Home Assistant is local-first, but local does not automatically mean secure. An installation limited to your home network has a much smaller internet attack surface than one exposed publicly, yet it may still control locks, alarms, garage doors, cameras, heating and appliances—and store credentials, tokens, household routines and complete configuration backups.
Start with these five controls: use unique passwords and separate accounts, enable multi-factor authentication (MFA), keep Home Assistant and its host updated, avoid direct internet exposure, and maintain encrypted off-site backups with the recovery key stored separately.
As an Amazon Associate I earn from qualifying purchases.
What Home Assistant security protects
A Home Assistant instance can contain or control:
- Door locks, garage doors, alarms and cameras
- Presence, occupancy and household schedules
- Family-member names and locations
- Wi-Fi credentials, API keys, certificates and cloud tokens
- Voice-assistant data and automation logic
- Backups containing much or all of the configuration
Security therefore has four dimensions:
- Confidentiality: preventing unauthorized access to data.
- Integrity: preventing changes to automations, accounts and devices.
- Availability: recovering after hardware failure, corruption, ransomware or a failed update.
- Safety: preventing software or automations from causing physical harm or property damage.
HTTPS is useful, but it addresses only part of this problem.
Home Assistant’s security documentation covers strong passwords, MFA, secrets management, updates, remote access, SSH and host hardening.
#1 Best Overall
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
First identify your installation
Your responsibilities depend on how Home Assistant is installed:
| Installation | Main security responsibilities |
|---|---|
| Home Assistant OS or Home Assistant Green | Use the integrated update, backup and app-management workflows, while still securing accounts, router, Wi-Fi, remote access, apps, backups and physical hardware. |
| Home Assistant Container | Update the host OS, Docker and images; verify image sources; protect volumes, permissions, network exposure and secrets; and manage backup and restore testing. |
| Home Assistant Core or manual installation | Also manage Python dependencies, the service account, process supervision, reverse proxy, TLS, firewall, SSH and operating-system security. |
Advice written for Home Assistant OS does not automatically apply to Container or Core installations.
Secure accounts and authentication
- Create a separate account for every household member. Never share the owner account.
- Use a password manager to create a long, unique password that is not reused for email, Nabu Casa, the router, NAS or cloud services.
- Enable MFA for every account that supports it.
- Give administrator privileges only to people who genuinely need them.
- Remove or disable accounts belonging to former occupants, contractors, guests or unused devices.
- Treat long-lived access tokens like passwords.
In the current interface, go to Settings → People, select a user, configure MFA and review administrator status. Labels can change between releases, so check the interface for your installed version.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHome Assistant’s authentication system supports separate users and authenticated token-based requests; see the authentication documentation.
What MFA does—and does not do
MFA reduces the risk of a password-based account takeover. It does not protect a stolen long-lived token, a valid browser session, a compromised phone or browser, a malicious app running on the host, a compromised router or an insecure third-party cloud account.
If you lose your authenticator or administrator access
Use a valid local browser session if one remains, or regain access from the local console using the supported recovery process for your installation and release. Prioritize documented account recovery and restoring a known-good backup. Avoid making destructive database edits unless the official instructions for your exact version require them. If the host may be compromised, recover from trusted media or hardware and rotate credentials rather than merely changing one password.
Update safely, not blindly
Home Assistant publishes a major release on the first Wednesday of each month, with patch releases when needed, according to its FAQ. Timely updates matter, but “update immediately” should not mean installing blindly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
- Read the release notes and check compatibility with critical integrations.
- Create a fresh backup and confirm it completed successfully.
- Update Home Assistant.
- Review logs, repaired issues and integration errors.
- Test locks, alarms, garage doors, heating or cooling, leak detection and presence automations.
Keep the host OS, Docker engine, reverse proxy, VPN, router firmware and apps updated too. Delay only for a documented compatibility reason, and do not remain indefinitely on an obsolete version. Apply emergency security fixes promptly.
Manage secrets correctly
Use secrets.yaml to centralize sensitive values such as API keys, MQTT credentials, SMTP passwords, database passwords, camera credentials and long-lived tokens. However, secrets.yaml does not encrypt those values; it improves organization and reduces accidental duplication.
- Do not publish
configuration.yaml,secrets.yaml,.storageor complete backups in public repositories. - Restrict filesystem permissions on configuration files and backup locations.
- Remove credentials from screenshots, logs, diagnostic downloads, notifications and support posts.
- Rotate a credential immediately if it appears in Git, a forum, chat or public backup.
- Do not place secrets in automation names, dashboard cards, notification text or URLs that may be logged.
Centralization, access control and encryption are different controls. A secret may still appear in the filesystem, backups, process logs, integration configuration, browser history or a third-party service.
Choose remote access deliberately
Remote access is optional and is not enabled by default. Home Assistant recommends avoiding casual direct exposure. Choose according to your technical ability, privacy preferences and the devices that need access.
| Method | Best fit | Trade-offs |
|---|---|---|
| Home Assistant Cloud | Most households and beginners | No router port forwarding or certificate administration; supported and simple. It costs money, depends on Nabu Casa availability and uses cloud-mediated access. |
| VPN or mesh VPN | Technical users wanting no public Home Assistant endpoint | Private device-level access, but each phone, tablet or laptop needs a client or profile. Subnet routing can expose more of the LAN than intended. |
| Reverse proxy with HTTPS | Advanced users needing a conventional URL | Flexible, but requires TLS renewal, firewall rules, proxy updates, trusted-proxy configuration and ongoing monitoring. |
| Direct port forwarding | Rare specialist cases | Greatest exposure and easiest misconfiguration. A random external port is not a security control. |
Home Assistant Cloud
Home Assistant describes Cloud as the easiest and safest option for most users. It supplies a remote URL without router port forwarding and handles certificate setup. Nabu Casa documents encrypted remote-access traffic and generated certificates. This does not eliminate the need for strong credentials, MFA, updates, router security or independent backups, and “safest” depends on whether you accept the provider and its service dependency.
See Home Assistant Cloud and Nabu Casa’s remote-access explanation.
VPNs
Tailscale, ZeroTier, WireGuard or a router-hosted VPN can avoid publishing Home Assistant as a public web service. Secure VPN accounts and authorize only the devices and routes required. A VPN is not automatically least privilege: poorly configured subnet routing may grant access to the wider home network.
Rank #3
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
The companion app may not update sensors remotely until the VPN is connected. An always-on VPN, split tunneling or Cloud may be necessary for reliable background operation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Reverse proxy or direct exposure
A reverse proxy needs valid TLS certificates, strong authentication, correct proxy headers, strict firewall rules, minimal exposed services and timely updates. Home Assistant must be configured to trust the proxy; otherwise requests are blocked by design. Follow the remote-access documentation.
Port forwarding is not encryption. Forwarding port 8123 directly increases the public attack surface, and changing the external port does not fix that. TLS, authentication, patching, rate limiting and monitoring remain necessary. CGNAT, dynamic addresses, DNS errors, firewalls and IPv4/IPv6 differences can also prevent access.
Set the external URL
- Go to Settings → System → Network.
- Under Home Assistant URL, enter the external URL in the Internet field.
- If using Cloud, enable Use Home Assistant Cloud instead.
- Save and test locally and remotely.
Harden the host and SSH
For manually managed hosts, update the operating system, remove unused services, use a non-root administrative account, restrict SSH to the LAN or VPN, enable a host firewall, review listening ports and protect the machine physically. Encrypt the disk where practical and avoid unrelated internet-facing services on the same host.
Home Assistant recommends disabling direct root SSH login by setting this in /etc/ssh/sshd_config:
Free tools Windows power users keep installed
One-click scans. No signup required.
PermitRootLogin noPrefer SSH keys over password authentication, especially when SSH is remotely accessible. Paths, service names and commands vary across Home Assistant OS, Debian, Raspberry Pi OS, Ubuntu, Docker, Proxmox and NAS platforms; do not apply a generic command block without verifying your host.
Review apps, add-ons and custom code
Apps (formerly commonly called add-ons), HACS repositories and custom integrations expand the software you trust. They are not automatically unsafe, but community software requires more review and maintenance than an official component.
Rank #4
- 【2K Ultra HD & Full Color Night Vision - 4 Cam Kit】Upgrade your home security with this 4 pack security cameras wireless outdoor system. Delivering 2K 3MP ultra-clear live video, these cameras for home security feature advanced color night vision and infrared modes, ensuring vivid details even in pitch black. Equipped with a 3.3mm focal length lens, this porch camera set provides a wide-angle view for your front door, backyard, garage, or driveway. See every detail in full color and protect your property with the ultimate outdoor camera wireless solution. (*Not support 5GHz WiFi)
- 【Wire-Free Battery Powered & Easy 3-Minute Setup】Experience a truly wireless security system with no messy cables. This rechargeable battery operated camera features an exceptional battery life, providing 1-6 months of standby time for home security system. and supporting up to 3,000+ motion triggers on a single charge. With a quick charging time of 6-8 hours, it ensures long-term performance for indoor pet/baby monitoring or outdoor garden farm security. Portable and easy to install, this WiFi camera can be moved anywhere, from your apartment hallway to a remote warehouse, providing wireless monitoring.(*Only work with 2.4GHz WiFi)
- 【Smart AI PIR Motion Detection & Instant Mobile Alerts】 Never miss a moment with smart PIR motion detection and AI cloud analysis. This IP camera accurately triggers instant alerts to your cell phone when movement is sensed, acting as a reliable motion sensor camera. Customize your motion alerts to monitor specific zones like your patio, office, or store. As a top-rated surveillance camera, it ensures real-time notifications are pushed via the remote smartphone app, keeping you connected to your home security no matter where you are.
- 【Two-Way Talk & Intelligent Siren Alarm System】This WiFi camera features a high-fidelity built-in microphone and speaker for seamless two-way audio. Use the remote access app to speak with delivery drivers or warn off intruders directly from your phone. For active deterrence, the intelligent alarm triggers flashing white lights and a siren to drive away unwanted visitors. Whether it's a house camera for greeting guests or a security camera outdoor for catching package thieves, the real-time intercom and live view provide peace of mind.
- 【IP65 Weatherproof & Flexible Dual Storage Modes】Secure your footage with dual storage options: insert memory card for free local storage, or opt for our encrypted cloud service. New users receive a 7-day free trial of advanced AI features and cloud storage. This IP65 waterproof wireless camera is a rugged weatherproof camera designed to withstand rain, snow, and extreme heat, making it the perfect outside camera for house security. Protect your yard, deck, or pool area even chicken coop with this durable battery camera that keeps your home security intact year-round.(*Only 2.4GHz WiFi supported)
Before installing, check the maintainer, release history, requested permissions, host-networking requirement, Docker-socket access, configuration-directory write access, credential handling, external data flows and security-related issue reports. Remove unused components.
Give particular scrutiny to anything that can access /config or /backup, execute shell commands, expose a web interface, proxy external traffic, process cameras or microphones, or access the Docker socket. Home Assistant’s app-security documentation warns that relaxing app protection can allow an app to damage the system.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Secure the wider smart home
- Change default device and vendor-account passwords and enable vendor MFA.
- Prefer reliable, maintained local control where appropriate.
- Disable unused cloud integrations and rotate exposed API keys.
- Protect MQTT with authentication and appropriate network restrictions.
- Do not expose cameras directly to the internet.
- Restrict webhooks and rotate webhook identifiers if exposed.
- Review Matter fabric administration, Thread border-router dependencies and Zigbee coordinator security.
- Treat locks, garage doors, alarms and voice assistants as separate security boundaries.
IoT segmentation
A VLAN or separate IoT network can reduce lateral movement, but it must allow the discovery and control traffic your devices require. Poor isolation can break mDNS, SSDP, Matter commissioning, Chromecast or AirPlay discovery, cameras, MQTT and mobile-app connectivity. Treat segmentation as an advanced improvement, not a substitute for patching and authentication, and design the allowed traffic before isolating devices.
Backups and recovery
A backup is useful only if it is recent, complete, encrypted, protected, available away from the main machine and restorable without the original server. Aim for the 3-2-1 model: three copies, on at least two types of storage, with one copy off-site.
- Back up before major configuration changes and updates.
- Confirm the backup is listed as completed.
- Download or export an independent copy.
- Store the backup emergency kit separately from the backup.
- Keep an offline or independently controlled copy.
- Test restoration on replacement hardware or a disposable environment.
- Document the installation type, critical dependencies, network settings, radio hardware, USB paths and external credentials.
- If the original host may have been compromised, rotate credentials after restoration.
The backup emergency kit contains restoration information, including encryption-key details. Nabu Casa states that it does not retain the key and cannot decrypt a backup if you lose it.
For Cloud subscribers, Nabu Casa documents one encrypted latest backup, a 5 GB maximum, AES-128 encryption and provider inability to access the backup data or key. This is useful off-site protection, but it is not historical retention or a complete strategy for external services, radio hardware and every dependency. See the Cloud backup documentation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSecure the router and network
- Change the router administrator password and update firmware.
- Use WPA2-AES or WPA3; never WEP or open Wi-Fi.
- Disable internet-facing router administration unless genuinely needed.
- Inspect port-forwarding and UPnP tables, and remove unused mappings.
- Use a guest network and consider DNS filtering or network monitoring.
- Keep router, Home Assistant host and storage on a UPS where practical.
UPnP deserves special attention: devices may create port forwards automatically, so inspect the router even if you never created a rule manually.
Monitor and respond to incidents
Watch for unexpected login notifications, unknown users or tokens, new automations, unfamiliar apps, repeated failed logins, unexplained state changes, new router rules, unusual outbound connections, sudden resource usage and missing or failed backups.
Quick Recap
If compromise is suspected:
- Disconnect Home Assistant from the internet.
- Preserve logs and screenshots where possible.
- Revoke long-lived tokens.
- Change Home Assistant passwords from a trusted device.
- Rotate vendor API keys, cloud credentials and affected Wi-Fi or router credentials.
- Review users, automations, scripts, scenes, apps, integrations and router rules.
- Inspect the host for unauthorized services or files.
- Restore only from a known-good backup after identifying the likely entry point.
- Update the system and dependencies, then rebuild the remote-access configuration.
- Reconnect the host cautiously and notify affected household members.
Practical security checklist
In the next 10 minutes
- Confirm remote access is not unintentionally exposed.
- Use a unique password and enable MFA.
- Remove unknown users and unused tokens.
- Inspect router port forwards and UPnP mappings.
Within an hour
- Update Home Assistant and its host or container stack after backing up.
- Review administrator accounts and installed apps.
- Move credentials into controlled secret storage and remove exposed copies.
- Choose Cloud or a VPN rather than direct port forwarding.
Advanced actions
- Harden SSH and the host firewall.
- Review container permissions and Docker-socket access.
- Segment IoT devices using a documented traffic model.
- Reduce unnecessary cloud integrations and public endpoints.
Quarterly maintenance
- Review users, tokens, apps, integrations and router rules.
- Test critical automations and backup restoration.
- Rotate credentials that may have been exposed.
- Check firmware, certificates, VPN clients and storage capacity.
Recovery readiness
- Maintain encrypted off-site and offline copies.
- Store the emergency kit separately but securely.
- Record radio hardware, USB paths and external dependencies.
- Know how to isolate, rebuild and restore the host.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
