In older firmware versions or misconfigured deployments, the direct MJPEG stream path might be accessible without requiring a username or password. This allows unauthorized external parties to view the feed.
Turn off HTTP if you only use HTTPS. Disable Bonjour, UPnP, and FTP if they are not needed. inurl axis cgi mjpg motion jpeg free