A smart home lets you check the front door from work and switch off every light with one sentence. It also adds a dozen small computers to your network, many made by companies that spend little on security. A cheap camera or plug with an old bug in it can be the easiest way for someone to get into everything else.
You don’t need to be a security expert to fix most of this. These steps go from most to least important.
1. Lock down the router first
The router is the front door for every device you own, so start here.
- Change the admin password. This is the password for the router’s settings page, not the Wi-Fi password. Older routers shipped with defaults like admin/admin, and lists of them are public. Log in (the address is on the router’s label) and set a long, unique password.
- Use WPA3, or WPA2 at minimum. Under the wireless security settings, choose WPA3 or WPA2/WPA3 mode. Never use WEP or the original WPA; they can be cracked in minutes.
- Turn off WPS and remote management unless you actually use them. Both are common ways in.
- Use a network name that doesn’t identify you. “Smith Family WiFi” tells people whose network it is.
2. Put smart devices on their own network
Most routers can run a separate guest network, and some newer ones have a dedicated IoT network for exactly this. Put cameras, plugs, bulbs and speakers on it, and keep laptops and phones on the main network.
If a device on the separate network is compromised, it can’t easily reach the computers where your email and banking live. One catch: some devices need to be on the same network as your phone for local control or casting to work. If something stops responding, check whether your router has an IoT network option that allows it, or keep only those devices on the main network.
3. Use unique passwords and two-factor sign-in
Every smart device comes with an app and an account, and reusing one password across them means one leak opens them all.
- Use a password manager such as Bitwarden, 1Password or the one built into your phone, and let it create a different password for every account.
- Turn on two-factor authentication for every account that offers it, especially cameras, doorbells and your main smart home app (Google Home, Amazon Alexa, Apple Home, SmartThings).
4. Change device defaults during setup
Many cameras and network video recorders still arrive with a default password, especially older or unbranded ones. Change it during setup. In the UK, a law that took effect in April 2024 bans new connected products from shipping with a universal default password, but plenty of older stock is still around.
5. Switch off features you don’t use
Go through each device’s app and turn off anything you don’t need: remote access, public sharing links, guest access, or a camera’s “view from anywhere” web feature. Every feature that’s off is one less thing that can be attacked.
6. Keep everything updated
Firmware updates patch security holes, so they matter more than new features. Turn on automatic updates in each device’s app, and check once every few months for devices that don’t update themselves. If a brand has stopped releasing updates for a device, especially a camera, replace it.
7. Buy from brands that support their products
Before you buy, check how long the maker promises security updates and whether it has a history of fixing problems quickly. Devices that support Matter, the shared smart home standard, can be controlled locally and work across Apple, Google, Amazon and Samsung systems, which means you’re less tied to one company’s cloud staying online.
A five-minute checklist
- Router admin password changed, WPA2 or WPA3 on, WPS off.
- Smart devices on a guest or IoT network.
- A different password for every smart home account, with two-factor turned on.
- Remote and sharing features you don’t use switched off.
- Automatic updates on, and no devices the maker has stopped supporting.
