How to secure a Wi-Fi baby monitor or nursery camera

What can go wrong

A Wi-Fi baby camera sends video to a server or directly to your phone. Four weak points matter: the account (a weak or reused password), the device (outdated firmware or a default password), the network (a poorly protected router) and sharing (links and logins handed to many people). Fixing them takes about 30 minutes and costs nothing.

The ten-step checklist

1. Change default credentials. If the camera shipped with a username and password, replace both. The FTC advises never using default usernames or passwords, or any password you use elsewhere.
2. Use a long, unique password for the camera account and store it in a password manager.
3. Turn on two-factor authentication for the app or cloud account, if it is offered. The FTC recommends it.
4. Update the firmware and the app. Check the maker’s site for updates or turn on automatic updates. Keep the viewing app current.
5. Secure the router. Replace the default router admin password and network name, use WPA3 or WPA2 encryption, confirm the firewall is on and install router updates.
6. Put the camera on a separate network from computers and printers, such as a guest network or a dedicated one, if your router supports it. The FTC suggests this so a problem with one device does not expose your cameras. Some cameras do not work on guest networks that isolate devices; check, and see our guide to a separate smart home network.
7. Turn off remote access if you do not use it. The FTC suggests considering a camera that lets you disable remote viewing, especially if it shows private areas like bedrooms. If you watch only at home, local viewing is the smaller target.
8. Limit who can watch. Choose a camera with permission levels and give each person their own login instead of sharing yours. Remove people who no longer need access.
9. Check the access log. The FTC suggests checking access logs on IP cameras regularly for unfamiliar addresses or unusual access times. Sign out other sessions if the app allows it.
10. Retire old hardware. If the maker stops issuing updates, replace the camera, and factory-reset it before you sell or recycle it.

Which threat does each step handle

Choosing a camera with security in mind

• Encryption. The FTC advises choosing a camera with built-in security features, especially encryption for account information, livestreams and archived video. Check the product page or ask the maker.
• Update policy. Look for a stated period of security updates. A camera that stops getting updates ages quickly.
• Two-factor authentication and permission levels in the app.
• Physical privacy. A lens cover or a way to switch the camera off from the device itself is useful for a camera that does not need to watch around the clock.
• Standards. NIST has published a baseline of cybersecurity features for consumer IoT products (NIST IR 8425), and a U.S. labeling program was announced; see our explainer on the U.S. Cyber Trust Mark before relying on a label.

When logging in through a web browser, make sure the address starts with https at the login page and afterwards. If it does not, the login and the stream may not be encrypted.

Placement and cords

Security is not only about hackers. The CPSC advises keeping baby monitor cords at least three feet from any part of the crib, bassinet or play yard, and never placing a monitor inside or on the edge of the crib. Mount the camera on a wall or put it on a shelf on the far side of the room, and run the power cord so a child cannot reach it. Do not point a camera at the crib from a spot that needs a cord across the room floor.

Remember that a camera is not a medical device. The American Academy of Pediatrics advises against relying on consumer monitors to reduce the risk of SIDS; safe sleep practices come first.

Sharing with grandparents and sitters

Create a separate login for each regular viewer with the lowest permission level that works, and remove it when it is no longer needed. For one-time visits, ask whether the app offers temporary access instead of sharing your password. Never share a livestream link publicly. Our guide to sharing smart home access covers the same habit for locks and cameras.

If you think someone else has been watching

Warning signs include a camera that moves or speaks on its own, new devices or logins you do not recognize and settings that changed. Unplug the camera, change the account password from a device you trust, sign out all sessions, update the firmware, factory-reset the camera and contact the maker. If it happens again, replace the camera.

When a non-Wi-Fi monitor is the simpler answer

If you only need to see and hear the baby from elsewhere in the house, a monitor with a dedicated camera-to-parent-unit link needs no account and no internet. It cannot be reached remotely, which also means it cannot be reached by a remote attacker. See our Wi-Fi vs non-Wi-Fi comparison.