Printer Security: Essential Settings to Protect Your Network and Data

Why printer security matters

A printer is a network device that stores data, connects to other systems, and often sits on the network for years. Unsecured printers are a known target for attackers, who can use them to launch distributed denial-of-service attacks, exfiltrate data, or pivot to other machines. The first step is to treat the printer with the same seriousness as a computer. According to ENERGY STAR, an estimated 10 to 35 percent of pages printed in offices are never picked up, which is why the agency recommends the secure-print feature that locks output until the person who sent the job releases it. That simple feature prevents sensitive documents from sitting in a tray.

Beyond physical output, the printer's network interfaces can be attacked if left open. The Printer Working Group (PWG) develops standards like IPP Everywhere, which allow computers and mobile devices to print without vendor-specific drivers. IPP Everywhere includes authentication and access-control options, and the PWG has recently approved OAuth extensions for secure authentication. Knowing what your printer supports helps you secure it correctly. The first step is to check the manual or the printer's built-in web server to see what security settings are available.

Change the default admin password

The single most important setting is the administrator password. Most printers ship with a default password or none at all, leaving the management console wide open to anyone on the network. An attacker who gains admin access can change settings, exfiltrate data, or even install malicious firmware. Change the password as soon as you power on the printer, and use a passphrase that is at least 12 characters long with a mix of letters, numbers, and symbols. Do not reuse a password from another account.

If your printer offers role-based access, give regular users limited rights and reserve full admin privileges for the IT department or the person who manages the device. Many models also support authentication through LDAP or Active Directory, if your environment uses those. If not, at least require a PIN for the web interface. For a small office, a strong password and limited admin accounts are often enough.

Keep firmware updated

Firmware is the underlying software that controls the printer's functions. Like any operating system, it can contain vulnerabilities that are fixed by updates. Check the manufacturer's support website for new firmware versions, and apply them soon after they are released. Some printers can check for updates automatically, and you should enable that option when it is available. If you are buying a printer, look for one with a clear update policy and a straightforward way to apply patches.

Firmware updates also add features and improve compatibility with new operating systems. Because printers are connected to your network, an outdated firmware can be a risk to the whole environment. Set a reminder to check every few months, or use the automated update feature if your printer has one. For business printers, many vendors offer central dashboards that push updates to all devices. A printer that cannot receive updates is a security liability.

Disable unused ports and services

Every open port is a potential entry point. If you do not use the USB port, disable it. If you use Wi-Fi, turn off the wired Ethernet port (or vice versa). Disable cloud printing services you do not need, such as email-to-print or manufacturer cloud portals. Also turn off any legacy protocols like FTP or raw TCP port 9100 if you rely on more modern standards like IPP Everywhere. The Printer Working Group reports that 98 percent of printers sold today support IPP/2.0 and DNS-SD, so you can safely disable older protocols and still use modern discovery and printing.

If your printer has a built-in web server, use it to review the list of open services. You can usually disable telnet, SNMP, and other legacy management protocols, and require HTTPS for the management interface. Keep only the services you actually use. For a home printer, that might be just IPP and maybe AirPrint or Mopria, which rely on standard protocols. Disabling unused services reduces the attack surface without sacrificing functionality. To understand which connectivity options matter, see our printer connectivity explainer.

Use secure printing features

Secure print, also known as PIN release, is a feature that holds a print job on the printer until you enter a code at the device. ENERGY STAR recommends this feature to prevent papers from being left in the output tray. The same mechanism also ensures that sensitive documents are not visible to anyone passing by. When you send a confidential document, choose the secure print option, and only the person who knows the PIN can release the job.

For organizations that need access control, the Printer Working Group has defined IPP Shared Infrastructure Extensions, which allow centralized management and access control. The latest version includes OAuth authentication, which lets users authenticate through an identity provider. This is especially useful in enterprise environments where you want to restrict who can print to which printer. For most home and small office users, a simple PIN or passphrase is enough. To learn more about the underlying protocols, visit our network protocols guide.

Network and procurement considerations

The security features that matter most depend on your environment. For a home network, the most important thing is to use a strong Wi-Fi password and separate your printer onto a guest network if possible. For an office, consider placing printers on a dedicated VLAN and restricting access to the management interface to authorized IP addresses. Also, check whether the printer supports IPP Everywhere and Mopria, because these standards make it easier to keep drivers and protocols current.

When you buy a printer, look for one that offers firmware updates, a web interface that requires HTTPS, and the ability to disable unused ports. ENERGY STAR certification, while focused on energy efficiency, also indicates that the device meets basic power-management and duplexing requirements, which often go hand in hand with a thoughtful firmware design. You can find certified models from major brands, and the ENERGY STAR product finder lets you filter by features. For specific buying recommendations, see our best wireless printers and best laser printers guides.

What to pick for your use

Questions

What is the default admin password on most printers?

It varies by model. Many printers come with a default password like 'admin' or no password at all. You should change it immediately after setup to prevent unauthorized access.

How often should I update printer firmware?

Check every few months or enable automatic updates if your printer supports it. Firmware updates patch security vulnerabilities and improve compatibility.

What is secure print?

Secure print, also called PIN release, holds a print job on the printer until you enter a code at the device. ENERGY STAR recommends it to prevent sensitive pages from being left unclaimed.

Is IPP Everywhere secure?

Yes. IPP Everywhere is an industry standard developed by the Printer Working Group that includes authentication and access control, and recent OAuth extensions add identity-based security.

Do I need to disable ports I don't use?

Yes. Disabling unused ports such as USB or legacy protocols like FTP reduces the attack surface and is a recommended security practice.