A proper home network security guide for a UK smart home comes down to five habits: change every default password, keep firmware updating automatically, put smart devices on their own network, use WPA3 (or WPA2 at minimum), and turn off remote access you don't actually use. None of this needs new hardware — most routers already support it, and the National Cyber Security Centre (NCSC) treats these as the baseline for any home with connected devices. The main caveat: a full separate network for IoT devices (VLAN or guest Wi-Fi) takes more router capability than the cheapest ISP-supplied hubs offer, so if your router can't do it, that becomes your first upgrade priority rather than an optional extra.
What's the single biggest home network security risk in a UK smart home?
The biggest risk is a smart device still running its factory-default password on the same flat network as your laptop, phone and any file shares. The NCSC's guidance on smart devices in the home warns that default passwords for internet-connected devices "can be easily shared online," and once one device on a flat (unsegmented) network is compromised, an attacker typically has a much easier path to everything else on it. This is why the two changes that matter most — unique passwords everywhere, and keeping IoT devices off your main network — appear at the top of nearly every UK and international home security checklist, including NCSC's own.
How do I secure my router first?
Start at the router, because it's the single point every device on your network passes through. Change the default admin login (not just the Wi-Fi password) to something unique — NCSC recommends a "three random words" passphrase over complex-but-memorable strings, since length beats complexity for resisting automated guessing. Turn on automatic firmware updates if your router supports them, or set a monthly reminder to check manually; router firmware patches are how manufacturers fix the vulnerabilities that get devices added to botnets. Finally, disable any router feature you don't actively use — remote web administration and UPnP are the two most commonly left on by default and rarely needed in a typical home, and NCSC's guidance for edge devices specifically flags exposed admin interfaces as a route attackers use to extract stored credentials.
Do I need a separate network for smart home devices?
Yes, if your router supports it — NCSC's guidance for home users describes a three-network model as the ideal setup: one network for your personal devices (laptops, phones), one for IoT/smart home devices, and one guest network for visitors, so that a compromised smart plug or camera can't reach your personal files or a visitor's device can't reach your smart locks. The simplest version of this is enabling your router's built-in guest Wi-Fi and putting IoT devices on it instead of guests. For proper isolation with firewall rules between segments, you want VLANs, which mesh systems like eero and prosumer routers from Ubiquiti or TP-Link Omada support natively — we cover the full setup in our home network VLAN guide. If you're already running Home Assistant, our IoT VLAN setup guide walks through wiring VLANs into your automations without breaking device discovery.
Is WPA2 secure enough, or do I need WPA3?
WPA2 is still considered secure for home use as long as it's paired with a strong, unique password — NCSC guidance states your home Wi-Fi router should use "WPA2 or greater." WPA3 is preferable where your router and devices support it, since it removes some of the weaknesses that made WPA2 vulnerable to the 2017 KRACK attack and offers better protection on open or weak-password networks. In practice, most routers sold in the UK since roughly 2020 support WPA3, but plenty of older smart plugs, sensors and bulbs only speak WPA2 — many routers offer a mixed WPA2/WPA3 mode specifically to cover this, which is the pragmatic choice for a household with older IoT hardware still in service.
What does the UK's PSTI Act mean for the security of new smart devices?
Since 29 April 2024, the Product Security and Telecommunications Infrastructure (PSTI) Act has made it a legal requirement for smart devices sold in the UK to ban universal default passwords and to publish a minimum security update support period at the point of sale. In practice this means any smart plug, camera, doorbell or sensor you buy new in the UK should force you to set a unique password on first setup rather than shipping with "admin/admin," and the manufacturer must tell you how long it will keep issuing security updates. NCSC frames that support-end date as a "'use by' date for your device" — worth checking before you buy, and worth checking again before you keep using an older device past that date, since unpatched vulnerabilities in unsupported hardware are a growing target for attackers.
How do I access my smart home safely when I'm away from home?
The safest option is a VPN back into your own network rather than opening ports on your router or relying on manufacturer cloud remote-access features you don't fully trust. Port forwarding an admin interface or camera stream directly to the internet is exactly the kind of exposure NCSC's advisory on internet-facing routers warns about, since exposed services are what attackers scan for continuously. If you run Home Assistant, our WireGuard VPN guide sets up encrypted remote access without exposing anything directly to the internet. If you don't need remote access to a device at all, NCSC's simplest advice applies: switch off its remote-access setting entirely.
A monthly home network security checklist
Five minutes a month covers most of this once the initial setup is done. Check your router and smart devices for pending firmware updates and install them. Glance at connected-devices lists (most routers and mesh apps show this) for anything you don't recognise. Confirm remote access is still switched off on anything you're not using it for. If you added a new smart device this month, make sure it went onto your IoT or guest network rather than your main one, and that its default password was changed during setup — checking this each time you add a device is far easier than auditing your whole network retroactively later.
