The short answer

For most homes, the useful order is: identify the device and its consequences, change the account and device defaults, install updates, put it on the least-trusted network that still works, reduce data collection, and write down the baseline. This is risk reduction, not a guarantee of safety. A guest Wi-Fi network is not automatically a complete firewall, and “local” does not automatically mean secure.

This guide is for household devices such as cameras, speakers, plugs, thermostats, doorbells, and hubs. Router menus differ by brand. Do not change electrical wiring, defeat a safety interlock, expose an admin panel to the public internet, or keep experimenting with a device that may be compromised.

1. Triage the device before connecting it

Make a one-minute inventory: manufacturer, model, companion app, account owner, camera or microphone, location access, cloud storage, physical reset method, and what the device can control. A bulb and a smart lock should not receive the same setup decision.

Device or capability	First priority	Stop and investigate when
Smart bulb or plug	Change credentials, update, isolate	The app requires broad permissions unrelated to control
Speaker or camera	Review microphone/camera access and cloud retention	You cannot explain who can view recordings or invite users
Thermostat or heater control	Preserve manual safety controls and update support	The device is unsupported or the safety state is unclear
Lock, alarm, or garage controller	Unique accounts, MFA, recovery plan, and local fallback	A failure could lock someone out or create a physical safety risk

The FTC has found that many surveyed smart products did not clearly disclose how long software updates would be provided. Treat an unknown support period as uncertainty, not as evidence that updates will continue. Check the vendor’s support page before buying or installing a high-consequence device.

2. Make the account and device harder to misuse

Before pairing the device, use a unique password and enable MFA when the service offers it. Store recovery codes somewhere you can reach if the phone is lost. Remove old household members and shared accounts. Never reuse the router password for a device account.

Install firmware from the manufacturer’s normal update path. Do not follow update files or “support” instructions from an unsolicited message. Turn off remote administration, unused integrations, and permissions that do not serve the device’s job. For cameras and microphones, check whether recordings are retained, where they are stored, and which household members can access them.

The Australian Cyber Security Centre’s IoT guidance recommends checking update support, changing default credentials, using secure networks, and reviewing privacy settings. Those are sensible baseline controls, but individual menus and service guarantees still need verification from the device maker.

3. Put the device on a contained network

If your router supports it, create a guest Wi-Fi network or IoT VLAN. Disable guest access to the main LAN if the router exposes that choice. Keep trusted computers, NAS storage, and router administration on the main network. Add cross-network exceptions one at a time for a known need such as casting or a local controller; test the feature after each change.

If you cannot create a separate network, keep the device updated, disable unnecessary remote access, and do not treat the shared network as contained. A consumer guest network may still permit discovery or local communication depending on the router. If you need VLAN firewall rules and do not understand the traffic flow, stop at the router documentation rather than copying an arbitrary configuration.

4. Record a small, useful baseline

Write down the date, firmware version, network name, account owner, enabled integrations, expected cloud service, and whether the device should be reachable from outside the home. A baseline helps you notice a new login, a changed setting, or an unexpected connection; it does not prove that traffic is safe.

An illustrative example: if a camera normally talks to its vendor cloud and your phone, a new outbound destination is a reason to check the vendor documentation and router logs. It is not by itself proof of compromise. First confirm time zones, firmware updates, backups, and household changes. If the device controls entry, heat, or safety equipment, preserve logs and use the manufacturer’s incident process or a qualified professional.

5. Use a maintenance rhythm

Once a month, review device inventory, account members, MFA, firmware, privacy permissions, and cloud retention. Once a quarter, remove abandoned devices, rotate credentials after a household change, and check whether the vendor still supports the model. The two-factor authentication guide covers recovery-code and lost-device planning; the home Wi-Fi guide helps separate a coverage problem from a security configuration problem.

When to stop

Pause the setup if the device has an unknown owner, cannot be updated, requests permissions unrelated to its function, exposes an admin page directly to the internet, or behaves differently after a reset. Disconnecting power may be unsafe for some devices; use the manufacturer’s shutdown procedure where relevant. For locks, alarms, heaters, medical-adjacent devices, or suspected compromise, keep a safe manual fallback and seek qualified support rather than guessing.

The goal is a documented, reversible setup: know what the device does, limit who and what it can reach, and retain a way to recover when an update or integration fails.

Take it with you

• Download the home IoT security checklist

  A plain-text setup and review checklist for connected devices.