How to Secure Home Assistant: Practical and Advanced Guide

Securing a Home Assistant server is a fundamental task, especially if you expose the system externally for the remote management of lights, locks, thermostats and alarm systems. This guide describes the conservative approach to reducing attack vectors, managing credentials, configuring multi-factor authentication (MFA) and setting up a reliable backup strategy. For complex interventions on electrical systems or motorised locks, always rely on a qualified electrician or technician.

Prerequisites: administrative access to Home Assistant Core, OS or Supervised (recent version), permissions to modify the local network, and a router with support for VPN or a secure reverse proxy.

Limitations and compatibility: Graphical User Interface (GUI) menu items may vary slightly between monthly releases. Always check the official documentation for your specific update channel (Stable, Beta, Dev).

1. User management and the principle of least privilege

The first mistake to avoid is the continuous use of the Owner account for daily use or for connecting mobile devices. Every user added to Home Assistant should only have the permissions strictly necessary.

Role separation

Create a secondary administrator user protected by strong credentials and assign the standard user role (or limit permissions via ACLs if using advanced configurations) to family members or fixed wall-mounted devices (tablet dashboards). Disable the initial onboarding user if it is no longer required.

Password policy

Enforce complex and unique passwords for each user. Home Assistant does not natively enforce strict minimum complexity, so the choice of passphrase rests with the administrator.

2. Mandatory Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) drastically reduces the risk of account compromise in the event of password theft.

Access the user profile by clicking on your name at the bottom left of the Home Assistant sidebar. Scroll to the Multi-factor authentication section. Choose the TOTP (Time-based One-Time Password) module, compatible with apps like Google Authenticator, Authy or Aegis. Scan the QR code with the application on your smartphone and enter the six-digit numerical code generated to confirm activation. Keep recovery codes in a safe, offline location.

3. Secure remote access: VPN vs Direct Exposure

Exposing port 8123 directly to the Internet via port forwarding on the router is strongly discouraged unless you use a robust layer of protection such as a reverse proxy with SSL/TLS (e.g. Nabu Casa, Nginx Proxy Manager or Cloudflare Tunnels) combined with a Web Application Firewall or geoblocking.

The recommended choice: Nabu Casa or VPN

The most secure and integrated method for remote access without configuring manual SSL certificates is a subscription to Home Assistant Cloud (Nabu Casa), which handles end-to-end encryption securely. Alternatively, configure a private VPN (such as WireGuard or OpenVPN) on your router or on a dedicated server (e.g. a separate Raspberry Pi or pfSense/OPNsense firewall), accessing the home network before opening the Home Assistant interface.

4. Step-by-step procedure for securing your system

1. Log in to Home Assistant using the main administrator account, verifying that the SSL certificate is active on the local or remote domain.
2. Go to the Settings menu, select People and remove or deactivate all unused or test accounts created previously.
3. Open your administrative user profile, locate the MFA section and enable the TOTP module by pairing it with an authentication app on your smartphone.
4. Verify that sensitive configuration files use the secrets.yaml file to store tokens, IoT device passwords, MQTT credentials and API keys.
5. Configure the automatic backup system in Settings -> System -> Backups, scheduling periodic encrypted backups.
6. Move the generated backup files off the SD card or main disk of Home Assistant, saving them to a local NAS or an encrypted cloud storage.
7. Immediately disable direct port forwarding of port 8123 on your home router if you had configured access unprotected by HTTPS or VPN.
8. Configure system notifications to receive immediate alerts in the event of failed login attempts or critical errors in the security logs.
9. Update Home Assistant Core, Supervisor and the operating system to the latest available stable security patch.

5. Secrets, Logs and Updates

Regular security maintenance requires special attention to hardcoded data, log cleaning and timely updates.

Managing secrets.yaml files

Never enter plaintext passwords in automation files or in the main configuration (configuration.yaml). Use the !secret key_name syntax to retrieve protected data from the dedicated secrets file.

Log analysis

Regularly monitor the system log (home-assistant.log) or the Logs section in Settings -> System to identify brute-force attempts coming from suspicious IP addresses, repeated authentication errors or anomalies in add-ons (Add-ons).

Update policy

Update the system regularly. Many zero-day vulnerabilities are fixed in the monthly security patches released by developers. Always perform a full manual backup prior to any major update.

6. Verifying the result

To confirm that your security configurations are effective, perform the following checks:

• Log out from all clients and attempt to log in: the system must require the TOTP code generated by the app on your smartphone.
• Verify using an external port scanner (or via a mobile network with Wi-Fi disabled) that port 8123 does not respond in plaintext (HTTP), but is unreachable or protected by HTTPS/VPN.
• Check that automatic backups are present in the remote destination folder and that the restoration procedure has been tested at least once in a staging or test environment.

7. Common issues and troubleshooting

8. Frequently Asked Questions (FAQ)

Is it safe to use Home Assistant without a Nabu Casa subscription?

Yes, it is entirely safe as long as you implement a private VPN (such as WireGuard) or a properly configured reverse proxy with valid SSL certificates (Let's Encrypt). A Nabu Casa subscription significantly simplifies this process by offering a ready-made solution while supporting the development of the project.

What should I do if I suspect a system compromise?

Immediately disconnect Home Assistant from the Internet (disable network connection or turn off router access to the outside), change all administrator user passwords, revoke Long-Lived Access Tokens, analyse log files for anomalous IPs, and restore a clean backup created prior to the date of suspected compromise.

Can add-ons (Add-ons) compromise security?

Yes, installing add-ons from unofficial or unverified repositories can expose the system to security vulnerabilities. Use exclusively official repositories or verified community stores and keep all add-ons updated.

How can I protect automations that manage locks or alarms?

For critical devices such as smart locks or alarm systems, always implement an additional consistency check, require encrypted PIN codes inside dashboards, and ensure that critical commands are accessible only to users with elevated privileges and active MFA.