ESPHome Body Matches Mostly Describe Documentation and Devices

ESPHome firmware can expose a small web server for monitoring and control, and its project documentation is widely indexed. Those two facts explain why a body count can dwarf an application fingerprint. On November 15, 2026, ZoomEye returned zero matches for app="ESPHome", 839 for title="ESPHome" and 830,661 for http.body="ESPHome" with sub_type=all, page 1 and page size 1.

The 830,661 body matches are not 830,661 exposed devices. The string appears in documentation, tutorials, package pages, configuration examples and firmware-generated content. The title count is narrower but still includes docs and unrelated projects. The zero app count means this field did not classify the product in the run; it does not prove that no ESPHome deployment exists.

ESPHome's web server documentation says authentication is optional and recommends always setting a password when the server is enabled. Device security also depends on the native API, OTA update path and network placement. A reachable dashboard can control relays, sensors or other physical functions. A firmware update endpoint can change the device's behavior. These are different authorities even though both may be served by the same device.

Inventory owned devices by hostname, firmware version, configuration source, network segment and enabled services. Verify that the web server has authentication if it is enabled, that OTA is restricted to trusted networks, and that the device cannot reach arbitrary internet destinations. Store Wi-Fi and API secrets in the configuration's secret mechanism rather than in a public repository.

The review should distinguish a device's web page from the ESPHome dashboard used to build firmware. They are separate services with separate credentials and update authority. Do not scan public addresses outside an authorized scope just because a body query returns a large number.

For owned assets, test an unauthenticated read, an unauthenticated control action, and an OTA attempt from outside the approved network. Keep the device on a segmented network and log configuration changes. The count is useful for finding product references, but the security decision belongs to the device's physical and network owner.

References