Securing a smart home network
Attackers work at scale. That single fact tells you which of your worries deserve an afternoon and which deserve none.
Attackers work at scale, which decides everything#
The single most useful idea in home security is that attacks are economic. Someone scanning the internet for exposed devices can try millions of addresses from a chair. Someone attacking your Zigbee mesh has to be within radio range of your house, and gets one house for the effort.
That asymmetry sorts the entire risk list for you.
| What people worry about | What actually happens |
|---|---|
| Someone sniffing my Zigbee or Z-Wave traffic from the street | Credential stuffing: a password reused from an unrelated breach, tried against your platform account |
| A hacker taking over a smart bulb | A camera or NVR exposed to the internet by port forwarding or UPnP and found by a scanner |
| Matter being cracked | A device with a default admin password and a web interface, recruited into a botnet |
| Someone unlocking my door over the air | A router past end of support, running firmware with a public exploit |
| The government listening through my thermostat | A stale account link or an abandoned integration nobody is maintaining |
None of the left column is impossible. All of it requires proximity, time and a specific target, which is why it is rare, and why the right column is where the effort belongs. The FTC's guidance for home networks reads the same way: change defaults, update firmware, turn off remote management, UPnP and WPS, and use a separate guest network.
The five controls that matter#
1. Unique passwords and two-factor on the platform account#
Your Apple, Google, Amazon, Samsung or Home Assistant account is the master key to everything attached to it, including cameras and locks. A password reused from any other site is the most likely way anyone gets in, because breach data is bulk traded and testing it is automated.
Use a password manager, one unique password per account, and turn on two-factor authentication everywhere it exists. Apple requires two-factor for HomeKit and iCloud, which is a design choice worth copying voluntarily elsewhere. This one control does more than the other four combined.
2. Never port forward, and turn off UPnP#
Port forwarding a camera, an NVR or a hub to the internet puts a login prompt in front of every scanner on Earth. UPnP is worse, because it lets a device open that hole without telling you. The FTC recommends turning UPnP off, and so do we.
The correct ways to reach your home remotely, in order of preference: the platform's own remote access (Apple's home hub, Home Assistant Cloud, a vendor relay), or a VPN back into your own network. Both give you an authenticated tunnel instead of an exposed service. Home Assistant users in particular should treat a directly exposed instance as a serious risk, because it is an administrative interface to the whole house.
3. Change default credentials on anything with a web interface#
Cameras, NVRs, PoE recorders, some access points, and any device with an admin page. This is the vector behind the large IoT botnets, and it persists because the devices are cheap, numerous and rarely touched after installation.
Standards-based devices are largely exempt from this problem, and it is worth understanding why. A Matter device is commissioned with a numeric passcode from its QR code and holds a device attestation certificate proving what it is, so there is no default password to leave in place. Z-Wave S2 pairing uses a device-specific PIN or QR code, the DSK. Zigbee 3.0 uses install codes, and Zigbee 4.0, announced in November 2025, adds Dynamic Link Key, a Device Interview step and a Restricted Mode. The devices with default passwords are almost always the ones with an IP web interface, not the ones on a mesh radio.
4. Update the router, then the hub, then everything else#
The router is the highest-value target in the house, because it sees all traffic and is reachable from outside. It is also the device most likely to be running firmware from three years ago. Check for updates, enable automatic updates if the vendor offers them, and retire hardware that is past end of support, because no configuration compensates for unpatched code.
Then your hub, which is the second most valuable target. Then devices. Device firmware is getting easier to manage: Homey added Device Updates in August 2026 that pull Matter firmware from the alliance Distributed Compliance Ledger, and Home Assistant surfaces updates for Matter, Zigbee and Z-Wave devices in one place. Where a vendor provides no update path at all, treat the device as disposable and keep it away from anything important.
5. Segment, with your eyes open#
Put IoT devices on their own SSID and, if your gear supports it, their own VLAN. The benefit is containment: a compromised camera cannot reach your laptop, your NAS or your hub's admin page.
The cost is discovery. Matter, HomeKit, AirPlay and Thread border router announcements all rely on mDNS multicast, and a VLAN boundary stops multicast dead unless you configure an mDNS reflector and get IGMP snooping right. Home Assistant's Matter documentation is explicit that the protocol expects a flat residential network and that multicast optimizations break discovery. Do this deliberately, with the recipe in the network setup a smart home wants, or do not do it at all. A half-configured VLAN produces months of intermittent failures that look like broken devices.
For most households, a much simpler version captures most of the benefit: a separate 2.4 GHz IoT SSID on the same subnet, a real guest network for visitors, and client isolation left off on the IoT network.
Device classes worth extra thought#
Cameras are the highest-consequence device and the one most often installed badly. Never expose one directly. Prefer local storage or an NVR, keep the recorder off the internet, change the admin password, and be deliberate about whether cloud analysis is worth the exposure. A camera pointed at a shared space is a different decision from one pointed at a bedroom door.
Locks are where people overestimate the digital risk and underestimate the physical one. A smart lock using Z-Wave S2 or Matter has real cryptography in front of it, and the door frame, the window and the key under the mat do not. Aliro, which arrived in Samsung Wallet's Digital Home Key in March 2026, brings a standardized credential model to phones and watches. The practical advice is unglamorous: audit your access codes, remove codes for people who no longer need them, and check that codes are validated on the lock rather than in a cloud service.
Hubs deserve one specific habit: take a backup you have actually tested restoring. That is a security control as much as a reliability one, because ransomware and a dead memory card have the same recovery path. Home Assistant and Hubitat both support this; Apple Home notably provides no way to export or back up a configuration.
Voice assistants and displays are covered in smart home privacy, and the security angle is mostly account security, because the assistant can act on everything the account can reach.
If you think something is compromised#
Work in this order.
- Change the platform account password and revoke active sessions. Start where the blast radius is largest, not where the symptom is.
- Audit third-party access. Remove account links and integrations you do not recognize or no longer use. Amazon's Smart Home API v2 retirement in November 2025 and Routines Kit retirement in May 2026 left plenty of stale links behind.
- Check the router for unexpected port forwards, changed DNS servers and unknown administrative users. Changed DNS is a classic and it is easy to miss.
- Factory reset the suspect device and re-pair it. Follow the unpair order in removing and re-pairing devices cleanly so you do not leave a ghost entry behind.
- Update firmware everywhere, starting with the router.
- Rotate access codes on locks and review the access log.
Can someone hack my Zigbee or Z-Wave devices from outside?
It is possible in principle and rare in practice, because it requires being physically near your house with specialist equipment, for one target. Modern pairing is properly secured: Z-Wave S2 uses a device-specific PIN or DSK, Zigbee 3.0 uses install codes, and Zigbee 4.0 adds a dynamic link key and a device interview step. Your account password is a far more likely route in.
Do I need a VLAN for my smart home?
Not for most homes. A separate 2.4 GHz IoT SSID and a real guest network for visitors gets you most of the containment with none of the multicast problems. A VLAN is worth it if you run cameras, an NVR, or devices from vendors you do not trust, and only if you are willing to configure an mDNS reflector and IGMP snooping correctly. Otherwise it causes more failures than it prevents.
Is Matter more secure than what it replaces?
On the pairing and control path, yes. Each device carries a device attestation certificate, commissioning uses a passcode from the QR code rather than a shared default, and control happens over an authenticated local session rather than a vendor cloud. Matter 1.6 added Product Security 1.1 in June 2026. It does not fix weak account passwords, exposed services or absent firmware updates.
Are cheap cameras dangerous?
The camera is usually fine. The installation is the problem. Cheap cameras are more likely to ship with a default password, a web interface, and instructions that tell you to port forward. If you change the password, keep it off the internet, and record locally to a recorder that is also off the internet, price is not the risk factor.
What is the single most important thing to do?
Put a unique password and two-factor authentication on the account that controls your smart home. It is more valuable than every network change on this page combined, because credential reuse is the mechanism behind most real compromises of home accounts.
Does turning off UPnP break my smart home?
Almost never. Smart home devices make outbound connections to their services, which UPnP is not needed for. UPnP exists mainly for games and peer-to-peer applications that want inbound ports. If something does break, you will know immediately and can decide whether that feature is worth an automatically opened hole.
How do I know if a device is still getting security updates?
Check the vendor's firmware release notes and the app's update history, and search the support site for your exact model. Silence for a year or more on a connected product means nobody is watching for vulnerabilities in it. That is also one of the warning signs in when a smart home company shuts down, which is not a coincidence.
Should I put my smart home devices on a guest network?
A guest network is designed to isolate clients from each other, which is exactly what you do not want for a smart home: your phone needs to reach your devices, and Matter and HomeKit need multicast to flow. Use a dedicated IoT SSID with client isolation off, and keep the guest network for actual guests.
Primary sources
Specification and vendor documentation we checked while writing this page. Where a claim depends on firmware behaviour rather than a published spec, the page says so inline.