Secure the camera without turning the nursery into a tiny data centre
Can Baby Monitors Be Hacked? How to Secure Yours
Quick answer: yes, an internet-connected baby monitor can be accessed without permission, but a hack is not inevitable. The common protections are wonderfully boring: a unique account password, two-step verification, prompt software updates, careful household access and remote viewing switched off if you never use it. If an unknown person speaks through the monitor, the camera moves by itself or the account shows an unfamiliar login, turn the device off, move the baby if needed, secure the account and linked email from a trusted device, and contact the manufacturer. Call 999 for an immediate threat.
Baby-monitor horror stories are memorable because a stranger’s voice in a nursery is nightmare fuel. They do not mean every flickering light is a criminal in the router. The National Cyber Security Centre says unauthorised access to smart-camera feeds happens in rare cases and explains practical ways to make it much harder.
The risk depends on the type of monitor, how its account is protected, whether it receives updates and which features are enabled. This guide covers ordinary audio/video monitors and briefly separates them from products that measure breathing, movement or heart rate.
Which baby monitors can be hacked?
Wi-Fi and app-connected monitors
These connect to a home network and usually a manufacturer’s cloud service so a parent can view the feed away from home. That convenience creates more routes to protect: the monitor, app account, linked email, phone, router and provider’s service. A reused password stolen elsewhere, an unprotected account, old software or exposed network setting can all increase risk.
Local digital monitors
DECT, FHSS and other monitor-to-parent-unit systems do not normally put a live feed on the public internet. Their risk is different: nearby radio interception, accidental crossover or physical access rather than someone logging in from another country. Digital pairing and channel hopping reduce casual interference, but “non-Wi-Fi” is not the same as “magically impossible to intercept”.
Analogue monitors
Older analogue audio signals may be picked up by a nearby compatible receiver. They avoid a cloud account but offer less privacy from someone within radio range. Check the actual model rather than relying only on a shop label such as “digital” or “smart”.
What should you check before buying?
- Security-support end date: UK rules require manufacturers of consumer connectable products to publish how long security updates will be provided. A bargain monitor near the end of support can become an expensive ornament.
- No universal default password: connected products supplied under the UK regime must not rely on easily guessed shared defaults. You should still create a unique password for the account.
- Two-step verification: choose it where available. It can stop a login even when somebody has learned the password.
- Automatic updates: check whether firmware updates itself, how you learn about an update and whether the app is still actively maintained.
- Access and recording controls: find out who can join the household, whether old sessions can be signed out, where recordings are stored and how they can be deleted.
- A local-only option: if you do not need to watch from outside home, a model that works without internet access may suit you better.
- A real security contact: the manufacturer should explain how researchers or customers report a vulnerability.
Do not buy on “military-grade encryption” alone. Ask ordinary questions that affect an ordinary Tuesday: will it still be updated, can I turn remote access off, can I see connected users, and can a previous owner be removed completely?
Secure a Wi-Fi baby monitor step by step
- Update first. Install current updates for the monitor, its app, your phone and your router before settling on the final setup.
- Use a unique password. The NCSC suggests three random words as one memorable approach. Never reuse the email, shopping or social-media password.
- Turn on two-step verification. Store recovery codes somewhere another trusted adult can reach in an emergency, not in the nursery photo album online.
- Check household members. Remove old phones, former carers, installers and accounts that no longer need access. Give each adult their own login where the product supports it.
- Review remote access. If you only watch while at home, switch internet viewing off if the model allows. This may also disable alerts or smart-home connections, so test the result.
- Turn on automatic updates. If they are manual, set a monthly reminder and check the manufacturer’s support page.
- Secure the router. Change any old default administrator password, install router updates and disable administration from the internet unless it is genuinely needed.
- Consider UPnP and port forwarding. The NCSC says these router features can expose smart cameras and suggests considering disabling them. They can be needed by games or other devices, so follow the router and monitor instructions rather than randomly switching settings.
- Keep the camera physically safe. Put the monitor and cable well outside the cot and out of reach. Cybersecurity does not make a trailing wire safe.
Does a strange light or noise prove a hack?
No. A light can change during an update, connection loss, night-vision switch, motion event or another authorised adult viewing. A click can come from the infrared filter, and camera movement may be part of an automatic tracking feature. Read the model’s indicator guide and check the app’s access history before declaring cyber warfare on the night-light.
Take these signs seriously enough to investigate:
- an unknown voice or message through talk-back;
- the camera repeatedly pans, tilts or zooms when no authorised user or automation is doing it;
- an unfamiliar login, device, household member or password-reset alert;
- privacy, recording or notification settings changing without explanation;
- being locked out of the account or finding the recovery details replaced.
One sign is not proof. Several together, or a direct threat, justify immediate action.
What to do if you think the monitor is compromised
- Protect the room first. Turn off or unplug the camera. If somebody is speaking, threatening or moving it, take the baby with you and do not argue through the device.
- Record safe details. Note the time, alert text, account name, unfamiliar device and what happened. Photograph the app screen with another device if useful, without circulating private nursery footage.
- Use a trusted updated device. Change the monitor-account password and the linked email password. Sign out all sessions, remove unknown users and enable two-step verification.
- Check reused credentials. If that password appeared anywhere else, change those accounts too. Start with email because it can reset other logins.
- Update and reset. Install current firmware, then follow the manufacturer’s secure factory-reset and re-pairing instructions. Do not reconnect until the account and router are protected.
- Contact the manufacturer. Ask it to preserve account logs, confirm connected devices and investigate. Keep a case number.
- Report a threat. Call 999 if anyone is in immediate danger. For a non-emergency crime or credible threat, contact the police on 101 and follow their evidence advice.
If the provider reports a wider breach, follow its official notice rather than a link in an unexpected email. Check the company’s app or support site directly.
For wider care questions, use NHS baby health and care and NHS Start for Life baby advice; neither treats a monitor as a substitute for a safe cot setup or a health assessment.
A monitor does not make an unsafe sleep space safe
A video, movement or vital-sign monitor does not replace safer-sleep advice or adult supervision. The NHS says babies should sleep in the same room as a parent or carer for at least the first six months, day and night. The Lullaby Trust says there is no evidence that baby monitors prevent sudden infant death syndrome (SIDS).
Use a clear, flat, firm separate sleep space, place the baby on their back and keep monitor cables and devices outside the cot. Our newborn sleep guide, baby-pillow safety guide and safe baby bedtime routine cover the practical sleep setup.
Treat an app’s sleep graph as an estimate, not a health result or a grade for the night. The baby wake-windows guide explains why useful ranges still need to bend around the baby in front of you.
For broader care advice, use the current NHS baby guidance and NHS Best Start in Life baby advice. A monitor can help you hear or see a baby; it cannot diagnose why a baby looks or sounds unwell.
What about breathing, movement and heart-rate monitors?
These are not the same as a conventional audio/video monitor. The MHRA says many products that monitor breathing, movement, heart rate, blood oxygen or temperature meet the UK definition of a medical device. Look for the appropriate CE, UKCA or UK(NI) conformity marking and follow the clinician’s instructions when monitoring was prescribed.
Some families comparing connected nursery products also look at a baby heart rate monitor. Marketing reassurance is not a medical diagnosis and a consumer dashboard does not override safe-sleep guidance. Ask a health professional before using readings to make a medical decision, especially for a premature baby or a child with a known condition.
Can you safely use a second-hand monitor?
Potentially, if it is still supported and can be fully removed from the previous owner’s account. Check the published update end date, factory-reset it, create a new household, update it and confirm the seller no longer sees the feed. Replace missing or damaged cables with manufacturer-approved parts.
If the company has closed, the app has vanished or the monitor no longer receives security fixes, a free device may be poor value. Our before-baby preparation guide can help separate useful purchases from nursery clutter.
Common questions
Are non-Wi-Fi baby monitors safer?
They avoid a cloud account and remote internet viewing, which removes some risks. They can still be intercepted nearby, paired incorrectly, interfered with or accessed physically. Choose the risk and features that fit your home.
Should the baby monitor use a separate Wi-Fi network?
A guest or dedicated smart-device network can limit what a compromised gadget can reach, if your router supports it and you can manage it confidently. It is an extra layer, not a substitute for passwords, two-step verification and updates.
Does a strong Wi-Fi password protect the monitor account?
No. The router password and cloud-app password protect different doors. Make both unique and protect the linked email account too.
Can I keep remote viewing?
Yes, if it is useful. Protect the account, use two-step verification, review connected users and keep software current. Turning a feature off is best only when you do not need it.
Where can I learn the same basics for older children?
Use the online-safety guide for children for accounts, conversations and incident reporting, or browse the KidsCo child-safety hub.
The bottom line
A connected baby monitor can be hacked, but “connected” does not mean “already compromised”. Buy a supported product, use a unique password and two-step verification, update it, limit remote access and know who shares the account. Treat odd behaviour as a reason to check—not instant proof. If a compromise is credible, power the camera down, protect the baby, secure the account and email, contact the maker and involve police for threats or danger.
Sources reviewed
Editorial check: KidsCo, 6 August 2026. This is general UK consumer-security and baby-safety information, not an individual cybersecurity investigation, product endorsement or medical assessment.
