🏠 Home Assistant
Get started with local smart home platform.
Security
Critical
All levels
Smart home also means responsibility. An insecure setup can give hackers access to your network, cameras, and data. Take security seriously from the start.
🔒 Basic Security
Section titled “🔒 Basic Security”⭐⭐⭐ Critical (do this first!)
Section titled “⭐⭐⭐ Critical (do this first!)”| Action | Why | How |
|---|---|---|
| Strong passwords | Weak passwords = easy access | Use password manager, 16+ characters |
| Two-factor on HA | Extra protection | Settings → Users → 2FA |
| Update everything | Security holes get patched | Check for updates weekly |
| Change default passwords | Everyone knows them | Router, cameras, everything! |
⭐⭐ Recommended
Section titled “⭐⭐ Recommended”| Action | Why | How |
|---|---|---|
| Separate IoT network | Isolates devices | VLAN or guest WiFi |
| Local DNS (Pi-hole) | Blocks tracking | Run Pi-hole or AdGuard |
| VPN for remote access | Secure access from outside | WireGuard, Tailscale |
| Avoid cloud devices | Smaller attack surface | Choose local alternatives |
⭐ Advanced
Section titled “⭐ Advanced”| Action | Why | How |
|---|---|---|
| Firewall rules | Control traffic | pfSense, OPNsense |
| IDS/IPS | Detect attacks | Suricata, Snort |
| Log analysis | Detect misuse | Graylog, Grafana |
🏠 Why Local?
Section titled “🏠 Why Local?”Home Assistant and ESPHome run locally on your network. This is a BIG security advantage:
| Local | Cloud |
|---|---|
| ✅ Works without internet | ❌ Requires internet |
| ✅ Faster response | ❌ Slower |
| ✅ Private - no data to vendor | ❌ Your data sent to cloud |
| ✅ Works if company shuts down | ❌ Stops if service is discontinued |
| ✅ You have full control | ❌ Vendor has control |
🌐 Network Segmentation
Section titled “🌐 Network Segmentation”Keep IoT devices on a separate network:
┌─────────────────────────────────────────────────────┐│ ROUTER │└─────────────────────────────────────────────────────┘ │ │ │ ┌────┴────┐ ┌────┴────┐ ┌────┴────┐ │ VLAN 1 │ │ VLAN 2 │ │ VLAN 3 │ │ Primary │ │ IoT │ │ Guest │ │ │ │ │ │ │ │ PC │ │ Sensors │ │ Guests │ │ Phone │ ──► │ Cameras │ │ │ │ HA │ │ Bulbs │ │ │ └─────────┘ └─────────┘ └─────────┘🔐 Password Best Practices
Section titled “🔐 Password Best Practices”Good Passwords
Section titled “Good Passwords”❌ Bad: password123❌ Bad: MyDog2024❌ Bad: qwerty✅ Good: correct-horse-battery-staple✅ Good: Xk9#mP2$vL8@nQ4&Use a Password Manager
Section titled “Use a Password Manager”| Manager | Price | Comment |
|---|---|---|
| Bitwarden | Free | ⭐ Recommended, open source |
| 1Password | $3/mo | Polished, family sharing |
| KeePass | Free | Offline, full control |
🌍 Secure Remote Access
Section titled “🌍 Secure Remote Access”Want to access Home Assistant from outside? Do it securely:
| Method | Security | Difficulty |
|---|---|---|
| Nabu Casa | ⭐⭐⭐⭐⭐ | Easy |
| Tailscale VPN | ⭐⭐⭐⭐⭐ | Easy |
| WireGuard VPN | ⭐⭐⭐⭐⭐ | Medium |
| Reverse proxy + cert | ⭐⭐⭐⭐ | Hard |
| Port forwarding | ⭐ | AVOID! |
📋 Security Checklist
Section titled “📋 Security Checklist”At Installation
Section titled “At Installation”- Change all default passwords
- Update firmware on all devices
- Enable two-factor on Home Assistant
- Use HTTPS (automatic with Nabu Casa)
Monthly
Section titled “Monthly”- Check for updates
- Review active users
- Check logs for anomalies
- Backup configuration
For New Devices
Section titled “For New Devices”- Research manufacturer’s security practices
- Prefer devices without cloud
- Update firmware before use
- Place on IoT network
🚀 Next Steps
Section titled “🚀 Next Steps”🔧 ESP32
Build 100% local sensors yourself.