True Security Gear is reader-supported. When you buy through links on our site, we may earn an affiliate commission. This doesn't affect our verdicts.
Change the default login on every camera, turn on two-factor authentication for the cloud account if it is offered, install updates, and put the cameras on a network that your computers do not share. Those four steps cover most of what the Federal Trade Commission, CISA and NIST tell home users to do, and they cost nothing except an evening.
Passwords first
The FTC’s advice starts with a strong password and says not to keep the default username and password that came with the camera. CISA, passing along a UK National Cyber Security Centre advisory on internet-connected cameras, says the same: change the default password and create a strong one.
NIST adds two points that people often skip. Do not reuse passwords across accounts, because a leak from some unrelated site then opens your camera feed. And use multi-factor authentication wherever the service supports it. The FTC specifically recommends two-factor authentication for the cloud account behind the camera, which is usually where the live view lives.
Updates and the app
Camera firmware ages. The FTC says to check the manufacturer’s website for updates and to sign up for automatic updates when they are available, and to keep the camera’s app current as well. NIST gives the same advice: set devices to update automatically. CISA lists keeping software up to date among its steps.
One consequence follows from that. A camera whose maker no longer provides updates is a weaker choice, and NIST suggests researching a manufacturer’s breach history and security features before you buy. That is easier to do before the box is open.
Lock down the network
The camera is only as safe as the network it sits on. The FTC recommends a strong password for your router, the router’s firewall turned on, and WPA3 or WPA2 encryption on the wireless network. It also suggests considering a separate network for the cameras, so a compromised camera is not on the same segment as your laptop. NIST makes the same suggestion in different terms: keep smart devices on a separate network from computers that hold sensitive financial information. Many routers offer a guest network that does this job.
Network placement also affects how the camera reaches you. If you are weighing storing footage on the device versus in a vendor’s cloud, the tradeoffs are laid out in local storage versus cloud security cameras. Local storage reduces the cloud account as a target; it does not remove the need for the steps here.
Security also starts at the store. NIST suggests researching a manufacturer’s breach history and its security features before purchase. The FTC adds two things worth confirming: that the camera and its app encrypt their traffic, and that the login pages use https. A listing that says nothing about updates, accounts or encryption is a reason to keep looking, since those are exactly the settings the rest of this checklist depends on.
Trim what the camera can do
| Setting | What the sources advise | Source |
|---|---|---|
| Remote access | Turn it off if you do not use it | CISA |
| Unused features | Disable them | NIST |
| Sharing access | Use permission levels rather than full accounts | FTC |
| Login pages | Confirm encryption and https | FTC |
| Cameras in private rooms | Be cautious about remote viewing | FTC |
| Privacy settings | Review them periodically | NIST |
The pattern is simple. Every feature you leave on is something an attacker can reach, so turn off what you do not use. A camera pointed at a bedroom or nursery is the extreme case, and the FTC’s caution about remote viewing of private areas applies. Consider whether that camera needs to stream outside the house at all.
A sensible order of work
If you have ten minutes, spend them in this order. Change the login on the camera and on its cloud account, because that is the exposure the FTC puts first. Turn on two-factor authentication. Then update the firmware and the app, and switch on automatic updates. After that, look at the router: its own password, the firewall, and WPA3 or WPA2 encryption. Last, go through the camera’s settings and turn off remote access and any feature you do not use, and check whose accounts have been granted access to the feed.
The order follows the sources’ emphasis, not a ranking published by any of them. Even so, the first two steps remove the most common way in. The rest narrow what an attacker could do if one of those fails.
What if the camera is already compromised
The sources above are prevention guides; none of them gives a recovery procedure, so what follows is the logical sequence rather than a quoted one. If you see the camera moving on its own, hear a voice you did not expect, or find logins you do not recognize in the account history, change the account password first, then the router password, and update the firmware. Check the sharing list for people you did not add. If the device keeps misbehaving after that, contact the manufacturer. If you believe a crime has occurred, report it to your local police.
A related problem is a camera that simply goes dark. Wireless attacks on the signal are a different category from account takeover, and the post on Wi-Fi jammers and security cameras covers how that works and what keeps a camera recording.
Our take
Most home camera break-ins start with a password someone never changed. Fix the login, add two-factor, keep the firmware current and give the cameras their own network. If you cannot do that for a given camera, it probably should not point at a bedroom.
Common questions about securing security cameras
What is the most important step to secure a security camera?
Change the default username and password to a strong, unique one. The FTC and CISA both give this as a first step.
Should I use two-factor authentication on my camera account?
Yes, if the service offers it. The FTC recommends two-factor authentication for the camera’s cloud account, and NIST recommends multi-factor authentication generally.
Do I need a separate network for my cameras?
The FTC suggests considering one, and NIST recommends keeping smart devices on a separate network from computers that hold sensitive financial information. A router’s guest network can serve that purpose.
Should I turn off remote access?
CISA says to disable remote access if you do not use it. If you do use it, protect the login with a strong password and two-factor authentication.
How do I know if my camera has been hacked?
Warning signs include the camera moving on its own, unexpected voices or sounds, and unknown logins in the account. Change your passwords, update the firmware and contact the manufacturer.
Who checked this
True Security Gear does not run a test lab and does not take units apart. One half of the work is documents: manufacturer specs, certifications, and seller claims checked against the paperwork. The other half is the record owners leave behind, in verified-buyer reviews, owner forums, and warranty complaints. Where that evidence is thin we say it is thin, rather than filling the gap with an adjective. The criteria are on How we evaluate.
Google lets you pick which sites come up first in your own results.
