Since April 2024, UK law has required manufacturers to state how long a smart device will keep receiving security updates, and the National Cyber Security Centre tells owners to treat that date as a use-by date because a device past support is easier to hack. That single rule explains the shape of modern smart home security: the device you buy matters, but what you do after unboxing matters more.
A typical home now runs smart security cameras, a video doorbell, speakers, plugs, bulbs and a television on one router, and each is a small computer that can be misconfigured. This guide gives you 10 steps to secure your smart home devices, a table of which settings matter for which gadget, and a plan for what to do when a device is old or compromised.
Why Smart Home Security Matters More Every Year
Smart devices collect video, audio, schedules and habits, which makes them valuable targets and sensitive in the wrong hands. A weak camera password can expose a living room, and a compromised speaker or plug can become a foothold on the home network. Attackers also use poorly protected devices as stepping stones, so the risk is not only to the gadget but to every phone and laptop on the same Wi-Fi.
The security picture is improving through regulation and labelling, but it is uneven, and most devices already in homes predate those rules. Our overview of smart home tech covers the products themselves, while this guide focuses on locking them down. If criminals are already using AI to find weak targets faster, the same shift is covered in our report on how hackers use AI now.
The 10 Steps to Secure Your Smart Home
Step 1: Change default passwords
The NCSC advises changing any default password when you first set up a device and using a strong, unique one, such as three random words combined. Do the same for the router and the companion app. Store the passwords in a password manager so you do not need to remember them.
Step 2: Turn on automatic updates
The NCSC recommends enabling automatic updates where the device offers them, and installing manual updates when prompted. Updates fix known flaws, so a device that never updates stays exposed to problems that have already been published.
Step 3: Enable two-step verification
Where the device or its app supports it, turn on two-step verification. The NCSC notes that it makes it much harder for attackers to get in even if they know your password, which matters for camera and doorbell accounts that hold video history.
Step 4: Switch off remote access you do not need
If you never check a device from outside the house, turn off remote access, as the NCSC advises. Fewer open doors means fewer ways in.
Step 5: Put smart devices on a separate network
Most modern routers support a guest or separate network. Putting speakers, plugs and cameras there keeps them away from your laptops and phones, so a compromised bulb cannot see your banking device. Name the network clearly and give it its own password.
Step 6: Secure the router first
Everything flows through the router, so change its admin password, use the strongest Wi-Fi encryption it offers, keep its firmware updated, and disable features you do not use. If the manufacturer no longer supports your router, replace it.
Step 7: Review privacy and microphone settings
Open each app and check what is recorded, stored and shared. Disable cameras and microphones you do not use, shorten cloud storage retention, and turn off voice purchasing if you do not want it.
Step 8: Check support dates before you buy
The NCSC advises reading product and manufacturer reviews and avoiding devices that are out of support or will soon lose it. Check how long updates are promised before you pay, because a cheap device with a short update window is not a bargain.
Step 9: Retire devices when support ends
The NCSC says to treat the support end date as a use-by date, because after it a device is easier to hack and may stop working. Replace cameras, doorbells and routers that no longer get updates, and recycle the old unit properly.
Step 10: Factory reset before you sell or give away
The NCSC advises a factory reset first to remove your personal data. Also remove the device from your account in the app, so the new owner cannot see your video or settings.
Which Setting Matters for Which Device
| Device | Top risks | Priority settings |
|---|---|---|
| Smart security cameras | Exposed video feeds, weak logins | Unique password, two-step verification, limited cloud sharing, no unnecessary remote access |
| Video doorbell | Account takeover, shared clips | Two-step verification, review shared users, check motion zones and storage |
| Smart speakers and displays | Always-on microphones, voice purchases | Mute when not in use, delete recordings, restrict voice purchasing |
| Smart plugs and bulbs | Weak firmware, network foothold | Separate network, automatic updates, disable unused cloud features |
| Smart TV | Tracking, outdated software | Update software, review privacy and ad settings, turn off unused microphones |
| Router | Single point of failure | Admin password, strong encryption, firmware updates, guest network |
Warning Signs a Device May Be Compromised
Unexpected camera lights or movement, settings you did not change, login alerts from places you have not been, and devices that slow or reboot without cause are common signs. If you suspect a problem, check the manufacturer’s website for guidance and reset the device if you believe someone has taken control, as the NCSC advises. Change the account password from a different device, review linked accounts, and update the router.
If login details for a device account may have leaked in a larger incident, treat it like any other breach. Our data breach response guide walks through the steps, and our explainer on stolen data on the dark web shows why reused passwords are the main danger.
Buying Smarter: A Short Pre-Purchase Checklist
Before buying a camera, doorbell or hub, check that it supports two-step verification, receives automatic updates, states a clear support end date, and lets you control cloud storage. Prefer brands that publish a security contact and fix reported flaws publicly. Be careful with unknown brands sold only through marketplaces, where support can disappear along with the seller. Look for independent security labels where your country has them, and keep the receipt and manual so you can reset the device later.
