Securing the smart home itself: the dull measures that work
The device most likely to let a stranger in is not your lock. It is an unpatched camera, a reused password or a forwarded port.
The device most likely to let a stranger into your home is not your lock. It is your router, your hub, or an unpatched camera on your network. Smart home security is usually discussed as burglary; the other kind matters too, and it gets far less attention.
The reassuring part is that the measures that actually help are few, dull and mostly free. Almost nobody needs anything sophisticated.
The realistic threats
It helps to be specific rather than alarmed, because the plausible risks are quite different from the dramatic ones.
Credential reuse. By far the most common route in. A password you used on a website that was breached is tried against your other accounts automatically, at scale. If that password protects an account that can unlock your door, this is the whole attack.
Default credentials. Devices shipped with a known username and password, connected to the internet, and never changed. This is how large numbers of cameras have ended up publicly viewable.
Unpatched firmware. A device with a known vulnerability, exposed to the internet, found by automated scanning. The scanning is constant and indiscriminate.
Deliberate remote exposure. Someone forwarding a port on their router so they can see a camera from work, thereby publishing it to everyone.
Cloud service breaches, which you cannot prevent and can limit by choosing what you put in the cloud.
What is not a realistic domestic threat: someone sitting outside your house cracking your Zigbee encryption. It is possible in a laboratory and it is not what happens. Spend your effort on the list above.
The five things that matter
1. Unique passwords, in a manager
The single highest-value action. Every account gets a different password, generated and stored by a password manager. This alone eliminates the most common attack.
Nobody remembers thirty passwords, which is the entire argument for a manager. Use one.
2. Two-factor authentication on anything that matters
Particularly on accounts that can open doors, view cameras or administer your hub. An app-based code or a hardware key is better than a text message, and a text message is far better than nothing.
3. Change every default, delete every unused account
New device: change the admin password before anything else, including on the router. Then when someone leaves the household, or a cleaner stops coming, remove their access properly. Stale accounts accumulate silently and are the commonest real-world weakness.
4. Keep firmware updated
Enable automatic updates where offered. Where they are not, check occasionally. This is the one ongoing chore in the list and it is the price of having network devices at all.
It also means not buying devices from manufacturers who never issue updates, and being willing to retire a device that has been abandoned.
5. Never forward a port to a camera or a hub
If you want remote access, use the manufacturer's proper remote service or a VPN into your own network. Port forwarding a camera publishes it, and search engines exist specifically for finding such devices.
Network separation, which is easier than it sounds
The idea: keep devices you cannot fully trust away from the devices that hold your data.
The simple version, available on almost any modern router: put smart home devices on the guest network and keep computers, phones and network storage on the main one. Guest networks usually isolate devices from each other and from the main network, which is exactly what you want. Two caveats — some hubs need to see devices on the same network to work, and casting or printing across networks often breaks, so test before committing.
The better version, if your equipment supports it: a separate VLAN for smart home devices, with specific rules allowing your hub to reach them. More work, more control.
Either way, the principle is worth holding: a cheap camera should not be on the same network as your work laptop. If the camera turns out to have a vulnerability, that separation is what limits the consequence.
Choosing devices with this in mind
Security is largely decided at purchase.
Prefer local operation. A device that works without a cloud account has a smaller attack surface and no third-party breach to worry about.
Prefer open protocols. Zigbee, Z-Wave, Thread and Matter devices talk to your hub, not to the internet. A sensor that has no internet connection cannot be attacked over the internet.
Check the update record. Has this manufacturer issued firmware updates for previous products, and for how long? Some now publish a support period, which is a genuinely useful signal.
Be wary of very cheap unbranded cameras. This category has a poor record on default credentials, hard-coded accounts and abandoned firmware.
Read what data leaves. Some apps request contacts, location and far more than the function needs.
Note that regulation is moving here. The EU Cyber Resilience Act and the UK's product security legislation both impose requirements on connected consumer devices, including bans on universal default passwords and obligations around update periods. Over the next few years that should raise the floor considerably; in the meantime, the manufacturer's own record is the best guide.
The hub is the crown jewels
Your hub can open locks, disarm alarms, view cameras and see when you are home. Treat it accordingly.
A strong unique password and two-factor authentication.
Separate accounts per household member with appropriate permissions, rather than everyone sharing an administrator login.
No unnecessary remote access. If you do not need to control the house from abroad, do not expose it.
Keep it updated, and prefer a hub whose maker ships updates reliably.
Back up the configuration. Not strictly security, and the difference between an afternoon and a fortnight if the hardware dies.
Review the audit log occasionally, if it has one, particularly after anyone leaves the household.
Voice assistants and cameras, honestly
Two categories where the privacy question is legitimate and often discussed unhelpfully.
Voice assistants listen locally for a wake word and send audio after it. The realistic concern is not constant surveillance; it is accidental activation sending a fragment of conversation, and human review of samples. Practical responses: use the mute button where it matters, review and delete recordings if the service allows it, do not put one in a bedroom if that bothers you, and do not enable door unlocking by voice.
Cameras are more consequential because footage is unambiguous. Prefer local recording, keep retention short, use physical shutters indoors, and activate indoor cameras only in away mode.
Both are reasonable to own. The point is to make the decision deliberately rather than by default.
If you are worried about someone with previous access to your accounts — a former partner, a former housemate, a previous occupant — revoking a code is not sufficient. Change the passwords on every account, enable two-factor authentication, remove every user and administrator you cannot account for, check for devices you did not install, and consider a factory reset of the hub. Domestic abuse support services in many countries now provide specific guidance on connected home technology, and it is worth asking for.
A one-evening checklist
- Install a password manager and change your hub, router and camera passwords to unique generated ones.
- Enable two-factor authentication on every account that can open a door or view a camera.
- Update the firmware on your router, hub and cameras, and turn on automatic updates.
- Check for port forwarding on your router and remove any you did not deliberately create.
- List every user account on every app and delete the ones you cannot explain.
- Move smart devices to the guest network, then test what breaks.
- Retire anything abandoned by its manufacturer, particularly cameras.
- Back up your hub configuration.
Items one and two take twenty minutes and address the overwhelming majority of realistic risk. The rest is worth doing and it is not where most incidents come from.