iPhone security settings checklist: the settings worth changing, in order

Every path below was checked against Apple's own support pages in October 2026. Menu names move slightly between iOS versions, so if a path does not match, use the search bar at the top of the Settings app and type the feature name. You do not need any app for this checklist, and nothing here costs money.

The order matters. The first items protect you against the thing that happens most often (a stolen or lost phone, or an account takeover), and the later ones are for narrower risks.

A common phone theft pattern goes like this: someone watches you type your passcode in a bar, takes the phone, then uses the passcode to change your Apple Account password, turn off Find My and open your saved passwords. Stolen Device Protection breaks that chain. When your iPhone is away from familiar places such as home or work, it requires Face ID or Touch ID with no passcode fallback for actions like viewing saved passwords, and it adds an hour-long security delay before changes such as a new Apple Account password.

1. Go to Settings > Face ID & Passcode (or Touch ID & Passcode) and enter your passcode.
2. Tap Stolen Device Protection and turn it on.

It needs two-factor authentication on your Apple Account, Face ID or Touch ID, Find My, and Significant Locations. It may already be on: Apple says it can be enabled by default. It must be on before the phone is stolen. See Apple: About Stolen Device Protection.

A six-digit code is easy to watch over a shoulder. A longer one is harder to catch and much harder to guess.

1. Go to Settings > Face ID & Passcode > Change Passcode.
2. Tap Passcode Options and choose Custom Alphanumeric Code or Custom Numeric Code.

Apple calls those two the most secure options. Eight or more digits is a reasonable balance for most people. While you are there, check Settings > Display & Brightness > Auto-Lock and set it to a minute or two. Apple's passcode guide also covers the option to erase the phone after 10 failed attempts. That is sensible if you have an iCloud backup, and risky with small children who like pressing buttons.

Go to Settings > General > Software Update > Automatic Updates and turn on both download and install, plus Security Responses & System Files. Apple ships urgent fixes through that last option, often for flaws already being exploited. Updates install overnight when the phone is charging on Wi-Fi.

Our guide to keeping every device updated covers apps, the router and what to do when an iPhone stops getting updates.

Your Apple Account controls iCloud, Find My and your backups, so it is worth more to an attacker than the phone.

• Check two-factor authentication is on. Tap your name at the top of Settings, then Sign-In & Security. Most accounts have it already.
• Add a recovery contact. In the same section, under Account Recovery, add someone you trust. They cannot see your data; they can only give you a code to get back in.
• Consider security keys. Apple supports physical FIDO security keys for the Apple Account. You need at least two, and if you lose all your keys and trusted devices you can be locked out for good. See Apple: Security Keys for Apple Account.

Apple never calls to ask for a verification code. A caller who claims to be Apple Support and wants a code is running one of the imposter scams the FTC sees most.

Safety Check is a review of who and what can reach your information. Go to Settings > Privacy & Security > Safety Check and choose Manage Sharing & Access. It walks through people you share location, photos and notes with, the devices signed in to your Apple Account, and which apps have access to things like your camera and location.

Remove any device you do not recognise. If you are leaving an abusive relationship, Apple's Personal Safety guide explains Emergency Reset, which stops all sharing at once, and the safety questions to think about before you use it.

• Find My iPhone: tap your name in Settings, then Find My > Find My iPhone, and make sure it and Find My network are on. Activation Lock comes with it, and makes a stolen iPhone hard to resell.
• SIM PIN: Settings > Cellular > SIM PIN (or Mobile Data). This stops a thief putting your SIM in another phone to receive your text message codes. You need your carrier's default PIN to set it; guessing wrong three times locks the SIM until you get an unlock code from the carrier. It does not stop a thief talking your carrier into moving your number, which is a separate problem covered in our SIM swap guide.

By default, Apple holds the keys for much of your iCloud data so it can help you recover it. Advanced Data Protection moves most categories, including iCloud Backup, Photos and Notes, to end-to-end encryption: only your devices can read them, so even a breach at Apple would not expose them.

The trade-off is recovery. If you lose access, Apple cannot help; you need your device passcode, a recovery contact or a 28-character recovery key. Turn it on at Settings > [your name] > iCloud > Advanced Data Protection. Apple's iCloud data security overview lists exactly what is covered. We think it suits people who are organised about recovery; if you have ever been locked out of an account, set up the recovery contact first and come back to this later.

Lockdown Mode is, in Apple's words, an extreme protection for the very few people who may be personally targeted by sophisticated spyware. It blocks most message attachments and link previews, limits some web technologies, blocks FaceTime calls from people you have not called in the last 30 days, and stops configuration profiles from being installed. Phone calls and plain texts keep working.

Journalists, activists, lawyers in sensitive cases and people in public life should consider it. Everyone else gives up a lot of convenience for protection against attacks they are very unlikely to face. If you want it: Settings > Privacy & Security > Lockdown Mode. See Apple: About Lockdown Mode.

Skip "antivirus" and "cleaner" apps that promise to scan your iPhone. iOS does not let one app inspect another, so they cannot do what the name suggests. Our guide to whether iPhones need antivirus explains what those apps can and cannot do. A pop-up in Safari saying your iPhone is infected is a tech support scam; close the tab.