How to secure your personal devices: iPhone, Android, Windows and Mac settings

What to set on every phone and laptop

Most harm to a personal device follows a few routes: someone uses it while it is unlocked, a thief takes it after watching you type the code, its storage is read on another machine, a flaw that an update would have fixed is exploited, an app collects more than it should, or an account it signs in to is taken over. Six settings close most of them, in this order:

1. Lock the screen with a code that is hard to guess, and add face or fingerprint unlock on top.
2. Turn on theft protection while the phone is still in your hand.
3. Encrypt the storage, so a stolen drive or phone gives up nothing without your sign-in.
4. Let updates install automatically, on a device that still receives them.
5. Limit apps: install from official sources, keep the built-in app checks on and take back permissions you did not mean to grant.
6. Protect the accounts and the phone number the device depends on, with passkeys or multi-factor authentication (MFA) and a lock at your carrier.

The device settings sit in different places on each platform. As of September 2026:

Theft protection works differently on each platform, so it is covered in the sections below.

Secure your iPhone

The paths below come from Apple's current iPhone User Guide and support articles. iOS 27, released on September 14, 2026, runs on iPhone 11 and later, according to Apple's security releases page.

Passcode and Face ID

1. Go to Settings > Face ID & Passcode (Touch ID & Passcode on a model with a Home button) and tap Turn Passcode On or Change Passcode. Under Passcode Options, Apple names a Custom Alphanumeric Code or a Custom Numeric Code as the most secure choices. Setting a passcode also turns on data protection, which encrypts the iPhone's data with 256-bit AES.
2. In the same screen, tap Set up Face ID. Apple says Face ID data is encrypted and does not leave your iPhone. The passcode is still required after a restart, after 48 hours without an unlock and after five failed Face ID or Touch ID attempts, which is why its length matters.
3. Set Settings > Display & Brightness > Auto-Lock to a short time.

If you are about to lose control of the phone, press and hold the side button and either volume button for two seconds, then press the side button: the next unlock needs the passcode, not your face.

Stolen Device Protection

A thief who has watched you type your passcode can otherwise use it to open saved passwords and change your Apple Account settings. Stolen Device Protection changes that when the iPhone is away from familiar locations such as home or work. Using saved passwords, passkeys and payment methods saved in Safari, turning off Lost Mode or erasing the phone then requires Face ID or Touch ID, with no passcode fallback. Critical changes add a Security Delay: to change your Apple Account password or your passcode, add or remove Face ID, or turn the feature off, you authenticate, wait an hour, then authenticate again.

It needs iOS 17.3 or later, two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Significant Locations and Find My, and it may already be on. To check, go to Settings > Face ID & Passcode, enter your passcode and tap Stolen Device Protection. To have the protection apply everywhere, including at home, choose Always under Require Security Delay.

Automatic updates

Go to Settings > General > Software Update > Automatic Updates and turn on Automatically Install. The iPhone then installs updates overnight while it is charging and on Wi-Fi, and tells you before it does. Apple calls keeping software up to date one of the most important things you can do for the security of its products.

App permissions, App Privacy Report and Safety Check

• Permissions: in Settings > Privacy & Security, tap a category such as Calendars or Motion & Fitness and switch off apps that do not need it.
• App Privacy Report (iOS 15.2 or later): turn it on in Settings > Privacy & Security > App Privacy Report. It shows how often each app used your location, photos, camera, microphone and contacts over the past seven days, and which web domains apps contacted. The report is stored only on the device and collects nothing until you turn it on, so check it again after a week.
• Safety Check (iOS 16 or later), in Settings > Privacy & Security > Safety Check, is Apple's quick way to review and stop sharing your information with people and apps. It can reset system privacy permissions for apps, or stop all sharing at once with Emergency Reset.

Permissions control what an app can reach on the phone. Tracking across apps and websites, and what advertisers and data brokers do with it, is covered in our guide to protecting your privacy online.

Lockdown Mode, for people at high risk

Lockdown Mode is an optional, extreme protection that Apple designed for the very few people who may be personally targeted by sophisticated attacks such as mercenary spyware, because of who they are or what they do. Most people are never targeted that way, and the phone works differently with it on: most message attachment types and link previews are blocked, some web technologies are switched off, 2G and 3G are turned off, and the iPhone must be unlocked to connect to an accessory or computer. If that describes your risk, go to Settings > Privacy & Security > Lockdown Mode, tap Turn On Lockdown Mode, then Turn On & Restart.

Secure your Android phone

Android settings differ between manufacturers. Google's help pages describe Pixel and standard Android and warn that some steps vary by device; if a setting is missing, the manufacturer's support site has the local name.

Screen lock and encryption

Go to Settings > Security > Screen lock and choose a PIN, pattern or password. Google recommends a PIN of at least six digits, notes that a strong password is the most secure option, and points out that Swipe and None give no protection. A PIN, pattern or password also encrypts your automatic and manual backups with your screen lock. Then add fingerprint or face unlock. Storage encryption is not a setting you need to find: all devices launched with Android 10 or later must use file-based encryption, and the default storage for your data becomes readable only after you unlock the phone.

Theft protection and Find Hub

Open Settings > Google > All services and, under Personal & device safety, tap Theft protection. The features need a screen lock, some work only on Android 10 or later, and they are not available on Android Go devices or tablets:

• Theft Detection Lock uses AI, the motion sensors, Wi-Fi and Bluetooth to recognize someone grabbing the phone and running, cycling or driving off, and locks the screen.
• Offline Device Lock locks the screen when an unlocked phone is kept offline, which is what a thief does to stop you finding it.
• Failed Authentication Lock locks the phone after repeated failed attempts in apps and settings.
• Remote Lock lets you lock the phone at android.com/lock with only your phone number.
• Identity Check, on supported phones, requires your fingerprint or face, with no PIN fallback, outside trusted places before anyone can view saved passwords, change the screen lock, run a factory reset or turn off Find Hub.

Find Hub turns on automatically when you add a Google Account. From another device or a browser, it can ring the phone, mark it as lost or factory reset it, as long as the phone is on, connected and signed in.

Google Play Protect and updates

Google Play Protect is on by default. It checks apps from Google Play before you download them, scans the phone for harmful apps from other sources, and can warn about, deactivate or remove them. To confirm it is on, open the Play Store, tap your profile icon, then Play Protect > Settings, and keep Scan apps with Play Protect turned on.

For updates, Google says most system updates and security patches install automatically. To check, open Settings > System > Software updates; Settings > About phone > Android version shows the date of the last Android security update and the Google Play system update.

App permissions

For each app, go to Settings > Apps, choose the app and tap Permissions. For location, camera and microphone, Allow only while using the app or Ask every time is usually enough. Settings > Security & privacy > Privacy > Permission manager shows every app that holds a given permission, and turning on Pause app activity if unused under an app's settings removes permissions from apps you stop using.

Advanced Protection, for people at high risk

Android's equivalent of Lockdown Mode is Advanced Protection: Settings > Security & privacy, then Advanced Protection under Other settings, and turn on Device protection. It keeps Play Protect on, blocks apps from unknown sources, blocks unauthorized USB access while the screen is locked, restarts a phone that has stayed locked for 72 hours so its data is unreadable until the next unlock, and blocks less secure 2G networks on supported phones.

Secure your Windows 11 laptop

Everything here is in Settings or the Windows Security app:

1. Check Windows Security. Search the Start menu for Windows Security. It brings together Microsoft Defender Antivirus, Windows Firewall and Smart App Control, and protects the PC from its first start. Under Virus & threat protection > Manage settings, Real-time protection should be on.
2. Confirm the disk is encrypted in Settings > Privacy & security > Device encryption. Device Encryption turns on BitLocker for the system and fixed drives, and is enabled automatically when you set up the PC with a Microsoft account or a work or school account, which also stores the recovery key. With a local account, it is not turned on automatically. Device Encryption works on Windows Home; the full BitLocker Drive Encryption is part of Pro, Enterprise and Education. If the page is missing, the PC does not meet its requirements (a usable TPM, Secure Boot and the Windows recovery environment), or you are signed in with a standard account.
3. Use a standard account for everyday work. Microsoft says it is safer to have fewer administrators and to use standard accounts day to day. Create a second account in Settings > Accounts > Other users, make it an administrator with Change account type, then sign in with it and change your everyday account to Standard User. Our guide to protecting a computer from malware explains what this stops.
4. Sign in with Windows Hello in Settings > Accounts > Sign-in options: facial recognition with an infrared camera, a fingerprint reader, or a PIN. The Hello PIN is tied to that one device, unlike your Microsoft account password.
5. Turn on Smart App Control if your PC offers it, in Windows Security > App & browser control > Smart App Control settings. It blocks apps that are malicious or untrusted and is not available on Windows 10. That page still says it needs a new installation, but Microsoft's Smart App Control FAQ says recent updates let you turn it on without one. There is no exception for a single app, so an unsigned tool you depend on means switching it off.
6. Keep Windows Update running. In Settings > Windows Update, check for updates, install what is offered and restart when asked; setting active hours keeps restarts away from the times you work.
7. Turn on Find My Device. It needs a Microsoft account with administrator rights and location turned on, and then locates and locks the laptop from account.microsoft.com/devices.

Secure your Mac

1. Turn on FileVault. A Mac with Apple silicon or a T2 chip encrypts its data automatically; FileVault adds the requirement that nobody can decrypt it without your login password, and an older Mac needs FileVault to be encrypted at all. Go to System Settings > Privacy & Security > FileVault and turn it on. Choose whether your iCloud account or a recovery key can unlock the disk if you forget your password; lose both, and the files are gone for good.
2. Turn on the firewall in System Settings > Network > Firewall. Options lets you allow or block individual apps, and macOS asks before letting an app you have not approved accept incoming connections.
3. Automate updates. In System Settings > General > Software Update, click the info button next to Automatic Updates and turn on Install macOS updates and Install Security Responses and system files. A laptop must be plugged in to download updates automatically.
4. Leave Gatekeeper to do its job. Under Privacy & Security > Security, keep Allow apps downloaded from set to the App Store, or the App Store and identified developers. Gatekeeper checks the developer's signature and, since macOS Catalina, that Apple has notarized the app. The Open Anyway button overrides it; use it only for software you are certain of, and be wary of any download page that explains how to get past this screen.
5. Use a standard account day to day, as on Windows. The malware guide covers it, along with the malware protection built into macOS. Lockdown Mode is available on a Mac too, under System Settings > Privacy & Security.

Protect the accounts your devices open

A locked, encrypted phone still signs in to your email, bank and cloud storage. The device settings stop someone holding it; the account settings stop someone who never touches it.

Passkeys are the strongest option. A passkey is a FIDO credential stored on your phone, computer or a hardware security key and unlocked the way you unlock the device, with a fingerprint, face, PIN or pattern. It is resistant to phishing because there is no shared secret to type into a fake page, and it can be synced across your devices or bound to one. On April 23, 2026, the UK's National Cyber Security Centre made passkeys its first recommendation for consumers wherever a service offers them. Where a service does not, its advice is a password manager to create stronger passwords, with two-step verification kept on. The one built into your phone (the Keychain on Apple devices, Google Password Manager on Android) is guarded by the screen lock and theft features above.

Set these up in this order:

1. Your email account, because whoever controls it can reset most of your other passwords.
2. Your Apple Account, Google Account or Microsoft account, which controls Find My or Find Hub, backups and the recovery key for your disk.
3. Your bank and your mobile carrier account.
4. Social media, covered in our guide to using social media safely.

Where MFA offers a choice, pick a passkey, a security key or an authenticator app over codes sent by text message. The FBI recommends strong methods such as biometrics, physical security tokens or standalone authentication apps, and the next section explains why SMS is the weak one.

Stop a SIM swap from taking over your phone number

In a SIM swap, a criminal convinces or pays someone at your mobile carrier to move your number to a SIM card they hold. The FBI describes three routes: impersonating you to the carrier, bribing an employee, or phishing carrier staff to get into its systems. From then on your calls and texts go to the criminal, who asks your email, bank and other accounts for a password reset and receives the one-time code. The FBI's IC3 received 1,611 SIM swap complaints in 2021 with adjusted losses of more than $68 million, up from 320 complaints over the three years 2018 to 2020.

Port-out fraud reaches the same result another way: posing as you, the criminal opens an account at a different carrier and has your number transferred to it. In November 2023 the FCC adopted rules against both that require US wireless providers to offer every customer, at no cost, a lock that stops SIM changes and one that stops port-outs, and to notify you of a SIM change request before carrying it out. Outside the US, ask your carrier whether it offers an account PIN or a lock on SIM changes and number transfers.

1. Set an account PIN or passcode with your carrier that differs from your phone's unlock code. Never read it to someone who calls you; the FBI advises hanging up and calling the carrier's customer service line yourself.
2. Turn on the SIM change and port-out locks in the carrier's app or website, or by calling it.
3. Move important accounts off SMS codes, as described above.
4. Keep your number and your finances off public profiles. The FBI warns against posting your phone number or advertising financial assets, including cryptocurrency.
5. Act fast if your phone suddenly loses service for no reason, or you get a SIM change notice you did not request: call the carrier from another phone, change your passwords, ask your bank to watch the accounts, and report it (in the US, to IC3).

Bluetooth and public USB charging: myths and real risks

Both come with advice that sounds absolute. The real risks are narrower, and the fixes are mostly habits you already have from the sections above.

Bluetooth

Switching Bluetooth off when you are not using it is sound advice, but the risk behind it is specific: flaws in Bluetooth software, and pairing. The Canadian Centre for Cyber Security describes the real attacks: exploiting vulnerabilities in a device's Bluetooth software, impersonating a device you trust, and capturing what you type on a Bluetooth keyboard. Its advice:

• Keep devices updated, since updates fix those vulnerabilities.
• Pair only devices you know, in a private place, and refuse pairing requests you did not start.
• Turn off discovery mode when you are not pairing, and remove old devices from the paired list.
• Avoid pairing your phone with a rental car, which stores your call log, contacts and messages; delete stored data from your own car before selling it.
• Turn Bluetooth off when you are not using it.

On an iPhone, the Bluetooth button in Control Center only disconnects accessories: Bluetooth stays available for features such as AirDrop, and accessories can connect again from 5 a.m. or after a restart. To switch it off completely, use Settings > Bluetooth.

Public USB charging and juice jacking

Juice jacking means using a malicious charger to reach a phone through the data connection that shares the charging cable. Phones answered it years ago with a prompt: an iPhone asks whether to trust a computer before it shares photos, contacts and other content, and an Android phone connects in charging mode until you choose File Transfer. In 2025, researchers at Graz University of Technology presented ChoiceJacking at USENIX Security: a cheap malicious charger that fakes your input to approve its own data connection. It reached files on every device they tested from eight vendors, including the six largest, and on two vendors' phones it worked while the phone was locked. Google, Samsung, Xiaomi and Apple acknowledged the findings and were adding fixes. The research shows the attack is real with a purpose-built charger; it does not measure how often anyone uses it.

What to do:

1. Charge from your own adapter in a wall socket, or from your own power bank, when you are away from home.
2. Decline any prompt to trust or share data when all you wanted was power. On an iPhone, Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy makes it forget every computer you trusted before.
3. Keep the phone updated, which is how vendors' fixes for attacks like this one reach it.
4. At high risk, Lockdown Mode and Android's Advanced Protection both block USB data connections while the phone is locked.

Public Wi-Fi is the other travel worry; it is covered, with the evidence, in our guide to staying safe online, and our VPN guide explains when a VPN adds something on a network you do not control.

Retire devices that no longer get security updates

Every setting above assumes the vendor still fixes the software. Microsoft's warning about Windows 10 applies to any device: without security updates, it is at greater risk from viruses and malware. Where each platform stands in September 2026:

When a device drops off those lists, replace it, or at least stop using it for email, banking and work. Before you sell, give away or recycle it, wipe it properly:

• iPhone: turn off Stolen Device Protection first, since changes away from home may start a one-hour delay. Then sign out of your Apple Account, choose Settings > General > Transfer or Reset iPhone > Erase All Content and Settings, and remove the phone from your list of trusted devices.
• Android: make sure you know your Google Account password and have a backup, then factory reset from Settings; your manufacturer's site has the exact steps.
• Windows: back up, then open Settings > System > Recovery and use Reset this PC with the option to remove everything.
• Mac: on a Mac with Apple silicon or a T2 chip running macOS Monterey or later, Erase All Content and Settings resets it to factory settings in one step.

When the devices belong to a business

Everything above is for one person's own devices. A company's laptops and phones need the same settings applied and checked on every device, which is a device management job: an inventory, enrolment in a management platform, a baseline, patch deadlines and a way to wipe a device when someone leaves. Our guide to managing cybersecurity on your team's devices walks through it, and a home office's router has its own home network checklist.

If you would rather hand that to someone, our IT support service covers device management: laptops and phones enrolled, configured and kept compliant from one console, with disk encryption and compliance policies, remote lock and wipe, and phishing-resistant sign-in where possible. The websites, servers and cloud accounts a business exposes to the internet need a different check, which our security scanning service runs on a schedule. More guides like this one are under security.