How to Secure Home Assistant: Practical and Advanced Guide

Securing a Home Assistant server is a fundamental operation, especially if you expose the system externally for the remote management of lights, locks, thermostats, and alarm systems. This guide describes the conservative approach to reducing attack vectors, managing credentials, configuring multi-factor authentication (MFA), and setting up a reliable backup strategy. For complex interventions on electrical systems or motorized locks, always rely on a qualified electrician or technician.

Prerequisites: administrative access to Home Assistant Core, OS, or Supervised (recent version), local network modification permissions, and a router with VPN or secure reverse proxy support.

Limitations and compatibility: graphical interface menu items may vary slightly between monthly releases. Always check the official documentation for your specific update channel (Stable, Beta, Dev).

1. User management and the principle of least privilege

The first mistake to avoid is the continuous use of the Owner account for daily use or for connecting mobile devices. Every user added to Home Assistant should only have the strictly necessary permissions.

Role separation

Create a secondary administrator user protected by strong credentials and assign the standard user role (or limit permissions via ACLs if using advanced configurations) to family members or wall-mounted fixed devices (tablet dashes). Disable the initial onboarding user if no longer needed.

Password policy

Enforce strong and unique passwords for each user. Home Assistant does not natively enforce strict minimum complexity, so the choice of the passphrase falls upon the administrator.

2. Mandatory Two-Factor Authentication (MFA)

Two-factor authentication (MFA) drastically reduces the risk of account compromise in the event of a stolen password.

Access the user profile by clicking on your name at the bottom left of the Home Assistant sidebar. Scroll down to the Two-factor authentication section. Choose the TOTP (Time-based One-Time Password) module, which is compatible with apps like Google Authenticator, Authy, or Aegis. Scan the QR code with the application on your smartphone and enter the generated six-digit numerical code to confirm activation. Keep the recovery codes in a secure, offline location.

3. Secure Remote Access: VPN vs Direct Exposure

Exposing port 8123 directly to the Internet via port forwarding on the router is strongly discouraged unless you use a robust protection layer such as a reverse proxy with SSL/TLS (e.g., Nabu Casa, Nginx Proxy Manager, or Cloudflare Tunnels) combined with a Web Application Firewall or geoblocking.

The Recommended Choice: Nabu Casa or VPN

The safest and most integrated method for remote access without configuring manual SSL certificates is a Home Assistant Cloud (Nabu Casa) subscription, which handles end-to-end encryption securely. Alternatively, configure a private VPN (such as WireGuard or OpenVPN) on your router or a dedicated server (e.g., a separate Raspberry Pi or a pfSense/OPNsense firewall), accessing your home network before opening the Home Assistant interface.

4. Step-by-step procedure for securing

1. Log in to Home Assistant with the primary administrator account, verifying that the SSL certificate is active on the local or remote domain.
2. Go to the Settings menu, select People, and remove or disable any unused or previously created test accounts.
3. Access your administrator user profile, locate the MFA section, and enable the TOTP module by associating it with an authenticator app on your smartphone.
4. Verify that sensitive configuration files use the secrets.yaml file to store tokens, IoT device passwords, MQTT credentials, and API keys.
5. Configure the automatic backup system in Settings -> System -> Backups, scheduling periodic encrypted saves.
6. Move the generated backup files outside of the Home Assistant SD card or main disk, saving them to a local NAS or encrypted cloud storage.
7. Immediately disable direct port forwarding of port 8123 on your home router if you had configured access not protected by HTTPS or a VPN.
8. Configure system notifications to receive immediate alerts in case of failed login attempts or critical errors in the security logs.
9. Update Home Assistant Core, Supervisor, and the operating system to the latest available stable security patch.

5. Secrets, Logs and Updates

Regular security maintenance requires special attention to hardcoded data, log cleanup, and timely updates.

Managing secrets.yaml Files

Never enter plain text passwords in automation files or in the main configuration (configuration.yaml). Use the !secret key_name syntax to recall protected data from the dedicated secrets file.

Log Analysis

Regularly monitor the system log (home-assistant.log) or the Logs section in Settings -> System to identify brute-force attempts from suspicious IP addresses, repeated authentication errors, or anomalies in add-ons.

Update Policy

Regularly update the system. Many zero-day vulnerabilities are patched in the security releases issued monthly by developers. Before every major update, always perform a full manual backup.

6. Verification of the result

To confirm that the security configurations are effective, perform the following checks:

• Log out from all clients and try to access: the system must strictly require the TOTP code generated by the app on the smartphone.
• Verify from an external port scanner (or from a cellular network by disabling Wi-Fi) that port 8123 does not respond in plain text (HTTP), but appears unreachable or protected by HTTPS/VPN.
• Check that automatic backups are present in the remote destination folder and that the restoration procedure has been tested at least once on a staging or test environment.

7. Troubleshooting

8. Frequently Asked Questions (FAQ)

Is it safe to use Home Assistant without a Nabu Casa subscription?

Yes, it is completely safe as long as you implement a private VPN (such as WireGuard) or a properly configured reverse proxy with valid SSL certificates (Let's Encrypt). The Nabu Casa subscription significantly simplifies this process by offering a ready-to-use solution and supporting the development of the project.

What should I do if I suspect a system compromise?

Immediately disconnect Home Assistant from the internet (disable the network connection or turn off the external router), change all administrator user passwords, revoke Long-Lived Access Tokens, analyze log files for anomalous IPs, and restore a clean backup prior to the date of the suspected compromise.

Can add-ons compromise security?

Yes, installing add-ons from unofficial or unverified repositories can expose the system to security flaws. Use exclusively official repositories or verified community stores and keep all add-ons up to date.

How do I secure automations that manage locks or alarms?

For critical devices such as smart locks or alarm systems, always implement an additional consistency check, require encrypted PIN codes within dashboards, and verify that critical commands are accessible only through users with elevated privileges and MFA enabled.