How to Secure Smart Home Cameras From Hacking

The Problem

Stories about strangers speaking through baby monitors are real, but the cause is almost never a sophisticated attack on the camera. It is one of three ordinary failures:

A reused password. The email-and-password pair from an unrelated breach was tried against the camera vendor's app and it worked.
The camera was published to the internet. Port forwarding or UPnP made the feed reachable from anywhere, and search engines like Shodan index those continuously.
Default credentials. Cheap own-brand cameras ship with admin/admin and nobody changes it.

All three are fixable in an evening, and none of them require replacing the camera. This guide covers the checks in the order that removes the most risk fastest.

Think someone is watching right now? Unplug the camera, then work through the steps. Do not leave it connected while you investigate.

The Fix: Step-by-Step

Step 1: Change the Account Password and Make It Unique

Start with the vendor account, not the camera. That account controls the cloud feed, recordings, and often remote unlock or two-way audio.

Change it to a long, unique password from your password manager — use a password manager safely.
Check whether the old one has been exposed: check if your email was in a data breach.
Never reuse it anywhere else.

If the same password protected your email, change that first — recover a hacked email account explains the order.

Step 2: Turn On Two-Factor Authentication

Every major camera platform supports it now: Ring, Nest, Arlo, Eufy, Wyze, Reolink, Tapo, and Hikvision consumer lines.

Find it under Account → Security in the app. Use an authenticator app rather than SMS where the option exists — see set up two-factor authentication and, if the number itself is a risk, prevent a SIM swap attack.

Step 3: Change the Camera's Own Local Password

Many cameras have two credentials: the cloud account, and a local device password used by the web interface, ONVIF, or RTSP stream. The local one is frequently left at the factory default.

Access the camera's local settings — via its own app's advanced section, or by browsing to its IP address on your network — and change:

The admin password.
Any RTSP or ONVIF credentials.
Any secondary "viewer" or "operator" accounts, or delete them.

To find the camera's IP: check the router's Attached devices list.

Step 4: Remove Port Forwarding and Turn Off UPnP

This is the step that closes the exposure that leads to a feed appearing on a public site.

Sign in to the router: usually 192.168.0.1 or 192.168.1.1.
Find Port forwarding / Virtual servers and delete every rule pointing at a camera — commonly ports 80, 554, 8000, 8080, 8554, 34567.
Find UPnP and turn it off. UPnP lets a device open a hole in your firewall without asking you, and cameras use it aggressively.
Save and reboot.

Remote viewing keeps working after this, because modern cameras connect out to the vendor's cloud rather than needing an inbound hole. Full reasoning in port forwarding and UPnP security risks.

Step 5: Check Whether You Were Exposed

From a phone on mobile data (not your Wi-Fi), try to reach your public IP on the camera's port. Find your public address by searching "what is my IP" on the phone.

If a login page or a video stream appears, the camera is still published to the internet. Go back to Step 4 — a forwarding rule remains, UPnP is still on, or the router has a separate "remote management" setting enabled.

Step 6: Update the Firmware

Camera firmware fixes real remote-access vulnerabilities, and vendors ship them quietly.

In the app: Device settings → Firmware → check for updates, and enable automatic updates if offered. Do this for the base station or hub as well as each camera.

If a camera no longer receives updates and the vendor has stopped supporting it, that is a reason to replace it — an unpatched internet-connected camera is a liability regardless of how well you configure it.

Step 7: Move Cameras to an Isolated Network

Even a well-configured camera should not be able to reach your PCs. Put it on a guest or IoT network with client isolation: set up a guest network to isolate smart home devices.

This means a compromised camera cannot scan your laptop, reach your NAS, or attack the router's admin page from inside the network.

Step 8: Review Who Has Access in the App

Shared access is a common blind spot — an ex-partner, a former housemate, an installer, or an old family member account.

In the app, check Shared users, Family, or Members, and remove anyone who should not have access. Then sign out all devices from the account security page, so anyone still signed in is dropped: review and revoke app access and active sessions.

Step 9: Set Privacy Boundaries That Do Not Depend on Security

Some risk is best removed rather than mitigated:

Do not put cameras in bedrooms or bathrooms. No configuration makes that a good idea.
Use privacy zones to black out a neighbour's window or a shared corridor — most apps support this, and in many countries it is a legal requirement.
Turn on the privacy shutter or scheduled off-mode when you are home, if the camera has one.
Prefer local recording to a microSD card or NVR over cloud storage where you have the choice — fewer copies, fewer accounts, fewer breaches.

Step 10: Watch for the Signs of Access

Check the app's event log or activity history for logins from unfamiliar locations, and enable notifications for new sign-ins.

Physical signs worth noticing: the camera panning on its own, the status LED behaving unexpectedly, settings reverting, or recordings missing from the timeline.

Buying Checklist for the Next Camera

| Look for | Avoid | |---|---| | Named brand with a security contact and update history | Unbranded rebadges with generic apps | | Two-factor authentication in the app | Cloud accounts with password only | | End-to-end encryption option | "Free unlimited cloud" with no encryption detail | | Local recording to SD or NVR | Cloud-only with no local option | | Published firmware update policy | No firmware page on the vendor site |

What Not to Do

Do not port forward to a camera to get remote viewing. Use the vendor's cloud, or a VPN back into your home network.
Do not use the same password on the camera app as anywhere else. This is the single most common cause of "hacked camera" reports.
Do not leave UPnP on because a game or console asked for it. Forward only the specific port you need, deliberately.
Do not buy the cheapest unbranded camera for a room that matters. Firmware support is the product; the hardware is commodity.

FAQ

How do I know if my camera has been accessed?

Check the app's login or event history for sessions from locations and devices you do not recognise, and look for gaps in recordings. Cameras that pan on their own or whose settings revert are stronger signals. Enabling sign-in notifications makes future access obvious immediately.

Is cloud storage or local storage safer?

Local storage keeps footage out of a third party's systems and removes breach risk, but it is lost if the camera is stolen. Cloud storage survives theft but depends on the vendor's security and account protection. Many people use local as primary with short-retention cloud as backup.

Do I need to port forward for remote viewing?

No. Every mainstream camera platform connects outbound to its own cloud, so remote viewing works with no inbound holes at all. Port forwarding to a camera is a legacy configuration that should be removed.

Are cheap unbranded cameras safe if I configure them well?

Configuration helps but cannot fix missing firmware updates. Many low-cost cameras stop receiving patches almost immediately and some ship with undocumented remote access. If you use one, isolate it on a guest network and never port forward to it.

Can someone hack a camera without knowing my password?

Through a firmware vulnerability, yes — which is why updates and network isolation matter. But the large majority of real incidents come from reused passwords and internet-exposed devices, not from vulnerabilities.

Should I cover the camera when I am home?

If it is indoors, yes — a privacy shutter or a scheduled off-mode removes the risk entirely for the hours you are there. Many apps can do this automatically based on your phone's location.

Still Not Working?

If a camera keeps reappearing on the internet after you remove forwarding rules, the router is probably re-adding them through UPnP or a vendor-specific "cloud access" setting — check both, and confirm remote management is off on the router itself. If the vendor account keeps being accessed after a password change, the credentials are being taken from a device: run remove virus and malware on the PC or phone used to sign in.