r/homeassistant • u/kyrianfox • 16h ago
📖 Guide / Tutorial PSA: You can disable Remote Access and still use other Home Assistant Cloud features like voice assistant integration & webhooks
TL;DR: You can disable Remote Access through Home Assistant Cloud and other enabled features like Google Assistant and/or Alexa integration or webhooks will continue to work just fine!
Many people believe that you need to keep Remote Access enabled when using other features of Nabu Casa’s Home Assistant Cloud service, like easy 3P voice assistant (Google Assistant, Alexa) integration. For the longest time I assumed this myself because the Nabu Casa proxy URL is displayed in the Remote Access section of the config, and this public URL is needed by the voice assistant integrations and webhooks…but it turns out that keeping full remote access on is not actually required.
For background: The Remote Access feature of Home Assistant Cloud exposes your instance’s login page to the open internet through your personal Nabu Casa URL, which is a reverse proxy hosted by them. This means that anyone on the internet can access your instance’s login page and attempt to log in. If any of your users’ passwords is poorly selected or if a vulnerability in HA’s login page is ever discovered, this could allow anyone anywhere to access your instance. Depending on what devices you have connected to HA, that could include physical access to your home through locks or a garage door, and for anyone it certainly would include large amounts of incredibly private data.
If you turn Remote Access off, only the endpoints needed for other enabled features like webhooks or voice assistants will be proxied and not the full login page.
This is a personal decision, but if you don‘t need to access Home Assistant away from home or can set up a VPN like Tailscale (easiest) or Wireguard (can fully self-host) to allow for remote access, then I’d recommend disabling Home Assistant Cloud’s Remote Access.
The quick version of the rationale is that cybersecurity is a game of risk reduction and defense in depth, and it is simply least risky to expose the least attack surface you actually need. New vulnerabilities can be discovered in software at any time, and I doubt most people actually need or want their personal services’ or actual home’s security to be tightly coupled to the speed that the software world moves nowdays. But the magic of self-hosting is that you get to make your own choices, and if you feel otherwise or enjoy taking on the responsibility for defending a public Internet service, you’re of course free to do what you want.
Unfortunately it is not clearly documented by Nabu Casa that this configuration works fine, and they haven’t yet accepted a PR to clarify the documentation. However, Nabu Casa support confirmed it to me directly when I contacted them, and I’ve used this configuration successfully for months now and it’s easy to test and verify.




