Quick Answer

The essentials: put IoT devices on a separate VLAN, use Tailscale for remote access instead of port forwarding, enable HA auto-updates, set up automatic backups, and turn on two-factor authentication. These five steps handle 95% of realistic threats without making your daily use painful.

Table of Contents

  1. Why Security Matters
  2. Network Segmentation
  3. Tailscale for Remote Access
  4. Keeping HA Updated
  5. Backups
  6. Two-Factor Authentication
  7. Troubleshooting
  8. FAQ

What You Need

Why Security Matters for Self-Hosted Smart Homes

Self-hosting gives you control, but also responsibility. A misconfigured Home Assistant exposed to the internet has been the source of real security incidents. Smart home devices — especially cheap Zigbee and Wi-Fi gadgets — often have poor default security and don't receive firmware updates.

The threats you're actually protecting against:

The good news: all of these are solvable with straightforward measures. You don't need to become a security expert.

Network Segmentation

The single most effective security improvement: put your IoT devices on a separate network from your computers and phones. If a smart plug gets compromised, it can't reach your laptop.

Create an IoT VLAN on your router with these rules:

Quick win: Even without VLANs, most consumer routers support a "Guest network" or "IoT network" option. Enable it for your smart plugs and cameras — it provides basic isolation at the cost of some configuration complexity.

Tailscale for Remote Access

Never port-forward Home Assistant to the internet. Never. Even with SSL, exposing HA's web interface directly adds significant attack surface. Instead, use Tailscale — a zero-config VPN that makes your HA server accessible from anywhere as if it's on your local network.

Setting up Tailscale on HA:

  1. Go to Settings → Add-ons → Add-on Store
  2. Install the Tailscale add-on
  3. In the add-on's configuration, add your Tailscale auth key (generate one at tailscale.com/admin)
  4. Start the add-on and check the logs for your HA's Tailscale IP (e.g., 100.x.x.x)
  5. Install Tailscale on your phone and computer
  6. Access HA remotely at http://100.x.x.x:8123 from anywhere with no port forwarding
Tailscale add-on configuration
# In the Tailscale add-on configuration tab:
tags:
  - tag:homeassistant
log_level: info
# Optional: advertise your home subnet for accessing other local devices
advertise_routes:
  - 192.168.1.0/24

With Tailscale running, your HA instance is only reachable by devices logged into your Tailscale account. It doesn't matter if the port is "open" — there's no route to it from the public internet.

Keeping Home Assistant Updated

HA releases monthly updates with security patches, bug fixes, and new features. Enable auto-updates for patch releases:

  1. Go to Settings → System → Updates
  2. Enable Automatically update for HA OS and Supervisor
  3. For HA Core itself, review release notes before major updates — they sometimes include breaking changes

Also keep your add-ons updated — Mosquitto, Zigbee2MQTT, and ESPHome all receive regular security and feature updates.

Backups

A full HA backup includes your configuration, automations, add-on data, and history. Set up automatic backups:

  1. Go to Settings → System → Backups
  2. Click the three-dot menu → Automatic backups
  3. Configure: daily backups, keep last 5, include all add-ons

By default, backups store locally. For offsite backup (protects against hardware failure or theft), add cloud storage:

Test your backups: Periodically restore a backup on a test HA instance to verify they're valid. A backup you've never tested is not a backup you can trust.

Two-Factor Authentication

Enable 2FA so that even if someone gets your HA password, they can't log in without your phone:

  1. Go to your Profile page in HA (click your username in the bottom-left)
  2. Under Multi-factor authentication modules, click Enable next to TOTP
  3. Scan the QR code with Google Authenticator, Authy, or Bitwarden
  4. Enter the 6-digit code to confirm and enable

Once enabled, every new login requires your password plus the TOTP code. Your existing session (phone, tablet) stays logged in, so daily use is unaffected.

Troubleshooting

FAQ

Is Nabu Casa secure for remote access?

Yes — Nabu Casa creates an encrypted tunnel similar to Tailscale. It's the easiest remote access option ($6.50/month) and is maintained by the HA team. Either Nabu Casa or Tailscale is significantly safer than port forwarding.

Should I worry about Zigbee/Z-Wave security?

Zigbee uses AES-128 encryption. The main risk is physical proximity attacks during pairing — someone nearby could theoretically join your network during the 60-second pairing window. Keep your permit_join window short and close it immediately after pairing.

How do I know if my HA instance has been compromised?

Check the HA logs for unexpected login attempts (Settings → System → Logs), review recently added users, and check for unusual automations or scripts. Set up HA's notification for failed logins via the "persistent notification" integration.

What UPS do I need for Home Assistant?

A small UPS (600VA / 360W) provides 20-30 minutes of runtime for a Raspberry Pi or mini PC — enough to outlast brief power dips that could corrupt an SD card. Look for models with USB monitoring so HA can trigger a clean shutdown before battery runs out.

Related Articles

SmartWired uses affiliate links. If you buy through our links, we may earn a commission at no extra cost to you. See our Affiliate Disclosure.