Smart-home security is not one setting. It is a chain: your router, device accounts, firmware, cameras, voice assistants, remote access, cloud services, and the old devices you forgot were still connected.
The good news is that most of the highest-value protections are simple. This checklist is designed for a normal home, not a security lab.
1. Secure the router first
Your router sits between most internet-connected devices and the outside world. Change factory-default administrator credentials, use a strong unique admin password, and keep the router firmware current. The U.S. Federal Trade Commission recommends using modern Wi-Fi encryption such as WPA3 or WPA2 and keeping router software updated.
2. Use a unique password for every smart-home account
Do not reuse the same password across camera, alarm, lighting, thermostat, voice-assistant, and manufacturer accounts. A breach at one service should not become a key to the rest of the house. A password manager makes unique credentials practical.
3. Turn on multi-factor authentication when the service offers it
For accounts that can unlock doors, show camera feeds, disable alarms, or control the home remotely, a second authentication factor is especially valuable. Store recovery codes somewhere you can access if your phone is lost.
4. Enable automatic updates where you trust the vendor
Connected devices need security and compatibility fixes over time. Enable automatic updates when the manufacturer provides a reliable mechanism, or create a routine to check firmware regularly. An inexpensive device with abandoned software support can become an expensive weak point later.
5. Remove devices you no longer use
Old cameras, plugs, hubs, speakers, and appliances can stay online long after anyone remembers why they were installed. Disconnect retired devices and remove them from your accounts. The FTC specifically recommends disabling or disconnecting features and devices you no longer use.
6. Disable remote access you do not need
Remote control is useful, but it also creates another path into the system. If a product lets you disable remote administration or internet access and you only need local control, consider turning the unnecessary feature off.
7. Treat cameras as high-sensitivity devices
Security cameras and video doorbells may capture people, conversations, children, neighbors, and the inside of your home. Before buying, check whether the vendor encrypts account information, live streams, and stored recordings. The FTC also recommends strong passwords, software updates, and using available security features on the camera account.
8. Consider network separation for cameras and IoT gear
If your router supports a guest network, IoT network, or VLAN-style segmentation, separating less-trusted devices from personal computers and storage can reduce the damage one compromised device can cause. The FTC specifically suggests considering a separate network for cameras rather than placing them on the same network as computers or printers.
Do not create segmentation blindly: some local discovery and smart-home protocols need devices to communicate across network segments. If you use advanced network isolation, test the automations and local-control paths you depend on.
9. Review camera access logs if the product exposes them
Look for unfamiliar IP addresses, devices, or access times. The FTC recommends checking camera access logs for unauthorized activity where the manufacturer provides that capability.
10. Audit who has household access
Review family members, guests, contractors, old phones, former tenants, and shared accounts. Remove access that is no longer needed. Prefer individual invitations over sharing one master username and password.
11. Check microphone and voice-history settings
Voice assistants are designed to listen for a wake word, and cloud services may retain voice interactions according to their settings and policies. Review voice-history controls, microphone switches, personalized voice features, and data-retention options in the ecosystem you use.
12. Understand where recordings and events are stored
For cameras, doorbells, alarms, and sensors, ask:
- Is video stored locally, in the cloud, or both?
- Is a paid subscription required for history?
- How long is data retained?
- Can you delete stored clips and account history?
- What stops working if the subscription expires?
“Works locally” and “has local storage” are not the same thing. A product may process commands locally but still require the cloud for notifications, history, AI features, or remote access.
13. Minimize app permissions
Smart-home apps may request location, Bluetooth, local-network access, contacts, photos, microphone, or camera permissions. Some are needed for setup; others may not be necessary every day. Review mobile permissions after installation and remove access you do not want to keep.
14. Keep an inventory and recovery sheet
Maintain a simple list of devices, model numbers, ecosystem, hub or border-router dependency, account owner, subscription, and reset instructions. Keep Matter setup codes or other recovery codes secure. This turns a future router replacement, household handover, or account recovery into a manageable task instead of a scavenger hunt.
15. Factory-reset smart devices before selling or giving them away
Remove the device from your account, revoke household access, and perform the manufacturer’s factory reset before transfer. The FTC recommends removing administrative access and personal information when smart-home equipment changes owners.
A practical priority order
- Router admin password and current firmware
- Unique passwords for critical smart-home accounts
- Multi-factor authentication
- Camera and door-lock account review
- Automatic device updates
- Household access cleanup
- Old-device removal
- Cloud storage and subscription review
- Network separation where it can be implemented without breaking needed local communication
What to check before buying the next device
Security is easier when it is part of the purchase decision. Look for a clear update policy, encryption, multi-factor authentication, account/session management, a documented reset process, and transparent cloud/subscription requirements. For cameras, specifically check how live video and recorded footage are protected.
A smart home does not need to be disconnected from the internet to be private or secure. It does need deliberate accounts, maintained software, limited access, and an understanding of which services are trusted with sensitive data.
Primary sources and further reading
- FTC Consumer Advice — Securing Your Internet-Connected Devices at Home
- FTC Consumer Advice — How To Secure Your Home Security Cameras
- FTC Consumer Advice — Buying or Selling a Smart Home
This is general consumer-security guidance, not a guarantee that a particular product, network design, or service is secure.