How to Secure Your Ubiquiti Cloud Key: Best Practices and Settings

Keep Firmware Up to Date

Ubiquiti regularly releases firmware that patches known vulnerabilities and improves stability. Enable automatic updates in the UniFi Network Controller or schedule manual checks at least monthly. After each update, verify that the Cloud Key reboots cleanly and that all managed devices reconnect.

Enforce Strong Authentication

Replace the default admin credentials with a unique username and a complex password (minimum 12 characters, mixed case, numbers, and symbols). Enable two‑factor authentication (2FA) in the UniFi OS settings; this adds a time‑based code requirement for every login, dramatically reducing the risk of credential theft.

Restrict Network Access

Place the Cloud Key on a dedicated management VLAN separate from guest and IoT traffic. Use firewall rules to allow only trusted subnets (e.g., your office LAN) to reach the device's IP on ports 443 (HTTPS) and 8443 (controller UI). Block inbound traffic from the internet unless you specifically need remote access.

Secure Remote Management

If you must manage the Cloud Key from outside your network, avoid exposing the UI directly. Instead, set up a VPN gateway (e.g., UniFi Dream Machine or third‑party OpenVPN) and connect through it. Alternatively, use SSH tunneling with key‑based authentication; disable password logins for SSH entirely.

Limit Account Privileges

Create separate user accounts for daily operations and for administrative tasks. Assign the "Read‑Only" role to staff who only need to view network status, and reserve the "Administrator" role for a limited number of trusted users. Regularly audit account activity in the UniFi logs.

Backup Configuration Regularly

Export the UniFi Network Controller backup at least weekly and store it encrypted offsite. In the event of a compromise, a recent backup speeds restoration and ensures that security settings are not lost.

Monitor and Respond to Alerts

Enable email or push notifications for critical events such as failed login attempts, firmware changes, or device reboots. Pair these alerts with a SIEM or simple log‑watch script that can trigger automated actions, like locking an account after repeated failures.

Physical Security Considerations

Place the Cloud Key in a locked rack or enclosure to prevent tampering. If the device is mounted in a public area, consider using a tamper‑evident seal and regularly inspect it for unauthorized access.

Key Settings Overview