Abstract
Smart-city and smart-home systems rely heavily on Wi-Fi, Bluetooth Low Energy, and ZigBee, while many practical risks arise from deployment and implementation weaknesses rather than failures of cryptographic primitives. This paper presents a structured, author-led synthesis of seven previously completed laboratory studies involving adaptive Wi-Fi penetration testing, WPA3-Enterprise attacks, a cross-layer audit of a commercial Wi-Fi smart lock, reverse analysis of a BLE control channel, cross-layer ZigBee assessment, software-defined-radio jamming, and an IoT security laboratory task set. The previously reported experimental findings are normalized by affected layer, attack vector, observable effect, test conditions, and source. On this basis, the study develops a six-level cross-layer taxonomy and 52 stakeholder-oriented recommendations for infrastructure administrators, device and firmware developers, mobile and cloud service developers, monitoring and risk-assessment teams, and testing-process owners. Each recommendation is assigned an evidence level distinguishing direct experimental support, support from external standards or literature, and proposed expert guidance. Priority controls are linked to reproducible acceptance criteria and twelve core metrics, while an extended traceability matrix provides qualitative or quantitative checks for the remaining recommendations. The resulting five-stage procedure is proposed as a testing-remediation-re-verification framework; it has not yet been independently validated as a complete system on an industrial testbed. The contribution is therefore an evidence-informed operational framework rather than a claim that all controls or thresholds are universally validated.