When securing a new wireless router, which of the following should be changed FIRST?

Changing the default SSID is a good practice but is not the highest priority - an attacker who knows the default SSID still cannot access the router without valid credentials.

Adjusting radio power levels relates to signal coverage and interference management, not to preventing unauthorized administrative access.

Wireless routers ship with well-documented default usernames and passwords that are the same for all units of a given model and are freely listed in manuals and online databases. Changing the default password first prevents any unauthorized user on the network from logging into the router's admin interface and modifying all other security settings. All subsequent security hardening steps are meaningless if the admin account remains accessible via default credentials.

Modifying DHCP settings affects IP address distribution and is a secondary concern compared to securing admin account access.