Smart Home Security Checklist: Protect Your IoT Devices
Most smart home break-ins start with a default password, not a picked lock. This free, afternoon-long checklist closes the doors attackers actually use.
Table of contents
Every smart device you add is another tiny computer on your home network — and another door someone could try. The reassuring part is that locking those doors is mostly free, takes an afternoon, and relies on a handful of habits rather than expensive gear.
Smart home security is not just about cameras and locks watching the outside world. It is about the passwords, updates, network setup and account recovery that protect the system itself. A burglar picking a smart lock is rare; a default password and an unpatched device are common. This checklist follows the layered, risk-based approach the U.S. Federal Trade Commission lays out in its "Careful Connections" guidance and the practical steps state cybersecurity teams recommend for households.
Start with the network: your real front door
Your router is the gateway every device passes through, so harden it first.
- Change the router's admin password and Wi-Fi password from the factory defaults. Default credentials are published online; leaving them is the single most exploited weakness in home IoT.
- Use WPA3 (or WPA2 at minimum) encryption. The FTC's guidance emphasizes encrypting data in transit; on your network that means modern Wi-Fi encryption, not open or outdated WEP.
- Put smart devices on a guest or separate network. Network-isolation guidance widely recommends keeping IoT gadgets off the same Wi-Fi as your laptops and phones, so a compromised bulb or camera cannot reach your work files. Most routers offer a guest network in two taps.
- Keep router firmware current. Routers get security patches too, and an out-of-date router undermines everything behind it.
Lock down accounts, not just devices
The cloud account tied to your cameras, locks and assistant is often the softest target — break in there and an attacker does not need to touch the hardware.
| Account control | What it does | Priority |
|---|---|---|
| Unique password per service | Stops one breach from unlocking everything | Critical |
| Multi-factor authentication (MFA) | Blocks logins even if a password leaks | Critical |
| Password manager | Makes unique passwords actually practical | High |
| Reviewed account recovery | Prevents attackers resetting your way in | High |
| Removed old authorized users | Closes access for ex-roommates, old installers | Medium |
Enable MFA everywhere it is offered — for your camera app, your smart-lock account, your platform login and your email (because email recovers all the others). Security guidance from state cyber teams and the FTC alike treats strong authentication as a baseline, not an extra. A password manager makes the "unique password per service" rule realistic instead of aspirational; reusing one password across devices means one leak unlocks the whole house.
Keep firmware and apps updated
Updates are unglamorous and they are the highest-value habit on this list. The FTC's "Careful Connections" framework calls on manufacturers to monitor and address security risks over a product's life — but the patches only protect you if you install them.
- Turn on automatic firmware updates for every device that supports them.
- For devices that need manual updates, set a quarterly calendar reminder to check.
- Avoid devices the manufacturer no longer supports. An abandoned camera with no patches is a permanent hole; longevity of updates should factor into what you buy.
Mind permissions and exposure
- Review what each device and app can access — location, microphone, contacts, camera — and switch off anything it does not genuinely need. This is the data-minimization principle the FTC promotes, applied at home.
- Disable features you do not use, such as remote access, UPnP on the router, or cloud sharing, to shrink the attack surface.
- Check who you have shared access with. Cameras and locks let you invite household members; prune that list when people move out.
- For cameras specifically, prefer local storage and encrypted video where available — our camera privacy guide walks through what to look for.
Don't forget decommissioning
When a device leaves your home — sold, donated or trashed — it can carry your network credentials and account links with it.
- Factory-reset any device before you get rid of it.
- Remove it from your account and any automations so a stale entry cannot be exploited.
- De-authorize it from your platform and revoke its network access.
This closing step is easy to skip and quietly important: the New Jersey cyber guidance and FTC framework both treat the full device lifecycle — including retirement — as part of security, not an afterthought.
Watch for the quiet risks
A few exposures rarely make a checklist but cause real trouble. Knock-off and ultra-cheap devices often ship with hardcoded passwords, no update mechanism and opaque cloud connections — the FTC's enforcement history against insecure connected-device makers is a reminder that "it was cheap" is not a security strategy. Forgotten devices are another: an old smart plug from three apartments ago, still on the account, still on the network, never updated. And over-broad sharing quietly accumulates — every guest, installer or family member you grant access to is a standing key you have to remember to revoke.
There is also a human layer the technology cannot patch. Phishing emails that impersonate your camera or lock vendor try to harvest the very account credentials that control your home; treat any "your device needs re-authentication, click here" message with suspicion and log in through the official app instead. The strongest network in the world does not help if someone simply talks you out of your password. Pair the technical checklist below with that skepticism and you have closed the gaps attackers most often walk through.
Your quick-run checklist
Segment this by effort. Do today (15 minutes): change router and device default passwords, turn on MFA for cameras, locks and email, enable auto-updates. Do this week: move IoT devices to a guest network, install a password manager, review device permissions. Do quarterly: check for firmware updates, prune shared users, and reset/remove any device you no longer use.
Bottom line
A secure smart home is built from cheap, repeatable habits, not gadgets: change defaults, isolate devices on a guest network, turn on MFA, keep firmware current, and clean up when devices leave. Following the FTC's risk-based "Careful Connections" thinking, you protect the whole system — not just the lock on the door.
