Android security settings checklist: what to turn on, and where to find it
Three things protect an Android phone most: a PIN or password screen lock, Google's Theft protection features, and a phone that still gets security updates. Play Protect and Find Hub finish the job.
By the editors of ProtectYour.com Last reviewed 6 min read
Affiliate disclosure: this guide links to Bitdefender. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- Set a PIN or password screen lock, turn on Theft protection (including Identity Check where offered), and make sure your phone still receives security updates.
- Theft protection lives under Settings > Google > All services > Theft protection on supported phones running Android 10 or later.
- Keep Google Play Protect on and leave "Install unknown apps" switched off for every app.
- Check how long your model gets updates. Pixel 8 and later get 7 years from launch; other makers publish their own schedules.
- Built-in Play Protect is enough for most people who install apps only from Google Play.
Before you start
Android looks different on a Pixel, a Samsung Galaxy and a Motorola, so menu names vary. The paths below follow Google's own help pages as of October 2026. If a menu is not where we say, search the Settings app for the feature name. Some features need Android 15 or later; we say where.
1. Use a PIN or password, not a pattern or nothing
Go to Settings > Security (on some phones Security & privacy) and tap Screen lock. Choose a PIN of at least six digits or a password, then add fingerprint or face unlock for convenience.
Patterns are easy to read from smudges and over a shoulder. Google also notes that your screen lock is what encrypts your phone backups, so "None" or "Swipe" weakens more than the lock screen. Google's help page on setting a screen lock covers the options. If you turn on Auto-confirm unlock (no need to tap enter), Google warns it may reduce security.
2. Turn on Theft protection and Identity Check
Google groups its anti-theft features in one place: open Settings > Google > All services, and under "Personal & device safety" tap Theft protection. Depending on your phone you will find:
- Theft Detection Lock: locks the screen if the phone senses a snatch-and-run motion.
- Offline Device Lock: locks the screen if a thief takes the phone offline to stop you tracking it.
- Failed Authentication Lock: locks the phone after repeated wrong unlock attempts.
- Remote Lock: lets you lock the phone from a browser using just your phone number.
- Identity Check: outside places you mark as trusted, sensitive actions such as changing your Google Account password require your fingerprint or face, with no PIN fallback. Only some phones offer it; if it is not on the list, your phone does not support it.
Turn on everything offered. The idea is the same as Apple's Stolen Device Protection: a thief who has seen your PIN still cannot take over your Google Account. See Google: Protect your personal data against theft.
3. Check your updates, and how long they last
On a Pixel, check Settings > System > Software update. On a Samsung it is Settings > Software update. Then find Google Play system update (search Settings for it) and install anything waiting. Our updates guide explains why these are separate.
The bigger question on Android is how long your phone gets updates at all. Google says Pixel 8 and later phones get 7 years of OS and security updates, counted from when each model first went on sale in the US Google Store. Samsung and other makers publish their own lists, and cheaper models often get far fewer years. A phone past its last security update should be replaced, especially if you bank on it. The security patch date is under Settings > About phone; if it is more than a few months old and no update is offered, your phone may be out of support.
4. Keep Play Protect on, and sideloading off
Google Play Protect scans apps before you install them from Play and checks your phone for harmful apps from other sources. It is on by default. To check: open the Play Store, tap your profile picture, tap Play Protect > Settings (the gear), and make sure Scan apps with Play Protect is on. See Google: Use Google Play Protect.
Most Android malware arrives as an app installed from outside Play, usually after a text or call that says you must install something to get a refund, track a parcel or "secure" your bank account. Search Settings for Install unknown apps and make sure no app (especially your browser and messaging apps) is allowed. If someone on the phone asks you to change this setting, hang up: that is how text message scams and fake bank calls end in drained accounts.
5. Make sure Find Hub can find your phone
Google renamed Find My Device to Find Hub. Check that you are signed in to a Google Account, that Location is on, and that Find Hub is on (search Settings for "Find Hub"). On Android 14 and later you can also let the phone be found when it is offline. Then test it once from another device at google.com/android/find.
Google's Find Hub setup checklist also suggests creating 2-Step Verification backup codes, so you can still sign in to your Google Account to lock or erase a lost phone when the phone itself was your second factor.
6. Review app permissions
Open Settings > Security & privacy > Privacy > Permission manager (the exact path varies) and look at Location, Camera, Microphone, SMS and Contacts. For location, camera and microphone, choose Allow only while using the app or Ask every time rather than all the time. An app that has no reason to read your text messages should not have the SMS permission: that is how some malware reads one-time codes. Google's app permissions page lists what each permission allows.
7. Secure the Google Account behind the phone
Your Google Account holds your email, photos, passwords and backups. Make sure 2-Step Verification is on, and add a passkey, which cannot be phished the way a password and text code can. People at high risk of targeted attacks can enrol in Google's Advanced Protection Program, which requires a passkey or security key and tightens account recovery and downloads.
Do you need an antivirus app on Android?
If you install apps only from Google Play, keep Play Protect on and stay current on updates, most people do not need anything more. A paid security app adds the most for people who sideload apps, use an older phone that is close to the end of its updates, or want web filtering that blocks scam sites in any browser. Our guide to whether free antivirus is enough compares the options.
Android settings at a glance
| Setting | Where | Protects against |
|---|---|---|
| PIN or password lock | Settings > Security > Screen lock | Anyone holding the phone |
| Theft protection, Identity Check | Settings > Google > All services | Thief who knows your PIN |
| Updates | Settings > System > Software update | Known security flaws |
| Play Protect | Play Store > profile > Play Protect | Harmful apps |
| Install unknown apps off | Search Settings | Malware pushed by scammers |
| Find Hub | Search Settings | Lost or stolen phone |
Skip
Common questions
Where is Theft protection on Android?
Open Settings, tap Google, then All services, and under Personal & device safety tap Theft protection. It needs a screen lock and Android 10 or later, and is not available on Android Go phones, tablets or watches. Features vary by model.
How many years of security updates does my Android phone get?
It depends on the maker and model. Google gives Pixel 8 and later phones 7 years of OS and security updates from when they first went on sale in the US. Other makers publish their own schedules, and budget phones often get fewer years.
Is Google Play Protect enough on its own?
For most people who install apps only from Google Play and keep their phone updated, yes. A paid security app adds more for people who install apps from outside Play or want web filtering against scam sites in every browser.
What is Identity Check on Android?
Identity Check makes sensitive actions, such as changing your Google Account password, require fingerprint or face authentication when you are away from trusted places, with no PIN fallback. It is offered on certain phones only, under Theft protection settings.
Your next step
If you want a paid toolAffiliate link
Bitdefender
Best for: Windows, Mac and Android users who want web protection, ransomware layers and several devices covered by one subscription.
Not for: Windows users happy with Microsoft Defender, and iPhone users: iOS apps cannot scan other apps, so the benefit there is mostly web filtering.
Visit BitdefenderRelated guides
- iPhone security settings checklist: the settings worth changing, in orderThree settings do most of the work on an iPhone: Stolen Device Protection, a passcode longer than six digits, and automatic updates. The rest of this checklist takes about 15 minutes.
- How to tell if your phone is hacked, and what to do about itMost phones that feel hacked are not. The ones that are usually show it through accounts, apps and settings, not battery life. Check the right places, then fix them in order.
- Is free antivirus enough? What Microsoft Defender covers and what paid suites addWindows already ships with a capable antivirus. Paid suites add extras that matter to some households and not at all to others. This guide helps you tell which one you are.
- Why software updates matter, and how to turn them on for every device you ownInstalling updates is the single cheapest security habit there is. Switch on automatic updates everywhere, know when a device stops getting them, and replace it before that happens.