How to Secure Your Smart Home Devices

Smart plugs, cameras, and speakers are convenient right up until one gets compromised. These are the practical steps that actually reduce your risk.

Change every default password

The single most common way smart home devices get compromised is through default or reused passwords. Every camera, smart plug, and hub should get its own unique password set during setup — never leave a device on its factory default login, and don't reuse your email password across your smart devices.

Put smart devices on their own network

Most home routers sold in NZ, including models from Spark, One NZ, and retail routers from Noel Leeming and PB Tech, support a guest Wi-Fi network as a separate option in settings. Putting smart plugs, cameras, and speakers on this guest network keeps them isolated from your laptop and phone — if one device is ever compromised, it can't easily reach your more sensitive devices on the main network.

Turn on two-factor authentication

Any smart home app tied to a cloud account — Google Home, Amazon Alexa, Ring, or similar — should have two-factor authentication (2FA) switched on. This means even if someone gets your password, they can't log in without a code sent to your phone. It takes a couple of minutes to set up and is one of the highest-value security steps available.

Keep firmware updated

Manufacturers regularly patch security flaws in smart device firmware, but many devices don't update automatically. Check each device's app periodically for pending firmware updates, and where the option exists, switch on automatic updates so patches install without you needing to remember.

Review what each device can actually access

Smart home apps often request broad permissions during setup — camera access, location, contacts. Go through each app's permission settings and remove anything the device doesn't genuinely need to function. A smart bulb, for instance, has no legitimate reason to need your contacts list.

Be deliberate about cameras and microphones

Devices with cameras or always-on microphones deserve extra scrutiny. Position cameras to only capture what's necessary, use physical shutters where available, and check the manufacturer's data retention policy — some brands store footage in the cloud for weeks by default, which you can usually shorten in settings.

Retire old devices properly

When you replace a smart device, don't just unplug it and forget it — log out of its account, remove it from your app, and factory reset it before selling or disposing of it. Old devices left connected with stale credentials are an easy target if they're ever reactivated by someone else.

Watch for phishing aimed at smart home accounts

Because smart home accounts are tied to email logins, phishing emails pretending to be from Google, Amazon, or camera brands like Ring are common. Never click login links from emails — go directly to the manufacturer's app or website instead, and report suspicious emails through CERT NZ if you're unsure.