Locking down your smart home cameras and video doorbells

Why this matters to you

Your 2-minute quick win

Open the app for your camera or video doorbell and go to its settings or system area. Find the password setting and change any default password to a new one made from three random words. You have done it right when the old default no longer works and the app accepts the new sign-in.

Smart cameras and video doorbells connect to your home Wi-Fi so you can watch a live feed, get alerts, and sometimes record footage. That same internet connection also creates risk if the device is left on weak settings.

The UK National Cyber Security Centre says some cameras are shipped with a default password set by the manufacturer. Those passwords can be well-known or easy to guess, such as 'admin' or '00000'.

If a criminal can use that password, they may be able to access the camera remotely. In rare cases, that can let an unauthorised person view live video or images from inside or around your home.

The risk is not only the camera feed itself. The NCSC also warns that a guessed device password can help someone use the device to access your network or conduct cyber attacks.

Video doorbells raise the same basic issues. They are smart cameras at your front door, often linked to an app, an online account, and remote viewing over the internet.

This guide focuses on the small settings that make the biggest difference. You do not need advanced tools. You do need to stop using defaults, keep software current, and switch off features you do not need.

What you are protecting

You are protecting your privacy first. A live feed can show when you are home, when you are away, who visits, and how your rooms are laid out.

You are also protecting recorded footage and snapshots. If your device stores clips, motion images, or alert history, that material can reveal routines and habits.

Your login matters as much as the lens. The app account for a video doorbell often controls alerts, viewing, settings, and sharing.

You are also protecting your wider home network. The NCSC says a criminal who can log into a smart device may use it to access your network or to conduct cyber attacks.

Support life matters too. The NCSC advises avoiding devices that are no longer supported by the manufacturer, or whose support period will end soon. It describes the support date as a kind of use-by date for safe use.

That means security is not just about what happens on day one. It is also about whether the maker still releases fixes when bugs or security issues appear.

Finally, you are protecting the people around you. Family members, visitors, and neighbours may be captured by a camera even if they never installed the app themselves.

What it costs you if you skip this

The most direct cost is loss of privacy. An outsider may be able to watch a live feed or view images that should stay inside your home.

You can also lose control of the device itself. If someone else gets into the account or camera settings, they may change options before you notice.

Skipping updates adds another cost. The NCSC says manufacturers release updates to fix bugs or security issues, and without those fixes a device becomes easier to hack.

Keeping remote access on when you do not need it also expands your exposure. The NCSC recommends switching off remote access if you do not need to use the device away from your home Wi-Fi.

There can be knock-on effects for the rest of your network. A weak smart device can become a stepping stone because it sits inside the same home network as other internet-connected devices.

Old hardware has a hidden cost too. Once support ends, the maker may stop issuing updates, and the device may become easier to attack or may stop working altogether.

There is also the cost of clean-up. You may need to reset the device, rebuild settings, reconnect it to your app, and check every account linked to it.

All of that takes far more time than changing a password and enabling automatic updates when you first install the device.

Step by step

1. Find the device in its mobile app and open the settings or system area. Look for sections named 'Settings', 'System', 'Software', 'Firmware', or 'Update'. Done correctly, you can see the device controls rather than only the live video screen.

2. Change any default password at once. Use three random words you will remember, and avoid common passwords. Done correctly, the app saves the new password and the old default no longer signs in.

3. Turn on 2-step verification if the device or app offers it. The NCSC notes this may also be called multi-factor authentication or MFA. Done correctly, the app asks for a second check when you sign in, not just the password.

4. Check for software updates right away. Some makers use the word 'firmware' instead of 'software', so look for both labels. Done correctly, the app shows the latest version is installed or starts an update.

5. Enable automatic updates if that option is available. This matters because manufacturers release updates that fix bugs and security issues. Done correctly, the update screen shows automatic updates as on.

6. Decide whether you really need remote access away from home Wi-Fi. If you do not, switch off the 'remote access' functionality. Done correctly, the app shows remote viewing is disabled, and the device works only when you are on your home network.

7. Check whether switching off remote access changes other features. The NCSC warns it may stop movement alerts or break links with smart home devices such as Alexa, Google Home, or Siri. Done correctly, you know which features still work before you rely on them.

8. Open your router settings and look for 'connected devices' or a similar list. This helps you confirm which camera or doorbell is actually on your network. Done correctly, you can see the device listed among the items connected to your router.

9. In the router settings, look for 'UPnP' and 'port forwarding'. The NCSC says these technologies can be exploited to potentially access devices on your network, including smart cameras. Done correctly, you know whether either feature is enabled.

10. Consider disabling UPnP and port forwarding on the router if you do not need them. Done correctly, the router saves the setting, though you should expect that some apps, media servers, games, or smart devices may stop working as before.

11. Check the manufacturer support period for the device on the maker's website. The NCSC advises avoiding products that are no longer supported or close to the end of support. Done correctly, you know whether the device still has security support ahead of it.

12. Keep the manual or support page for your exact model. The NCSC says setup details may be in a printed guide, inside the app, or on the manufacturer website. Done correctly, you know where to look when you need update, reset, or support steps later.

13. If you use an older camera and cannot find the password setting in the app, try the browser method described by the NCSC. Type the camera IP address into your browser after finding that address in the router's connected device list. Done correctly, the camera login page opens in your browser.

14. If you sell or give away the device, perform a factory reset first. The NCSC says this returns the device to original settings and should remove your personal data. Done correctly, the device starts again as if it were new and no longer shows your account details.

Illustrative example

Emma buys a video doorbell for her flat because she wants delivery alerts when she is out. She installs the app, connects the device to her home Wi-Fi, and can already see the live front door view.

Before she mounts it permanently, she opens the settings area in the app. She finds the password option, changes the default to three random words, and saves it.

Next, she looks for account protection. The app offers 2-step verification, so she turns it on and completes the extra sign-in check.

She then goes to the update screen. The app uses the word 'firmware', not 'software', so she installs the available firmware update and enables automatic updates.

Emma thinks about remote access. She wants alerts while away, so she keeps remote viewing on, but she makes a note that this feature increases exposure compared with local-only use.

After that, she signs into her router and opens the list of connected devices. She confirms the new doorbell is present, then checks whether UPnP and port forwarding are enabled.

She sees UPnP is on by default. Because she does not use media servers or special gaming features, she disables UPnP and leaves port forwarding off.

Finally, she checks the manufacturer support page for her exact model. She keeps the support link so she can find update and reset instructions later if something goes wrong.

The outcome is simple but important. Emma still gets the convenience she wanted, but she has removed the easiest paths into the device and reduced the chance of someone reaching it through weak network settings.

The near-miss

Now replay Emma's setup with one skipped check. She installs the video doorbell, keeps the remote features, and never changes the default password because the live view already works.

Weeks later, she notices odd sign-in prompts and starts worrying that something is wrong. She has no proof of who tried to access the device, but she does know the account was still relying on a manufacturer-set default.

She goes back into the app, changes the password, enables 2-step verification, and installs pending updates. She also checks the router for UPnP and port forwarding because she now realises the device was more exposed than necessary.

The concrete consequence of skipping the first check is lost time and uncertainty. Instead of a two-minute fix on day one, Emma has to treat the device as potentially unsafe and work through recovery steps.

How to check it worked

Signs your setup is safer now

Open the app and confirm the password is no longer the one printed in the box or listed in the manual. A successful password change means the original default no longer grants access.

Visit the update or firmware screen and check the current status. You want to see that the latest available update is installed and automatic updates are enabled if the device supports them.

Look at the account or security section in the app. If 2-step verification is available, it should show as on.

Test your remote access choice. If you turned remote access off, check from outside your home Wi-Fi and confirm you cannot view the live feed remotely.

Check the router settings again. If you chose to tighten the network side, UPnP should show as disabled and port forwarding should not point to the camera unless you made a deliberate choice to keep it.

For older cameras managed through a browser, verify that you can reach the login page only using the current details you set. If you had to use the device IP address, save that method somewhere safe for later maintenance.

Test yourself

Question: What is the fastest first step if your camera came with a default password?

Answer: Change it in the app or device settings to a secure password made from three random words.

Question: What should you do if the app offers 2-step verification?

Answer: Turn it on, because it adds a second check and makes access harder even if a password is known.

Question: When should you switch off remote access?

Answer: Switch it off if you do not need to view the camera when away from your home Wi-Fi.

Common mistakes

Leaving setup at the first working state

Many people stop as soon as the live view appears on screen. That is the moment when the device works, not the moment when it is safely configured.

Assuming all devices ship securely

The NCSC says some cameras are shipped with default passwords, and older devices may still rely on them. Never assume the manufacturer has already chosen a safe password for you.

Missing updates because the maker says 'firmware'

Some people look only for a menu called 'software update' and miss the update screen entirely. The NCSC says the same function may be labelled 'firmware', so check for both words.

Keeping remote access on by habit

Remote viewing is useful, but it should be a decision, not a default. If you never watch your feed away from home, turning the feature off removes one route into the device.

Ignoring router settings

It is easy to focus only on the camera app and never open the router admin page. The NCSC specifically warns that UPnP and port forwarding can be exploited to potentially access devices on your network.

Buying a device near the end of support

A cheap older doorbell can cost more in effort later. If the support period ends soon, updates may stop soon too.

Passing the device on without a factory reset

If you sell or give away a smart camera, do not just unlink the app and walk away. Perform a factory reset so the device returns to original settings and should remove your personal data.

Level up

Your next step is simple: check the support end date before you buy your next smart camera, not after it is already on your wall. The NCSC notes that, from 29 April 2024, new UK law requires basic cyber security measures for smart devices and includes stating the product support end date, which makes this check easier for buyers.

If two doorbells seem similar, choose the one with a clearer support period and the security options you will actually use, such as automatic updates and 2-step verification. The best smart home security choice is often the device you can keep supported and configured safely for years, not the one with the longest feature list.