Checking your shop, home or hotel entrance from your phone is one of the most useful things a CCTV system can do. It is also the part most often set up in a hurry, and a careless set-up can let strangers try to log in to your recorder.
Checking your shop, home or hotel entrance from your phone is one of the most useful things a CCTV system can do. It is also the part most often set up in a hurry, and a careless set-up can let strangers try to log in to your recorder.
This guide, for owners of their own systems, covers how remote viewing works, safe set-up, troubleshooting and removing old access.
Your cameras send video over cables (or Wi-Fi) to a recorder: an NVR for IP cameras, or a DVR for older analogue/HD-analogue cameras. Some standalone cameras record to a memory card or the cloud instead. If you are not sure which type you have, CCTV Cameras Explained covers the basics.
When you open the app on your phone, it has to reach that recorder across the internet. The recorder sits behind your router, which by design blocks unsolicited connections coming in from outside. So something has to make the connection possible. There are three common ways, and they are not equally safe.
| Part | Its job in remote viewing | What can go wrong |
|---|---|---|
| Camera | Captures video and sends it to the recorder | Weak or default password if it is reachable directly |
| Recorder (NVR/DVR) | Stores footage and serves live and recorded video to apps | Outdated firmware; shared admin login; web page exposed to the internet |
| Router | Connects your site to the internet and blocks unwanted incoming traffic | Port forwarding or UPnP opening holes you did not intend |
| Internet connection | Carries video out of your site | Low upload speed causes buffering; a power cut without a UPS takes it offline |
| Your phone and app | Logs in and displays the video | Old app version, weak phone lock, mobile data limits |
Upload speed matters more than download speed. Internet plans are sold on download speed, but remote viewing uses your site's upload. Watching also uses your phone's mobile data, and the full-quality stream uses far more than the sub-stream (the lower-quality second stream most recorders offer). Our CCTV storage calculator shows typical bitrates per camera, a rough guide to the bandwidth each live view needs.
1. The manufacturer's cloud or P2P service. The recorder makes an outgoing connection to the maker's service, and your app finds it by serial number or QR code. No router ports are opened. For most owners this is the simplest safer option, if the account is well protected. The trade-off: you rely on the manufacturer's service and its security.
2. A VPN (virtual private network). Your phone joins your site's network through an encrypted tunnel, then the app talks to the recorder as if you were standing in the building. The recorder itself is never visible to the internet. Options include:
3. Direct port forwarding. The router passes internet traffic straight to the recorder. It is quick to set up, and it puts your recorder's login in front of anyone scanning the internet. We do not recommend it as a default.
Warning Hikvision's command-injection flaw CVE-2021-36260 let attackers send malicious commands to the web server of affected cameras and recorders. CISA added it to its Known Exploited Vulnerabilities catalog in January 2022, meaning it was actually used in attacks. A device whose web server is open to the internet can be attacked before the owner has a chance to update it.
The UK's National Cyber Security Centre (NCSC) advises camera owners to consider turning off UPnP and port forwarding on the router, because criminals can use them to reach devices such as cameras on your network. The US Cybersecurity and Infrastructure Security Agency (CISA) summarised the same advice, warning that attackers can get live feeds or images from poorly secured cameras. More broadly, CISA's internet exposure guidance tells organisations to find what is reachable from the internet, remove what does not need to be, and put necessary remote access behind a VPN or similar controlled gateway.
In plain terms: any login page on the open internet will be found and tried, and recorders often go years without updates.
UPnP (Universal Plug and Play) lets devices open router ports by themselves, so a recorder can expose itself without anyone deciding to. Keep it off unless you need it.
Plays from YouTube when you press play.
Most recorders let you create several users with different permissions. Use that.
Hanwha Vision's guide recommends creating extra user accounts with minimal privileges, a principle that applies to any brand.
Tip Review the user list and the recorder's log every few months. Delete accounts nobody recognises.
A VPN is a good fit when:
If family members just need simple one-tap viewing and nobody can manage VPN accounts, a well-protected manufacturer cloud account is usually the practical choice.
When the app shows "offline" or the video keeps buffering, work through this order:
Only then contact the camera supplier or ISP, and tell them what you tested.
Warning If someone suggests "just open the ports" to fix it, ask why the cloud service or VPN cannot be fixed instead.
When an employee leaves, or you change installer, do this the same day:
If you suspect someone has taken control of the device, the NCSC's smart devices guidance advises resetting it following the manufacturer's instructions.
Usually it is the simplest safer option, because nothing is opened on your router. Protect the account with a unique password and MFA, and keep everything updated.
Not for cloud/P2P viewing or most mesh VPNs, which rely on outgoing connections. A static or public IP is mainly needed for port forwarding or a router-hosted VPN.
Usually the site's upload speed or your mobile signal is the limit. Switch to the lower-quality sub-stream, view fewer cameras at once, or check the site's upload speed.
Yes. The NCSC suggests disabling remote access you do not need. You can switch it back on later.
Not necessarily. Update the firmware, change passwords, check users and logs, then move to cloud or VPN access and remove the forwarding rules.
Three quick wins for today: update the recorder firmware, set a strong unique admin password, and give each person their own viewer account. Then confirm no router ports point to the recorder. For a wider view of your security basics, try our free cybersecurity checklist.
If you would like a second pair of eyes, Extrion Tech can review and configure remote access for your CCTV system as part of our security auditing and implementation service. Get in touch and tell us what you have.
This guide is general information to help you plan. Prices, product features and regulations change, so confirm the details for your own site before you buy.
Keep learning
Security & Surveillance
10 min
Buying CCTV for the first time is confusing. Sellers use words like turret, NVR, PoE and IP67, and two cameras that look alike can differ a lot in qua...
Read guide
Security & Surveillance
10 min
"How many days will it record?" is one of the most common questions about any CCTV system, and the answer is usually "it depends". This guide shows wh...
Read guide
Security & Surveillance
10 min
When you plan CCTV, one of the first questions is about shape: the long "bullet" camera you see on gate pillars, or the round "dome" you see on shop c...
Read guide