Smart Home Security: A 10-Step Checklist for Your Home

Smart home security starts at the router, because every camera, speaker and bulb reaches the internet through it. CISA's home Wi-Fi guidance says to change the router's default username and password, use WPA3 Personal or WPA2 AES encryption, keep the firmware updated, and turn off remote management. The UK NCSC adds the device side: change default passwords, switch on two-step verification and automatic updates, and factory reset a device before you sell it. This is a settings walkthrough, with the trade-off for each choice, so you can decide what fits your home.

Nothing here needs special skills. Every step is a setting you can find in your router's admin page or the maker's app. Menus differ by brand and change over time, so where we say "in the app's settings", follow the maker's own help page for the exact path.

Do this now: a 10-step checklist

1. Change the router's login. CISA says to change the default router username and password. Trade-off: if you forget the new one, you may have to factory reset the router and set it up again, so store it in a password manager.
2. Check the Wi-Fi encryption. CISA says to confirm the router uses WPA3 Personal or WPA2 AES. If it is open, or uses WEP, WPA or WPA2 TKIP, ask your internet provider for an upgrade or buy a new router. Trade-off: older devices may not support the newest mode, so test before you switch everything.
3. Use a long Wi-Fi passphrase. CISA suggests 5 to 7 unrelated words totalling at least 16 characters, not reused elsewhere, and a network name with no personal details.
4. Update the router. CISA says routine updates protect against known vulnerabilities; turn on automatic updates if the router offers them. Trade-off: an update can briefly drop your connection, and CISA's guidance does not say how to time it, so pick a quiet hour if the settings allow.
5. Turn off the risky extras. CISA says to disable remote management, WPS, and UPnP (after any device that needs it during setup has been added). Trade-off: WPS and UPnP are conveniences that make some devices easier to connect, so you may need to enter a Wi-Fi password by hand.
6. Use the guest network for smart devices. CISA says to put smart home devices that only need internet access on the guest network, with its own long, unique password, so they cannot discover your other devices or reach router settings. Trade-off (our reasoning): some devices must be on the same network as your phone or hub to work, so test each one after moving it.
7. Change every device's default password. The NCSC says if a device comes with a default password, change it, and use something strong such as three random words. Turn on two-step verification for the device's app account where it is offered.
8. Turn on automatic updates on devices and apps. The NCSC says to switch them on if available and install manual updates when prompted.
9. Switch off what you do not use. The NCSC suggests switching off remote access if you do not need it when away from home Wi-Fi. Trade-off: you lose viewing and control away from home, so keep it only on devices where you value it. Also review the privacy settings in each maker's app.
10. Retire devices properly. Before selling or giving a device away, the NCSC says to factory reset it, which should also remove your personal data. Check the support date too: the NCSC compares it to a use-by date for the device.

Rehearse the choices, trade-offs included, in the Smart Home Security Lab, a scenario with fictional people where nothing real is at stake.

How to tell your smart home needs attention

These are practical signals, not proof of an attack. Any of them is a reason to run the checklist.

• You never changed the router login. If the admin password is still the one on the sticker, start there.
• You cannot remember what is connected. Open the router's device list and look for names you do not recognise. Not every unfamiliar name is a stranger; many devices show odd technical names, so check each against your own gadgets.
• A device has had no update for a long time, or the maker has stopped supporting it. The NCSC advises avoiding unsupported devices.
• Old gadgets are still plugged in and linked to accounts you no longer use.
• Everything is on one network, so a cheap plug sits beside the laptop where you do your banking.

Router, cameras, speakers: what each needs

The router

It is the front door. Beyond the steps above, CISA notes that anyone with physical access could factory reset the router and use the default settings, so keep it somewhere you control. Do not use a network name that gives away your name or address.

Cameras and doorbells

Change the default password, turn on two-step verification for the app account, and keep the firmware updated. Think about where the camera points and who can view it, and review who has been shared access in the app. The NCSC's advice on default passwords, two-step verification and updates applies to all of them.

Smart speakers and displays

These listen for a wake word, so treat them like a phone: strong account password, two-step verification, updates on. Look at the maker's privacy settings for recordings and history. The exact menu path varies by brand, so use the official help page for yours. Trade-off: turning off history or voice features can make the assistant less personal.

Plugs, bulbs and thermostats

Low-cost devices are good candidates for the guest network because they usually need only the internet. Check before you buy how long the maker promises support, as the NCSC recommends.

The old-device question

Not every old gadget should go in a drawer still logged in. Decide: keep, sell or recycle. If you keep it, update it and make sure it is on the guest network. If it no longer gets updates, the NCSC says to avoid unsupported devices, so retire it. If you sell or give it away, factory reset first so your accounts and data are removed, and remove the device from your app account too. If it is going to be recycled, factory reset it anyway.

Prevent it next time: a habit checklist

• Every new device: change the default password and turn on two-step verification before you stick it on the wall.
• Put internet-only devices on the guest network from day one.
• Once a quarter, open the router's device list and the apps' device lists, and remove anything you no longer use.
• Check the manufacturer's support date before you buy.
• Use a password manager so unique passwords are no extra work; compare ideas in the Password Strength tool and make new ones with the Password Generator.
• Turn on two-step verification for the main account tied to your smart home. For stronger sign-in, see the Passkey Lab.
• If an account is taken over despite this, move fast: the Account Takeover Lab walks through it.

Frequently asked questions

How do I secure my smart home?

Start with the router, since every device connects through it: change its default login, check it uses WPA3 Personal or WPA2 AES, keep its firmware updated, and turn off remote management. Then change the default password on each device, turn on two-step verification where offered, and switch on automatic updates. These are the steps CISA and the UK NCSC list.

Should smart devices go on a guest network?

CISA advises connecting smart home devices to the guest network if they only need internet access, so they cannot discover your other devices or reach router settings. The trade-off is that some devices need to be on the same network as your phone or hub to be controlled locally, so test each one after moving it.

Do I need to change the default password on a smart camera?

Yes. The NCSC says that if a device comes with a default password you should change it, and to use a strong one such as three random words. Turn on two-step verification for the app account if it is offered.

What should I do with an old smart device?

The NCSC says to factory reset a device before you sell or give it away, which should also remove your personal data. Also check whether the manufacturer still supports it: the NCSC compares the support date to a use-by date, and an unsupported device may no longer get security fixes.

Are smart speakers a security risk?

They are internet-connected microphones, so treat them like any device: strong account password, two-step verification, automatic updates, and a look at the privacy settings in the maker's app. The exact menus differ by brand and change, so use the maker's own help page.

Is it safe to leave remote access on?

The NCSC suggests switching off remote access to a device if you do not need it when away from your home Wi-Fi. For the router itself, CISA advises turning remote management off, which stops changes being made from outside your network. The trade-off is that you lose the convenience of viewing or controlling things away from home, so decide per device.

Sources

• CISA Project Upskill, Module 5: Securing Your Home Wi-Fi
• UK National Cyber Security Centre: Smart devices in the home

This is general guidance, not legal advice. Router and app menus change; follow your maker's official help page for current steps. Trade-offs marked as our reasoning are our own judgment, not statements by CISA or the NCSC.