Smart-Home Privacy and Security Checklist

The biggest smart-home security wins are simple: a strong, unique password and two-factor authentication on every account, automatic updates turned on, a secured router, and cameras and microphones placed with care. Work through this checklist once at setup and once a year after that.

This checklist is based on public guidance from the U.S. Federal Trade Commission (FTC) and the Cybersecurity and Infrastructure Security Agency (CISA) on securing connected devices and home networks, plus manufacturer documentation.

Accounts

• Use a unique, strong password for each smart-home account (a password manager helps).
• Turn on two-factor authentication (2FA) for your ecosystem account and every device maker's account.
• Share access through the app's household or sharing feature instead of sharing your login.
• Remove old household members, guests and former roommates from access lists.

Devices

• Change any default password a device came with.
• Turn on automatic firmware updates, or check for updates regularly.
• Before buying, check how long the maker promises security updates. Avoid brands with no stated support policy.
• Turn off features you don't use, such as remote access on a device you only use at home.
• Record the Matter setup code somewhere safe, not taped to the device where visitors can see it.

Router and network

• Change the router's admin password from the default.
• Use WPA2 or WPA3 encryption for your Wi-Fi.
• Keep router firmware updated; replace routers that no longer get updates.
• Consider a separate guest or IoT network for smart devices, if your devices still work correctly on it.
• Turn off remote router administration and UPnP unless you need them.

Cameras and microphones

• Point cameras only where you have a right to record. Avoid neighbors' windows and shared hallways unless allowed.
• Tell household members, roommates and guests where cameras are.
• Use privacy zones and schedules to turn indoor cameras off when you're home.
• Learn the speaker's microphone mute button and review and delete voice recordings in the app's privacy settings.
• Check where camera clips are stored and for how long. Some services offer end-to-end encryption; turn it on if available.

Apps and data

• Review which apps and services are linked to your smart-home account, and remove ones you no longer use.
• Check phone permissions: location access for routines is useful, but limit it to what you need.
• Read the privacy settings for data sharing and product improvement programs, and opt out if you prefer.

When you move, sell or give away a device

• Remove the device from your account.
• Factory reset it (see the manual).
• When you buy secondhand, reset the device before setting it up, so the previous owner loses access.

## How often to review

When	What to do
At setup	Every item in this list
Monthly	Accept pending app and firmware updates
Every 6 to 12 months	Review shared access, linked apps and camera placement
When someone moves out	Remove access, change shared codes, reset door lock codes

For a broader beginner overview, start with what to buy first.

Frequently asked questions

Can smart-home devices be hacked?

Any connected device can have vulnerabilities. Unique passwords, two-factor authentication, regular updates and a secured router greatly reduce the risk.

Do smart speakers listen all the time?

Smart speakers listen locally for a wake word and, according to their makers, only send audio after detecting it. You can mute the microphone and review or delete recordings in the app.

Should I put smart devices on a guest network?

It can add a layer of separation from your computers and phones. Some devices need to share a network with your phone or hub to work locally, so test after moving them.