Turn off remote access on any smart device you do not need to reach when you are away from your home Wi-Fi. The NCSC gives that advice directly. If you do need it, protect the account with a strong unique password and two step verification, and keep the device updated.
What remote access is
Many cameras, thermostats and doorbells connect to the maker's cloud so you can view or control them from anywhere. That convenience means the device is reachable from outside your home, through an account and a service. A weak password on that account, or a flaw in the device, can let someone else in.
The NCSC advice
The NCSC's guidance on smart devices tells readers to switch off remote access if they do not need to reach the device when away from home Wi-Fi. It also tells them to change default passwords, use a hard to guess password, and turn on two step verification if offered.
A decision method
Ask three questions for each device.
- Will I ever need to control it when away? A porch light timer probably yes. A smart plug on a desk lamp, probably not.
- What is the worst case if someone else gets control? A camera is more sensitive than a bulb.
- Can I get the benefit another way, such as a schedule set at home?
If the answers favor switching it off, do it. If remote access is core to the product, keep it and harden it.
If you keep it on
- Use a unique strong password. Three random words is a good method.
- Turn on two step verification in the app or account.
- Turn on automatic updates.
- Review the list of people with access and remove those who no longer need it.
- Review connected apps and remove unused ones.
Check what you actually exposed
Open the app's settings and look for terms such as remote access, cloud access, away mode or external access. The names vary between makers. Check the manual or support page if you cannot find it. If a device only works through the cloud and offers no local mode, say so in your notes and treat it as always remotely reachable.
Examples of how to decide
A camera pointed at a front door is the case where remote access is most useful and also most sensitive. Many people want to see who is at the door when away. If you keep it on, apply every protection in the list above and prefer a model with a clear support period.
A smart plug on a lamp is the opposite. You can set a schedule at home and never need to reach it from outside. Switching remote access off removes a path with almost no loss.
A thermostat sits in between. You may want to adjust it on the way home. Decide whether the saving is worth the exposure, and review the decision when the support period ends.
When something looks wrong
If you think someone has taken control of a device, the NCSC says to reset it using the manufacturer's instructions. After resetting, change the account password from a clean device, and review the access list.
Quick check
Does turning off remote access stop the device working at home?
Often not, since local control can continue. Some products need the cloud even at home, so test after changing it.
Sources
Last reviewed: 19 October 2026.
