Your home is full of computers you never think of as computers: the smart TV, the video doorbell, the voice speaker in the bedroom, the WiFi-connected baby monitor, even the smart bulbs. These IoT (Internet of Things) devices are convenient — and they are also the weakest link in most home networks. They ship with poor default security, rarely get updated, and sit on the same network as your phone and laptop. Attackers know this. This guide shows you how to lock down every smart device in your home, step by step — a purely defensive guide for protecting your own household.
1. Why Smart Home Devices Get Attacked
Understanding the risk makes the fixes obvious. Smart devices are attractive targets because they are always on, always connected, and often forgotten:
- Weak default credentials: many cameras and routers ship with usernames like admin and passwords like admin or 1234. Automated bots scan the entire internet trying exactly these combinations — compromised within minutes of being plugged in.
- No update habit: unlike your phone, a smart bulb never nags you to update. Old firmware contains publicly known vulnerabilities that never get patched.
- Always listening or watching: speakers, cameras and doorbells collect audio and video by design. If the account or device is compromised, an attacker gets a live feed into your home.
- Bridge into your network: a hacked smart plug sits on the same WiFi as your laptop and phone, giving attackers a foothold to attack everything else.
The fixes below address each of these. None of them requires technical skill — just an afternoon and this checklist.
2. Change Every Default Password — Today
This is the single most important step. For every smart device and its companion app:
- Open each device's companion app and go to its account/profile settings. Change the password to something long and unique — use a password manager so you never reuse one.
- Check whether the device itself has a separate admin login (common on cameras and routers). If the manual mentions a default like admin/admin, change it immediately.
- Turn on two-factor authentication (2FA) for every smart-home account that offers it — Google Home, Amazon/Alexa, Ring, and others all support it. See our 2FA guide for setup help.
3. Update Firmware on Every Device
Firmware is the device's operating system, and updates fix security holes. Do a full pass:
- Open each companion app and look for Settings → Device → Check for updates (or similar). Update everything — TV, doorbell, cameras, speakers, plugs, bulbs.
- Turn on automatic updates wherever offered, so future fixes install without you remembering.
- Check your router's firmware too — log into the router admin page (usually 192.168.1.1 or 192.168.0.1) and look for a firmware update option. Our WiFi security guide walks through full router hardening.
4. Put Smart Devices on a Separate Network
The professional defense is network segmentation: smart devices get their own WiFi network, separate from your phones and computers. Then even if a cheap smart bulb is compromised, the attacker cannot reach your laptop.
- Use the guest network: most modern routers have a guest WiFi option. Create one (e.g. "Home-IoT"), give it a strong password, and connect all smart devices to it instead of your main network.
- Disable guest-to-main access: in router settings, ensure the guest network cannot see devices on the main network ("AP isolation" or "client isolation" — enable it).
- Keep the router admin interface off the guest network so a compromised device can't reconfigure your router.
This one change neutralizes the worst-case scenario: a hacked device becomes a dead end instead of a bridge.
5. Lock Down Cameras and Microphones
Cameras and voice assistants deserve extra attention because of what they observe:
- Disable cloud recording you don't need: if your camera uploads clips to the vendor's cloud, review the retention settings — shorter retention means less footage exposed in a breach.
- Use privacy shutters and mute buttons: indoor cameras with physical shutters and speakers with hardware mute buttons are worth choosing. Use them when you're home.
- Review voice recordings: Alexa and Google keep voice history. Delete old recordings in the app settings and turn on auto-delete (e.g. every 3 months).
- Check camera sharing: make sure you haven't shared camera access with old accounts, ex-housemates, or installers who set the device up. Remove anyone who shouldn't have access.
- Baby monitors: prefer models that work over your local network or a paired parent unit rather than streaming through a vendor's cloud. If yours is cloud-based, ensure its account has a strong password and 2FA.
6. Audit What Each Device Can Do
Smart devices accumulate permissions like apps do. Quarterly, review:
- Third-party integrations: in your Google Home or Alexa app, check which third-party services are linked. Remove anything you don't recognize or no longer use — each link is another company holding access to your home.
- Location permissions: doorbell and thermostat apps often request always-on location. Restrict it to "while using the app" unless geofencing automation genuinely needs it.
- Old devices: sold a smart speaker or gave away a camera? Remove it from your account before handing it over, and factory-reset it. A device still linked to your account is a backdoor.
7. Buy Smart: Security Checklist for New Devices
The cheapest no-name camera is cheap for a reason. Before buying any smart device:
- Brand with a security track record: established vendors publish security updates and vulnerability disclosures. Obscure brands often never patch anything.
- Automatic updates promised: check the product page or manual for update support and how long the vendor commits to providing them.
- Local control options: devices that work without a cloud account (local network control) expose less of your data.
- No mandatory cloud subscription for basic function: if a doorbell can't show you who's at the door without a monthly fee, the business model is your data — think twice.
8. The 30-Minute Smart Home Security Routine
Do this once, then repeat every three months:
- Change or verify passwords on every smart-home account; confirm 2FA is on.
- Run firmware updates on all devices and the router.
- Confirm all IoT devices are on the guest/IoT network, not the main one.
- Review camera sharing lists and third-party integrations; remove the unused.
- Delete old voice recordings; check auto-delete is enabled.
- Factory-reset and unlink any device you're no longer using.