Router on InSSIDer

[#1]

According to my Android app InSSIDer my router is using the security protocol WPA + WPS and is considered hackable as it's showing the broken padlock symbol.
When I look in the router via admin it is only using WPA PSK which is of course secure. Nothing to do with PlusNet I know but why is InSSIDer picking up WPS when that is just a short utility to connect other devices then it turns off ?
I did recently use WPS to increase my home WiFi signal via a pair of TP-Link range extenders.

[#2]

There are different methods to connect a device using WPS. One way requires pressing buttons, another way requires entering an 8 digit PIN number.
WPS being enabled could mean that the WPA key doesn't need to be cracked, instead gaining access to the wireless is reduced to needing to guess a 4 digit number then a 3 digit number (the 8 digit PIN number is split in half and one of the digits is a check number calculated from the other 7 digits). The android app doesn't know that the technicolor implementation of the WPS protocol should be adequately secure because it locks out the WPS function after a few incorrect guesses.
WPS may also give away other information potentially useful to someone trying to gain access, such as the model number and serial number of the router (although I think the 10.2.5.2 firmware no longer gives away the serial number). Disabling WPS is the most secure setting.

[#3]

It could also be that the symbol isn't referring to how secure WPS is, it could be indicating the value of the "AP Setup Locked" field.

[#4]

I did look through the router area but I couldn't see where to disable it. That was the main reason for my query.