A smart lock can add named codes, remote control, and useful activity records, but the electronics do not make a weak door opening secure. The lock, deadbolt, strike, frame, hinges, cylinder, interior release, app account, and backup entry path form one system. This audit checks that system without treating an app feature, marketing badge, or expensive keypad as proof of forced-entry resistance.
Short answer: verify the exact lock model and certification, confirm that the door and frame are sound, prove that the bolt extends without motor strain, inspect the strike and fasteners, control keys and codes, and test entry and exit during power and internet failures. Stop and use a qualified locksmith, door professional, landlord, building manager, or fire-safety authority when the opening is damaged, fire-rated, shared, or outside your authority to modify.
Smart lock physical security at a glance
| Layer | What to record | Pass condition | Do not assume |
|---|---|---|---|
| Door | Material, thickness, damage, warping, edge condition | Sound opening that closes consistently | A new lock repairs a weak or split door |
| Deadbolt | Exact model, backset, throw, handing, certification claim | Full travel with the door open and closed | App-reported “locked” proves full bolt extension |
| Strike and frame | Strike type, pocket depth, fasteners, frame condition | Bolt enters freely and hardware is properly seated | Visible screw length proves anchoring or suitability |
| Cylinder and keys | Key count, custody, rekey status, emergency path | Known keys work and unauthorized copies are addressed | Deleting codes cancels physical keys |
| Interior release | Thumb-turn or approved release path | Occupants can exit as required without an app | A connected lock may delay emergency egress |
| Accounts and codes | Owner, admins, users, recovery, updates | Named access and tested revocation | Physical strength fixes weak account control |
| Failure state | Low battery, dead battery, internet loss, hub loss | Documented entry and exit paths still work | Remote control or alerts always remain available |
Start with the exact opening, not a lock shortlist
Create one record for each exterior or controlled door. Photograph the door face, edge, hinges, frame, strike, threshold, weather seal, existing bore, and the label or model information on the installed hardware. Record whether the property is owned, rented, strata-managed, part of a multi-unit building, or subject to fire-door rules. Permission is a security control: an unapproved modification can create a repair dispute, disable required hardware, or force a rushed reversal.
Measure only with the door owner’s approval and the manufacturer’s current template. Record door thickness, bore diameter, edge-bore diameter, backset, cross-bore position, frame clearance, trim clearance, handedness, and the distance between separate handles and deadbolts. The smart lock retrofit guide explains these fit terms. Do not drill, chisel, lengthen holes, or change a fire-rated opening from a generic article.
Opening record
- property and door name;
- owner or approver;
- door and frame material;
- door thickness, backset, bore, and clearance;
- deadbolt, cylinder, strike, hinge, closer, and sensor models;
- fire, egress, rental, strata, insurance, and warranty constraints;
- installer name and installation date;
- photos before and after work;
- exact app, firmware, hub, bridge, and service path; and
- next inspection date.
Verify lock claims at exact-model level
The Builders Hardware Manufacturers Association says its ANSI/BHMA standards cover builders hardware and publishes an explanation of product grade levels. Use the manufacturer’s current documentation and the relevant certification directory to verify the exact model, function, and claimed standard. Do not transfer a grade from one model in a product family to another, and do not describe a self-claimed feature as independent certification.
A lock grade is not a grade for the complete doorway. Door material, frame condition, strike preparation, hinges, glazing, adjacent sidelights, installation, and maintenance can change the real result. Record certification as one input, then test the actual installed opening under safe normal use.
| Claim | Evidence to keep | Boundary |
|---|---|---|
| ANSI/BHMA grade or certification | Exact model in current manufacturer or certification record | Applies to the tested product and standard, not automatically to the door |
| Weather or exterior rating | Exact exterior component, environment, temperature, and installation limits | An exterior keypad rating may not apply to interior electronics or a full lock |
| Fire-door compatibility | Door label, lock listing, approved preparation, and professional sign-off | Do not modify a labeled opening from consumer instructions |
| Auto-lock or door-state feature | Current manual, required sensor, tested behavior | A timer is not the same as proof that the door is closed |
| Encryption or account security | Current vendor security page, update policy, account settings | Digital controls do not repair the frame or strike |
Inspect the door before the electronics
Open and close the door slowly. Look for splits around the bore, damaged edges, loose skins, rot, corrosion, water damage, cracked glazing, loose panels, swelling, and repairs that move under hand pressure. Check that hinges are secure and that the door does not drop, bind, or spring away from the seal. If the structure is damaged, stop. A motorized deadbolt can hide a problem for a few cycles and then fail when temperature, humidity, or wind changes.
Test from the inside and outside while the property is occupied and an independent entry path remains available. Never slam, kick, pry, shoulder, drill, pick, bump, or otherwise perform destructive or bypass testing. This is an inspection and normal-use test, not a forced-entry experiment.
Prove deadbolt travel with the door open and closed
First operate the deadbolt with the door open. It should extend and retract through its intended travel without scraping, stalling, or requiring the door to be pushed. Then close the door normally and repeat the test by hand, keypad, approved mobile credential, and any supported automation. Compare the sound, time, and resistance.
If the closed-door cycle is slower, louder, incomplete, or dependent on pulling the handle, fix the opening before relying on remote status. The smart lock door-alignment guide provides a controlled diagnostic sequence. Do not make the motor compensate for a shallow pocket, shifted strike, sagging hinge, thick weather seal, or warped door.
Record five states separately
- Door open: the opening is not secured even if the bolt is extended.
- Door closed: the leaf is within the frame, but the deadbolt may not be extended.
- Bolt commanded: an app, keypad, key, or thumb-turn requested movement.
- Bolt physically extended: the bolt reached the intended position in the pocket.
- Opening secured for the tested state: the door, frame, strike, and lock passed the defined normal-use check.
Do not collapse these states into one green icon. If the lock lacks an independent door-position sensor, say so in the operating record.
Inspect the strike, pocket, and frame
The strike should be the correct part for the lock and opening, sit flat, and allow full bolt travel. The bolt pocket must be clear and deep enough for the installed hardware. Fasteners must be the type, location, and length required by the current manufacturer instructions and suitable for the actual frame construction. The current Schlage Encode door-preparation instructions, for example, treat strike and reinforcement-plate preparation as part of the installation—not as decoration.
Do not remove screws merely to estimate their length, substitute longer screws blindly, over-tighten a strike into damaged material, or assume a decorative frame has solid structure behind it. Pipes, wiring, glazing, metal frames, sidelights, fire labels, and concealed reinforcement can change the safe method. Ask a qualified person when the frame condition or anchoring path is unknown.
Strike and frame pass questions
- Is the exact strike or approved equivalent installed?
- Does it sit flat without movement or sharp raised edges?
- Does the bolt enter fully without touching the strike or pocket?
- Is the frame free of splits, crushed material, loose trim, and failed repairs?
- Are fasteners installed to the manufacturer’s current instructions?
- Does normal closing avoid excessive force?
- Does the result stay consistent in the morning, evening, heat, cold, rain, and dry weather relevant to the property?
Check the cylinder, keys, and exterior controls
A keypad or phone credential does not cancel the mechanical key path. Count issued keys, identify who holds them, record the most recent rekey, and test every retained key without locking anyone out. If key custody is unknown, use the smart lock rekeying checklist and get permission before changing the cylinder.
Inspect the exterior escutcheon, keypad, reader, emergency contacts, and accessible fasteners for looseness or damage. Do not dismantle the device, probe ports, defeat tamper features, or copy techniques from bypass videos. The FTC’s Tapplock case is a useful warning against broad “unbreakable” claims: smart-device security claims require evidence. Your audit should record what was verified, not repeat marketing language.
Prove emergency exit and backup entry
Occupants should not need a working phone, cloud service, remembered password, or healthy battery to follow the property’s required emergency-exit path. Run the smart lock emergency-egress checklist with the responsible adult present. Stop if the inside release binds, requires an unexpected sequence, conflicts with another lock, or creates doubt about fire or accessibility rules.
For backup entry, test the exact documented method while another authorized person remains inside or another independent entry is available. That may be a managed physical key, manufacturer-supported emergency power, a local credential, or another approved route. The mechanical-key backup checklist separates possession, storage, handoff, and revocation. Do not hide a key in an obvious place or publish the backup route in a shared note.
Audit the connected controls too
The Federal Trade Commission’s consumer guidance for internet-connected devices at home recommends steps such as changing default credentials, using strong unique passwords, protecting the router, and checking for updates. Apply those controls to the lock account, email account, phone, hub, bridge, and voice-assistant link.
- name the primary and backup administrators;
- use unique account credentials and the strongest supported sign-in protection;
- remove former residents, contractors, cleaners, carers, and guests;
- replace shared permanent codes with named credentials where supported;
- review integrations and revoke ones no longer used;
- record firmware, app, hub, and bridge versions;
- verify alerts on the devices that must receive them;
- test account recovery before an emergency; and
- keep recovery details outside the lock app in an access-controlled record.
Physical and digital layers should fail independently where possible. A compromised account should not expose a hidden physical key, and a lost key should trigger its own rekey decision rather than only a password change.
Test batteries, power, internet, and service state
Record the battery type, installation date, low-battery warning path, replacement owner, and safe replacement interval based on the current manual and observed use. Link the lock to the household’s battery-maintenance record. Do not wait for the motor to slow before defining ownership.
Use controlled failures only. Keep the door open for the first battery and connectivity tests, retain independent entry, and avoid factory resets. Document what remains possible locally, what requires the internet, what requires a hub or bridge, what alerts are lost, how status resynchronizes, and how long recovery takes.
| Failure | Test safely | Record | Blocker |
|---|---|---|---|
| Low battery | Use the supported warning or controlled replacement procedure | Who is alerted and how early | No named owner or no working warning |
| Dead battery | Follow the manual with backup entry available | Local credential, key, or emergency-power behavior | Unproven entry path |
| Internet loss | Pause the approved network path without resetting devices | Local entry, remote control, alerts, history, restoration | Household assumes remote control still works |
| Hub or bridge loss | Disconnect only the documented component | Direct versus hub-dependent functions | No recovery owner |
| Service or plan change | Review current account state and documentation | Features retained or lost | Purchase depends on an unverified plan feature |
Use an installer handoff, not a verbal promise
If a locksmith or installer performs the work, use the smart lock installer quote checklist before work begins. The scope should identify the exact lock, strike, preparation, permissions, materials, account owner, setup devices, warranty boundary, cleanup, keys, codes, and acceptance tests.
After installation, the household administrator—not the installer’s personal account—must control the system. Remove temporary installer access, collect setup codes and spare parts, photograph the completed opening, and run the smart lock installation acceptance test. A successful app pairing is only one line of the handoff.
Run a 60-minute smart lock physical security audit
- Minutes 0–5 — authority: confirm owner, modification permission, fire/egress constraints, occupants, and independent entry.
- Minutes 5–12 — opening record: photograph and record the door, frame, hinges, strike, threshold, glazing, lock, and sensor.
- Minutes 12–18 — exact model: record model, manual, certification claim, app, firmware, hub, service, and installation date.
- Minutes 18–25 — door-open travel: test thumb-turn, key, keypad, and approved electronic credential with the door open.
- Minutes 25–32 — closed-door travel: close normally and repeat. Record noise, speed, resistance, and physical bolt extension.
- Minutes 32–38 — strike and frame: inspect seating, movement, damage, pocket clearance, weather effects, and visible preparation without dismantling.
- Minutes 38–43 — keys and codes: reconcile keys, admins, users, recovery, integrations, and temporary access.
- Minutes 43–49 — exit and backup entry: prove required egress and the documented backup route with another authorized person present.
- Minutes 49–55 — controlled failures: test one supported battery, internet, or hub failure without a reset or lockout.
- Minutes 55–60 — closeout: log blockers, assign owners and dates, save evidence, and set the next inspection.
Do not approve the opening until these blockers are cleared
- door, frame, strike, hinge, glazing, or threshold damage;
- unknown authority to modify the opening;
- unresolved fire-door, egress, accessibility, rental, strata, or insurance constraint;
- exact model, manual, fit, or certification claim cannot be verified;
- bolt does not extend fully with the door closed;
- motor stalls, reverses, or depends on pushing or pulling the door;
- strike or frame moves under normal operation;
- unknown physical-key custody;
- shared administrator account or former user still has access;
- no proven emergency exit or backup entry;
- no named battery, update, and recovery owner;
- installation is considered complete only because the app says “locked”; or
- the household cannot state what stops working during internet, hub, battery, or service failure.
Verdict
A smart lock is ready when the whole opening works: the door is sound, the bolt travels freely, the strike and frame are properly prepared, keys and codes are controlled, occupants can exit, authorized people can recover entry, and connected controls survive the tested failures. Treat physical product certification, installation quality, and account security as separate evidence. None replaces the others.
Frequently asked questions
Does a smart lock make a weak door stronger?
No. A smart lock adds supported access and reporting features. It does not repair a split door, damaged frame, loose strike, weak glazing, or poor installation.
Does an ANSI/BHMA grade cover the whole door?
No. Verify the exact product and standard. A product grade does not automatically rate the door, frame, strike installation, hinges, glazing, or complete opening.
Is an app “locked” status enough?
No. Separate the command, door position, physical bolt position, and condition of the opening. Test the real door with the bolt under normal use.
Should I install longer strike screws myself?
Not from a generic rule. Use the current lock instructions and a qualified professional when frame construction, concealed services, fire rating, glazing, ownership, or safe anchoring is unclear.
What must work when the internet is down?
That depends on the exact lock, credential, hub, bridge, and service. Test and document local entry, inside exit, alerts, remote control, history, backup entry, and restoration separately.
