The blooming of the Internet of Things (IoT) needs a communication infrastructure to allow connecting a wide range of devices. Visible light communication (VLC) provides an attractive solution for these IoT devices. However, the broadcast nature makes the VLC prone to be exposed in the reach of eavesdroppers, which undesirably impairs the IoT system security. The negative factors in practical use, such as light reflection, light intensity, channel correlation, and channel estimation error, remain less touched. In this paper, we propose the SecLight to support both the multiple-input single-output VLC (MISO-VLC) and the single-input single-output VLC (SISO-VLC) IoT devices. A random time reversal scheme is first proposed to automatically steer the SISO-VLC signal to the legitimate receivers by scrambling the eavesdropper's channel. Then, we mathematically analyze the impact of channel correlation and channel estimation error inherent in MISO-VLC system and propose an effective approach to alleviate the decreased secrecy capacity by introducing the Karhunen-LoEve transform and equivalent artificial noise. Through extensive evaluation, the proposed SecLight framework proves to be able to aggravate the bit error rate of eavesdroppers, even when a malicious interception is intended while holding the secrecy capacity above 3 bit/s/Hz. Overall, our results demonstrate that our framework SecLight is a promising solution for enhancing the security of the IoT devices.INDEX TERMS Visible light communication, physical layer, security.