A home inspection gives an authorized inspector access to rooms, utilities, panels, appliances, attics, crawlspaces, and exterior areas that ordinary visitors may never enter. This 2026 HomeKit security checklist gives the seller, buyer, agent, and inspector a written way to manage entry, alarm zones, cameras, locks, private storage, connected controls, outages, incidents, and same-day closeout.
This is a security operations guide, not legal, real-estate, inspection, insurance, electrical, gas, plumbing, HVAC, structural, or surveillance advice. The parties should follow the inspection agreement, local law, building or HOA rules, insurer requirements, safe-work practices, and the written instructions for every lock, alarm, camera, utility, appliance, and connected device.
HomeKit home inspection security at a glance
| Home inspection job | Minimum control | Pass evidence |
|---|---|---|
| Inspector entry | Named credential for one door and one appointment window | Entry, relock, expiry, and fallback tested |
| Inspection route | Written general, escorted, specialist, and closed areas | Inspector repeats the access and stop-work boundaries |
| Alarm state | Only planned openings bypassed or disarmed | All other exterior openings retain direct state |
| Camera privacy | Disclosed, lawful views with private areas excluded | Live view, recording state, access, and retention checked |
| Property protection | Valuables, documents, medicines, keys, and unrelated controls removed or locked | Pre-inspection condition and access record completed |
| Closeout | People, openings, utilities, devices, alarm state, and credentials reconciled | All agreed states restored and removed access fails |
1. Define the appointment boundary before changing the security system
Write the property address, date, appointment window, inspector, buyer and agent attendees, approved entry, inspection scope, closed rooms, specialist limits, utility rules, seller contact, backup contact, alarm owner, camera owner, and final closeout owner. Treat pre-inspection setup, the general inspection, any invasive or specialist test, and closeout as separate operating periods.
Draw a route from the approved entrance through every authorized room and exterior area. Mark each door, window, balcony, garage, basement, attic, crawlspace, roof access, shed, utility room, electrical panel, water shutoff, gas appliance, HVAC control, owner closet, network cabinet, medicine cabinet, key board, and device screen as general, escorted, specialist-only, or closed. A closed area needs a physical control, not only a verbal instruction.
- State the earliest setup entry and the hard credential-expiry time.
- Name the person who may change the inspection route.
- List every opening, utility, appliance, panel, and connected control expected to be tested.
- Record whether the property is occupied, vacant, staged, or partly moved.
- Separate seller devices from devices that will remain with the property.
- Assign one person to the final room-by-room sweep.
2. Give the home inspector a named, time-limited entry route
Use one named inspector credential for one approved door. Follow the temporary smart-lock access and removal checklist to record the door, person, start, expiry, owner, fallback, and deletion proof. Do not share a household administrator code, reuse a former cleaner or contractor code, or place the alarm master PIN in the inspection notes.
Test the credential from outside with the door closed, latched, and aligned. Prove the inspector can enter during setup, relock during the appointment if needed, and exit at close. Keep the approved mechanical-key or emergency-power fallback under named custody. A lockbox, key, app invitation, phone key, PIN, and alarm user are different credentials and need separate owners.
If a specialist joins the general inspector, issue a separate credential only when independent entry is authorized. A shared code makes it harder to attribute late entry, failed attempts, and incomplete closeout. Never give the inspector credential to a buyer, contractor, or other attendee.
3. Keep lock access, alarm authority, and Apple Home membership separate
Unlocking a door does not prove the alarm is disarmed, and a reported locked state does not prove the door is closed. Record the physical door, latch, lock, contact sensor, alarm zone, Apple Home tile, and automation state as separate facts.
Prefer a named alarm user or seller-controlled disarm where supported. The inspector should not receive the household master PIN, recovery code, monitoring account password, or unrestricted administrator account. If the system cannot isolate the inspection route safely, the seller or authorized agent must own the approved disarm and rearm sequence.
A single inspection usually does not require permanent membership in the Apple Home. Review Apple’s current Home sharing controls before inviting anyone. If temporary Home access is used, record the exact permissions and remove it during closeout with the HomeKit member-removal checklist.
4. Build an alarm-zone plan for inspection tests
List each zone that may change during the appointment: approved entry, patio door, garage personnel door, balcony, gate, attic hatch, crawlspace access, or another exterior opening the inspector is authorized to operate. Keep unrelated windows, secondary doors, sheds, owner closets, and closed floors protected when the system design and safe egress allow it.
Do not disable the whole alarm simply because several openings will be tested. Record the normal state, inspection state, test owner, restoration step, and result for each changed zone. Treat fire, carbon-monoxide, panic, and other life-safety devices according to maker and provider instructions; the inspector should not operate or bypass them outside the agreed safe test method.
At the end, inspect every changed opening directly. Use the open-zone troubleshooting checklist if the panel or app reports a door or window open after the physical sweep.
5. Remove valuables and authority, not only visible clutter
Before photography, setup, or inspector entry, remove or lock medicines, identity documents, financial records, spare keys, vehicle keys, passports, mail, portable electronics, jewelry, firearms, family calendars, school information, password notes, recovery codes, alarm paperwork, camera labels, and anything that reveals another property or account.
Check smart displays, wall tablets, voice assistants, unlocked computers, printer trays, routers, charging phones, keypads, garage remotes, and screens that show camera views or access history. Put seller-controlled devices into a documented privacy state or remove them. A Home scene can support a checklist, but it cannot confirm that a drawer is empty or a spare key has been secured.
Record valuable fixtures and devices that remain with the home. Photograph their condition before the appointment without exposing setup codes, serial numbers, private labels, or recovery information in the listing.
6. Set a lawful camera and audio boundary
Tell the inspector which doorbells and cameras are active, whether audio is enabled, who can watch live, what incident or boundary breach would justify review, and how long relevant evidence will be retained. Follow local law, the inspection agreement, and the inspector’s policies. Do not use hidden cameras in bathrooms, bedrooms, changing areas, or other places where people reasonably expect privacy.
Use the security-camera privacy guide to document placement, users, recording, retention, and sharing. A useful inspection view answers a narrow security question such as whether someone crossed a closed boundary or whether the inspector left. It should not become open-ended profiling or expose private conversations.
If an interior camera is paused, covered, moved, or removed, record its original position, network path, recording state, and restoration owner. Confirm that the inspection or listing photos do not reveal camera blind spots, alarm panel details, lock codes, setup labels, or exact storage locations.
7. Control utility and connected-device tests
Write which thermostats, smart switches, outlets, valves, garage controls, irrigation zones, appliances, panels, and shutoffs the inspector may operate. Keep alarm controls, camera administration, network settings, account recovery, automations, and unrelated smart-home devices outside that authority unless the inspection agreement names an exact test.
Record the starting state before any control changes. The inspector should announce a power, water, gas, heating, cooling, garage, or network test that could interrupt the alarm, cameras, hubs, storage, locks, or monitoring path. Unsafe, destructive, invasive, or specialist work needs separate written authority and the right qualified person.
Automations should be narrow and reversible. Pause rules that could undo the inspector’s test, relock an occupied route, start irrigation, change HVAC, open a garage, or send misleading alerts. Restore each rule only after its trigger, condition, action, and normal state are checked.
8. Protect vacant-home and partly moved-home failure paths
A listed home may have weak internet, disconnected utilities, empty rooms, removed equipment, missing backup contacts, or devices that the seller plans to take. Record what works locally and what needs the internet, a home hub, mains power, a vendor service, the seller’s phone, or a paid plan.
Run the internet-outage test before an unattended appointment. Verify the local lock credential, alarm keypad, siren, monitoring path if subscribed, camera recording path, and closeout route. A missing push alert does not prove a door stayed closed, and a working camera does not replace a direct opening sensor.
Keep a charged phone, printed contacts, authorized mechanical-entry fallback, and a safe lighting plan. Do not hide a permanent key on the property or leave recovery information beside the hub, router, keypad, or lock.
9. Define late arrival, failed entry, and unexpected-access rules
Decide what happens when the inspector arrives outside the approved window, a code fails, the door binds, someone tries a closed room, an unlisted specialist appears, or another appointment overlaps the inspection. The response should stop and verify, not widen access.
Use a known inspector, buyer-agent, or booking contact route rather than a phone number supplied by an unexpected caller. Never respond to a failed inspector code by sending the household master code. Use the failed-entry incident checklist when the lock reports repeated attempts, an unknown credential, tamper, or a conflicting door state.
Preserve original timestamps and device records before renaming users, deleting codes, clearing events, or changing time settings. If identity or authority cannot be confirmed, keep the property closed and reschedule access.
10. Run a room-by-room closeout before the property is left alone
- Confirm the inspector, specialists, buyer, agents, and every other approved attendee have exited or joined the closeout team.
- Walk the inspection route, escorted areas, bathrooms, closets, garage, exterior spaces, and every boundary that changed.
- Check for missing property, moved devices, open windows, unlocked doors, water, heat, smoke, damage, personal items, and unexpected packages.
- Close and latch each window, door, hatch, gate, garage door, and private-room barrier.
- Verify direct sensor state, lock state, camera state, router and hub power, and the intended alarm mode.
- Restore only the automations and privacy settings that were documented before the appointment.
- Expire inspector and specialist credentials; remove temporary Home, vendor-app, and camera access.
- Test removed access from outside. It must fail without locking the seller or authorized agent out.
- Record incidents, missing evidence, defects, owners, and the next required retest.
11. Preserve an incident record without searching unrelated household data
If there is missing property, unexpected entry, a forced private door, an alarm, a damaged sensor, an altered utility state, a privacy complaint, or a failed closeout, use the incident timeline worksheet. Record the inspection schedule, authorized people, original lock and alarm events, relevant clips, calls, device changes, decisions, and unresolved gaps.
Preserve original files and export paths before editing the system. Limit review and sharing to relevant evidence and lawful recipients. Do not browse unrelated private footage, messages, account history, or attendee information just because an incident occurred.
Run a 60-minute HomeKit home-inspection security test
- Minutes 0–10: review the inspection record, inspection route, closed areas, contacts, camera boundary, valuables, and stop-entry rules.
- Minutes 10–20: test named inspector entry, full door closure, alarm handling, and the authorized fallback from outside.
- Minutes 20–30: walk the inspection route and prove closed rooms, private devices, unrelated locks, and alarm zones remain outside inspector control.
- Minutes 30–40: simulate an internet outage and an unavailable seller. Use the local entry, alarm, communication, and closeout routes.
- Minutes 40–50: simulate a failed code, unexpected specialist, opened private door, and utility or connected-device state that cannot be restored. Follow the stop, verify, and incident rules.
- Minutes 50–60: stop entry, complete the room sweep, restore states, rearm, revoke access, and prove removed credentials fail.
HomeKit home inspection security scorecard
| Control | Owner | Pass rule |
|---|---|---|
| Inspection record | Home inspector | Times, people, route, closed areas, and contacts are written |
| Named entry | Lock owner | Inspector credential works only for the approved route and period |
| Alarm scope | Alarm owner | Changed zones are listed and every other opening retains its intended state |
| Privacy | Seller and agent | Cameras are disclosed, private views excluded, and inspection photos reveal no secrets |
| Property control | Seller | Valuables and authority records are removed or physically secured |
| Test control | Home inspector | Every opening, utility, and connected-device change has an owner and restoration result |
| Closeout | Named two-person team | Every room, opening, device state, and incident is reconciled |
| Revocation | Account owner | Temporary lock, Home, app, and camera access is removed and retested |
Do not open the property until these blockers are cleared
- No named person owns the appointment, alarm state, cameras, utility tests, or final sweep.
- The home inspector has a household master code, alarm master PIN, or administrator login.
- The inspection route, closed rooms, private storage, or scope-change rule is not written.
- Valuables, medicines, keys, identity records, recovery codes, or device-control screens remain exposed.
- Camera and audio use has not been reviewed against law, the inspection agreement, and local policy.
- A required exit is blocked or a life-safety device is bypassed for convenience.
- The entry lock has no tested battery, alignment, key, or approved emergency-power fallback.
- Internet availability is treated as proof of physical door, window, utility, or inspector state.
- No one can prove that temporary access expires and fails after the appointment.
Frequently asked questions
Should a home inspector become a permanent Apple Home member?
Usually not for a single home inspection. Prefer a named, time-limited door credential and seller-controlled alarm handling. If temporary Home access is needed, limit it, record it, remove it at close, and prove it no longer works.
Should the inspector know cameras are active?
Follow local law, the inspection agreement, and local policy. Disclose active cameras and audio, exclude private areas, limit viewers and retention, and use recording only for a defined security purpose.
Can the front-door sensor be ignored during the appointment?
The operating plan can account for frequent front-door use, but that does not justify disabling unrelated openings or life-safety devices. Keep physical, contact, lock, alarm, and Apple Home states separate and restore the normal state at close.
What should be checked after the inspector leaves?
Check every room, door, window, hatch, gate, garage door, lock, sensor, camera, router, hub, utility, tested device, key, and private boundary. Then restore the agreed states, rearm, remove temporary access, and prove removed credentials fail.
Can HomeKit prove the inspection is closed?
No. Home and device events can support the record, but the closeout owner still needs a physical sweep, people reconciliation, utility check, device-state check, and credential-removal test.
