Protect the routes that control the home
The most important security controls often sit outside the device itself. The router, email account, platform administrator, phone lock screen and recovery method can collectively control cameras, locks, automations and household information.
Keep the router and devices supported and updated, use unique account credentials and strong multi-factor authentication where available, restrict administrator access, remove former household or installer access and test recovery before an urgent need.
Secure the control chain in priority order
- Primary email and phone. These often receive sign-in approvals, password resets and account recovery messages.
- Router and Wi-Fi administration. Change unique credentials, install supported updates and disable remote administration or risky convenience features unless genuinely required.
- Smart-home platform administrators. Use separate named users, appropriate MFA and the fewest administrators needed.
- Manufacturer accounts and apps. Remove unused integrations, old phones, former residents, installers and shared credentials.
- Devices and hubs. Enable automatic updates where trustworthy, review alerts and replace products that no longer receive necessary security support.
Use household roles instead of one shared identity
Administrator
Can add devices, users, platforms and remote access. Keep this role limited and protect its recovery route.
Household member
Can use agreed functions without automatically receiving camera histories, billing or security settings.
Guest or temporary access
Should be time-limited, narrow and revocable without changing the access of the whole household.
Smart-home security checklist
- Router, hub and device models are recorded.
- Unsupported routers and high-consequence devices are replaced.
- Default or reused passwords are not accepted.
- Important accounts use appropriate MFA.
- Automatic updates are enabled or a manual update routine exists.
- Remote administration is limited to genuine needs.
- Guest Wi-Fi or network separation is used where appropriate and manageable.
- Phone and tablet lock screens protect household apps.
- Installers and former household members are removed promptly.
- Unexpected sign-ins, device sharing and camera access are reviewed.
- Recovery codes and manual access methods are protected and findable.
- A factory-reset and incident route is documented.
What product security information should be visible?
Useful manufacturers explain how long security updates are expected, how vulnerabilities can be reported, how the product authenticates users and devices, how data is protected and what happens at end of support. Country rules differ.
- NIST IR 8259 series, including the April 2026 revision of manufacturer activities.
- NIST IR 8425 consumer IoT profile.
- UK NCSC guidance on using smart devices safely.
- UK secure-by-design and PSTI information. UK baseline requirements have applied to relevant consumer connectable products since 29 April 2024.
- European Commission Cyber Resilience Act information. The main obligations apply from 11 December 2027, with reporting obligations from 11 September 2026.
Smart-home security FAQs
Should smart devices use a guest Wi-Fi network?
Network separation can reduce exposure, but it must still allow the devices, controller and phone to communicate as intended. Use router-supported guidance and test local control; a poorly understood setup can create failures without improving security.
What should I do if someone may control a smart device without permission?
Use a safe device or account to change important credentials, remove unknown users and integrations, review sign-in history, update or reset affected devices and contact the supplier. For stalking, domestic abuse, burglary or immediate danger, prioritise personal safety and contact appropriate local support or authorities.
How long should a smart device receive updates?
There is no universal period for every product. Check the manufacturer’s stated support period before buying and compare it with the expected useful life and consequence of compromise. Replace or isolate unsupported high-consequence devices.
Continue your smart-home decision
Use the next guide that matches the buying, compatibility, privacy, security, cost or resilience question you still need to resolve.
