Abstract The Routing Protocol for Low-Power and Lossy Networks (RPL), the de facto routing protocol for Internet of Things (IoT) offers little protection against various forms of routing attacks. An attacker can exploit the routing system of RPL to launch destructive and devastating attacks against an IoT network. Popular among these IoT attacks are Rank and Sybil attacks. To secure IoT networks from routing attacks, a time-based trust-aware RPL routing protocol (SecTrust-RPL) is proposed and implemented. The Secure Trust (SecTrust) trust system is embedded into the RPL routing protocol to provide protection against Rank and Sybil attacks. SecTrust-RPL uses a trust-based mechanism to detect and isolate attacks while optimizing network performance. The performance of SecTrust-RPL is compared with the standard RPL protocol. SecTrust-RPL protocol demonstrates its superior performance over the standard RPL protocol in the detection and isolation of Rank and Sybil attacks. The effectiveness and resilience of SecTrust-RPL is demonstrated through extensive simulation studies and testbed experiments. Based on SecTrust-RPL, we show as a proof-of-concept the viability of using trust as an effective security system for mitigating attacks in IoT networks.