Use secure WiFi (and account) passwords.
Use strong passwords on WiFi routers (e.g., 12 characters that include at least two of each of the following: upper case letters, lower case letters, symbols and numbers) and don’t freely give out the password. Change all passwords periodically.
Create unique passwords for different devices.
Don’t re-use passwords. Be sure all of your devices and log-ins from routers to thermostats to bank accounts have their own passwords. Consider a password keeper like LastPass or Dashlane.
Do not use the default password for anything. Change passwords for products once they’re out of the box.
Regularly check for updates to your IoT devices.
Manufacturers will periodically uncover and fix weak points in the security. You’ll need to keep them updated in order to have the latest protection.