Smart home devices are convenient and always connected, which makes weak defaults and old firmware more serious. A few setup choices make them much less useful to an attacker.
Does this affect you?
Use this for smart plugs, cameras, doorbells, speakers, locks, hubs, thermostats, and connected appliances from brands such as Amazon, Google, Ring, Wyze, TP-Link, and others.
One-time setup checklist
Do this for every new device, and revisit devices already in your home.
- Change default passwords during setup. Avoid admin, 1234, or passwords reused from other accounts.
- Put smart-home devices on a guest or IoT network if your router supports one.
- Turn on automatic firmware updates in the device app when available.
- Enable two-factor authentication for the hub or control account, such as Alexa, Google Home, Ring, or the manufacturer app.
- Turn off remote viewing or remote control features you do not use.
- Disable UPnP on the router if you do not specifically need it for another device.
Ongoing habits
A quick periodic review catches forgotten exposure.
- Review connected devices in the router app every few months.
- Review third-party skills and integrations in Alexa, Google Home, and device apps.
- Remove devices you no longer use from both the app and the network.
- Place cameras and microphones thoughtfully and review privacy settings.
- Watch for manufacturer security bulletins and update prompts, especially for cameras and doorbells.
More control
Choose supported brands
Some low-cost brands stop firmware updates quickly. Devices that remain online for years need vendors with a track record of patching.
Network separation limits damage
If a smart plug or camera is compromised on a flat network, it may be able to probe computers and phones. A guest or IoT network limits that reach.
Review recordings and privacy
Smart speakers and cameras may store voice clips, motion events, or video. Check the app for recording zones, microphone settings, and deletion controls.
Sources
- FTC Consumer Advice – Securing your internet-connected devices at home (2025)
- CISA – Securing the Internet of Things (2024)
- FBI – Securing smart devices in your home (2025)