How to Secure Your Home Assistant Setup: A 2026 Hardening Checklist

This post may contain affiliate links. As an Amazon Associate we earn from qualifying purchases. Disclosure.

Securing Home Assistant comes down to one rule above all others: never expose port 8123 directly to the internet. Home Assistant holds the keys to your locks, cameras, and alarms, so it deserves real hardening, not just a password. Home Assistant runs the house I'm building, and this is the checklist I'd give anyone, built from the official security guidance plus the choices I made for my own network and backups.

Bottom line: The biggest Home Assistant security wins are: enable two-factor authentication, never port-forward 8123 directly, keep the OS and add-ons updated, take automated encrypted backups, and put IoT devices on a separate network. The official Home Assistant security checklist recommends MFA and a secure remote-access method instead of direct exposure.

If you're still setting things up, start with our Home Assistant setup guide, then come back to lock it down.

Why Does Home Assistant Need Hardening?

Home Assistant controls physical security devices, so a compromised instance is a compromised home. Unlike a random web app, an attacker who gets in can unlock your door, disable your cameras, or watch your feeds. That raises the stakes well beyond a typical self-hosted service.

The most common mistake is also the most dangerous: forwarding port 8123 straight from the router to Home Assistant. The moment you do, automated bots start hammering the login. The official Home Assistant securing checklist advises against exposing the instance directly and points to Home Assistant Cloud, a VPN or an SSH tunnel for remote access, with multi-factor authentication on top.

So how do you get remote access safely without that open port? That's most of what this guide covers.

Step 1: Have You Turned On Two-Factor Authentication?

Enabling multi-factor authentication is the single highest-value thing you can do, and it takes two minutes. Home Assistant supports TOTP (the same six-digit codes as Google Authenticator or Authy) natively under your profile settings. Once on, a stolen password alone won't get anyone in.

Add it for every user account, not just yours. A guest or family account without MFA is the weak link an attacker looks for. While you're in there, ditch any short or reused passwords. A password manager makes long unique passwords painless.

With MFA on, credential stuffing and password reuse stop being enough on their own. Do it before anything else on this list.

Step 2: Why Never Expose Port 8123 Directly?

Direct port-forwarding is the cardinal sin, so route remote access through something safer instead. You have three solid options, in rough order of safety.

• VPN (most secure): A WireGuard or Tailscale tunnel means your phone joins your home network. Nothing is exposed publicly at all.
• Reverse proxy with TLS: An Nginx or Cloudflare Tunnel front-end adds HTTPS and can layer on extra authentication.
• Nabu Casa Cloud: The official paid remote-access service. It funds the project and handles TLS and tunneling for you with zero config.

For the reverse-proxy route specifically, our guide to hardening with Nginx and Cloudflare walks through the full setup. For the broader comparison of remote methods, see how to access Home Assistant remotely. If you only pick one, a VPN such as Tailscale is the least effort for the most safety.

Step 3: Is Everything Kept Updated?

Outdated software is how known vulnerabilities get exploited, so updates are a security task, not just a feature one. Home Assistant ships monthly core releases, and the OS, Supervisor, and add-ons all update independently. Check the updates panel regularly and apply them after a quick backup.

Don't blindly auto-update core the day a release drops, though. Breaking changes happen. A sensible rhythm is to wait a few days, skim the release notes for breaking changes, take a backup, then update. That balances security against the risk of a broken automation at the worst moment.

Add-ons deserve the same attention. An abandoned add-on that never patches is a liability sitting inside your trusted network.

Step 4: How Do You Automate Encrypted Backups?

A backup is both a recovery tool and a security control, because ransomware and bad updates are threats too. Home Assistant has built-in full and partial backups, and you should schedule them, encrypt them, and store a copy off the device. A backup that lives only on the same SD card disappears when the card dies.

My own setup splits the job in two. The configuration lives in a GitHub repository, with secrets kept out of it, so every change has a history. The data, such as the database and larger files, goes to Google Cloud every 24 hours. I have to be honest about one gap: I have never done a restore. A backup you haven't restored is a hope, not a backup, so a test restore onto a spare Pi or a virtual machine is on my list.

Encrypt the backups. They contain your tokens, passwords, and config, so an unencrypted backup in cloud storage is its own vulnerability.

Step 5: How Do You Vet Add-ons and Integrations?

Every add-on and HACS integration runs code inside your trusted instance, so trust is a real security decision. Official and community-vetted add-ons are generally safe, but a random custom integration from an unknown repo has full access to your data and devices.

Before installing, check the source. Is it actively maintained? Does it have real users and a public repo? Our roundup of best HACS integrations sticks to well-established ones. The convenience of a niche integration isn't worth handing device control to code you can't vouch for.

This is the step people skip because add-ons feel harmless. They aren't. Treat each one as code you're inviting inside the gate.

Step 6: Why Segment Your Network?

Putting IoT devices on a separate network limits the blast radius if one device is compromised. In my own network the IoT devices sit on a dedicated VLAN, which is a different thing from just adding a second Wi-Fi name. Cheap smart plugs and cameras are rarely well-secured, and you don't want a hacked $10 bulb sitting on the same network as your laptop and Home Assistant. A separate VLAN or a guest network is the fix.

The idea is simple: IoT devices talk to Home Assistant, but not to your computers or each other, and not out to the wider internet unless they need to. In practice, blocking internet access entirely breaks gear that depends on a vendor cloud, such as Wi-Fi breakers from Tuya, so my own rule is isolation from the home network plus visibility: outbound traffic isn't blocked, but I can see in the UniFi stats what each device talks to. Even a basic router's guest network is better than nothing. A managed switch with VLANs is the full version. If all you need is extra wired ports, the plug-and-play TP-Link TL-SG105 gives you five gigabit ones.

Is it overkill for a few bulbs? Maybe. Is it sensible once you're running cameras and locks? Absolutely. The segmentation contains a breach instead of letting it spread.

What About Monitoring for Trouble?

Hardening keeps attackers out, but monitoring tells you when something's wrong, so the two go together. Home Assistant can watch itself: alert on repeated failed logins, on a new device joining your IoT network, or on the instance going unreachable when it shouldn't be.

A few monitors worth setting up:

• Failed-login alert: Notify yourself if the auth log records several failed attempts in a short window, which is the earliest sign someone's probing.
• New-device alert: Flag when an unknown MAC address joins the network, so a rogue device doesn't go unnoticed.
• Update reminder: A weekly nudge listing pending core, OS, and add-on updates so patching never slips.
• Backup confirmation: A notification when the nightly backup succeeds, and a louder one when it fails.

None of this needs extra hardware. It's a handful of automations using the entities Home Assistant already exposes. The point is simple: a hardened system you never check can still drift, and a quiet alert beats discovering a problem after the fact.

What Is Your Home Assistant Hardening Checklist?

Work through these in order and your instance goes from soft target to genuinely hardened:

• Enable TOTP two-factor authentication on every account.
• Remove direct port-forwarding; use a VPN, reverse proxy, or Nabu Casa.
• Apply core, OS, and add-on updates on a deliberate schedule, after a backup.
• Schedule nightly encrypted backups stored off the device.
• Vet every add-on and HACS integration before installing.
• Segment IoT devices onto their own VLAN or guest network.

Security isn't a one-time switch; it's a posture you maintain. But the steps above are mostly set-and-forget, and they move you past the mistakes that actually get people compromised. The exposed port is the one that bites hardest, so if you do nothing else today, close it and put a VPN in front. Building out the rest of your system? Our best smart home hub guide covers the controller decisions that sit underneath all of this.