Mobile Phone Security Checklist: 12 Settings to Lock Down on Android and iPhone

Your phone holds your email, your bank, your photos, and the codes that open everything else. That makes it the most valuable thing you carry, and the easiest to lose. Most of the risk is not exotic malware; it is a four-digit passcode, an app that has been reading your location for two years, or a handset that has not restarted since spring. The fixes below take about twenty minutes in total, and every one of them is a setting rather than an app. Here is what to change, on Android and iPhone alike, and why each one matters.

1. Lock the Front Door Properly

Everything else on this list assumes a stranger cannot get past your lock screen. Start there.

• Use a long passcode. On iPhone, go to Settings > Face ID & Passcode > Change Passcode > Passcode Options and choose a six-digit or alphanumeric code. On Android, Settings > Security > Screen lock lets you pick a PIN or password. A four-digit birthday is not enough; anyone who watches you type it once has your entire phone.
• Shorten the auto-lock timer to thirty seconds or one minute, not five.
• Hide message previews. On iPhone: Settings > Notifications > Show Previews > When Unlocked. On Android: Settings > Notifications > Lock screen > hide sensitive content. Nothing leaks more at a glance than a two-factor code sitting on a locked screen.
• Set a SIM PIN. It stops a thief from pulling your SIM and using it in another handset. Look under Settings > Security > SIM lock on Android, or Settings > Cellular > SIM PIN on iPhone.

While you are in there, iPhone users should open the Allow Access When Locked section and turn off Accessories, so a plugged-in cable cannot pull data from a locked phone. On Android, hold the power button and use Lockdown when you are somewhere you do not trust. It hides notifications and disables biometrics until you enter your PIN.

2. Let the Updates Install Themselves

Out-of-date software is one of the most common ways phones get compromised, and it is also the easiest problem to solve permanently. You only have to do this once.

On iPhone, go to Settings > General > Software Update > Automatic Updates and enable all three options, including Security Responses and System Files. On Android, check Settings > System > Software update; on Pixel and many other models, also update Google Play system updates from the same menu.

Then handle your apps. In the Play Store: Settings > Network preferences > Auto-update apps > Over any network. On iPhone: Settings > App Store > Automatic Downloads. On Android, confirm Google Play Protect scanning is on, since it checks sideloaded apps for known threats.

One habit worth building: restart your phone once a week. Some patches only finish applying after a reboot, and a phone that has been running for months is carrying vulnerabilities it thinks it already fixed.

3. Trim App Permissions

A permission you granted in a hurry two years ago does not expire. A game with your contacts and your microphone is a liability, whether or not the developer meant any harm.

On iPhone, open Settings > Privacy & Security and walk down the list: Location, Microphone, Camera, Contacts, Photos, Bluetooth. For each category, you will see exactly which apps have access and can revoke it on the spot. On Android, Settings > Privacy > Privacy dashboard shows what accessed your location, camera and microphone in the last 24 hours, while Settings > Privacy > Permission manager lets you review everything app by app.

Three rules cover most cases. Set location to While using the app and switch off Precise location unless you are actively using maps or a ride-hailing app. Allow microphone and camera only for apps that genuinely need them, and turn on the indicator light checks if your phone offers them. Give photo access as limited or selected images rather than the whole library.

Finally, uninstall what you have not opened in six months. Unused apps keep their permissions and stop receiving security fixes.

4. Turn Off Ad Tracking

Neither Apple nor Google needs to follow you across apps to make the phone work. On iPhone, go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. On Android, open Settings > Privacy > Ads and delete or reset your advertising ID.

In your browser, enable Safari's Prevent Cross-Site Tracking, and set Chrome or Firefox to block third-party cookies. If you use Google Maps, check your Timeline and location sharing settings too; it is easy to forget a map you shared with a friend in 2021. This will not make ads disappear, but it stops your activity from following you between apps for years.

5. Set Up Find My Before You Need It

Locating a lost phone depends entirely on settings you enable in advance.

On iPhone, open Settings > [your name] > Find My > Find My iPhone, and turn on both Find My network and Send Last Location. The network option lets other Apple devices spot your phone even when it is offline. On Android, open the Find My Device app or Settings > Google > Find My Device and confirm it is on, with location sharing permitted.

Then enable remote erase and prepare a lock-screen message with a second phone number, so an honest finder can reach you. One warning: turning Find My off also disables Activation Lock, the feature that makes a stolen phone worthless to a thief. Leave it on.

6. Shut the Side Doors

Bluetooth and Wi-Fi are convenient and mostly harmless, but auto-connect features will happily join an attacker's network with a familiar name. Turn off auto-join for open networks, forget hotspots you no longer use, and switch Bluetooth off when you are not using it.

On Android, check Settings > Apps > Special access > Install unknown apps and make sure browsers, email clients and messaging apps cannot install software. On iPhone, stick to the App Store unless you have a specific reason not to. And wherever an account offers it, choose an authenticator app or hardware key for two-factor authentication instead of SMS codes, which can be intercepted through a SIM swap.

The Two-Minute Monthly Check

Set a recurring reminder and run through this list once a month. If your phone is lost or stolen, you will already know what to do: report it, use Find My to lock and erase it, change your email and banking passwords from another device, and call your bank if financial apps were installed.

1. Passcode is six digits or longer, with a short auto-lock.
2. Notification previews hidden on the lock screen.
3. SIM PIN enabled.
4. Automatic system updates switched on.
5. Automatic app updates switched on.
6. Play Protect or equivalent scanning active.
7. Location set to While using, precise location off.
8. Microphone and camera permissions reviewed.
9. Photo and contact access limited.
10. App tracking and advertising ID switched off.
11. Find My or Find My Device on, with remote erase ready.
12. Unknown app installs blocked, auto-join networks disabled, two-factor authentication using an app.

None of this is dramatic, and that is the point. A phone that locks quickly, updates itself, shares little, and can be found again is a phone that is genuinely hard to attack.

Photo: FunkyFocus / Pixabay