Home Device Security Guide: Windows, Mac, Android, and iPhone

Most home break-ins today are digital, and most of them start with a device that was never locked down. This guide walks you through securing every device in your house, menu by menu, in plain language. No technical background needed.

How to use this guide

You do not need to be technical to protect your devices. Most of what matters is turning on a few settings that are already built in, then keeping a handful of simple habits. This guide walks you through each one, menu by menu.

Pick the section for the device you are holding and work through the numbered steps in order. Each section takes about 30 to 45 minutes the first time. You can stop partway and come back; nothing here has to be finished in one sitting.

Menu names can differ slightly depending on your software version. If a setting is not exactly where this guide says, use the search box at the top of your Settings app and type the name of the setting (for example, “Firewall” or “Screen lock”).

The five habits that matter most on every device

1. Keep everything updated. Updates fix the security holes criminals use. Turn on automatic updates and restart when asked.
2. Use a different, long password for every account, stored in a password manager so you do not have to remember them.
3. Turn on two-step verification (also called two-factor authentication or 2FA) for email, banking, and social media. A stolen password alone is then not enough to get in.
4. Lock your screen with a PIN, fingerprint, or face, and turn on device encryption so a lost or stolen device cannot be read.
5. Back up your data so a broken, stolen, or ransomware-infected device is an inconvenience instead of a disaster.

If you do only these five things, you are ahead of most households.

Before you start: three things to set up first

Your email account is the master key to everything else, because password resets for every other account go there. Protect it first, then get a password manager so every other step is easier, then add two-step verification to your money and social accounts.

Step 1: Lock down your main email account (15 minutes)

1. On a computer, open your web browser and sign in to your email.
2. Change your password to something long and unique. A short phrase of three or four unrelated words with a number works well (example pattern: purple-canoe-staple-47). Never reuse a password you use anywhere else. Where to change it:
   • Gmail: click your picture (top right), then Manage your Google Account, then Security in the left menu, then under How you sign in to Google click Password.
   • Outlook.com / Hotmail / Live: go to account.microsoft.com and sign in, click Security in the top menu, then Change password (or Password security).
   • Yahoo: click your name (top right), then Account Info, then Account Security in the left menu, then Change password.
   • iCloud (Apple): on your iPhone open Settings, tap your name at the top, tap Sign-In & Security, then Change Password.
   • AOL: click your name, then Account Info, then Account Security, then Change password.
   • Internet-provider email (Spectrum, Xfinity, AT&T, and so on): sign in at the provider’s website and look for My Account or Profile, then Password or Security.
3. Turn on two-step verification. When asked how you want to receive codes, choose an authenticator app if offered (Google Authenticator, Microsoft Authenticator, or the one built into your password manager); otherwise choose text message. Text messages are less secure than an app but far better than nothing. Where to turn it on:
   • Gmail: Manage your Google Account, Security, then under How you sign in to Google click 2-Step Verification, then Turn on 2-Step Verification and follow the prompts.
   • Outlook.com / Hotmail / Live: account.microsoft.com, Security, then Advanced security options (or Manage how I sign in), scroll to Additional security, and under Two-step verification click Turn on.
   • Yahoo: Account Info, Account Security, then Two-step verification, click Turn on, and choose Authenticator app or Phone number.
   • iCloud (Apple): Settings, your name, Sign-In & Security, then Two-Factor Authentication. Most Apple accounts already have it on; if it shows Off, tap it and follow the prompts.
   • AOL: Account Info, Account Security, Two-step verification, Turn on.
4. Add recovery information so you can get back in if you are locked out:
   • Gmail: Security, then Recovery phone and Recovery email under How you sign in to Google.
   • Outlook.com: Security, Advanced security options, then Add a new way to sign in or verify, and add a phone number and an alternate email.
   • Yahoo: Account Security, then Phone numbers and Email addresses.
   • iCloud: Sign-In & Security, then Account Recovery, and add a Recovery Contact.
5. Sign out of devices you do not recognize:
   • Gmail: Security, scroll to Your devices, click Manage all devices, click any device you do not know, then Sign out.
   • Outlook.com: account.microsoft.com, Devices in the top menu, then Remove on anything unfamiliar. Also, under Security, click View my sign-in activity and look for logins from places you have never been.
   • Yahoo: Account Security, scroll to Recent activity, and sign out of unfamiliar sessions.
   • iCloud: Settings, your name, scroll to the bottom to see the device list, tap any you do not own, then Remove from Account.
6. Finally, remove access for old apps: in Gmail, Security, then Your connections to third-party apps & services; in Outlook.com, Privacy, then Apps and services. Remove anything you no longer use.

Step 2: Get a password manager (15 minutes)

A password manager is an app that creates and remembers a different strong password for every site, then fills it in for you. You remember one master password; it remembers the rest.

1. Choose one. Good options for home users:
   • Apple Passwords (free, built in): best if everyone in the household uses iPhone, iPad, and Mac. It is already on your Apple devices as the Passwords app. For Windows, install iCloud for Windows from the Microsoft Store and turn on Passwords.
   • Google Password Manager (free, built in): best if you use Android and Chrome. It is already on your Android phone (Settings, Google, Manage your Google Account, Security, Password Manager) and in Chrome.
   • Bitwarden (free for individuals; low-cost family plan): works on everything and is the best free choice for a mixed household. Download only from bitwarden.com.
   • 1Password (paid; very polished; good family sharing): works on everything. Download only from 1password.com.
2. Create your account and master password. Make it long, at least four unrelated words, and never used anywhere else. Write it on paper and keep it with your important papers at home. This is the one password it is fine to write down.
3. Install it everywhere you sign in to things:
   • Windows: download the desktop app from the maker’s website, then in your browser open the extension store (Edge: click the three dots, Extensions, Get extensions for Microsoft Edge; Chrome: three dots, Extensions, Visit Chrome Web Store; Firefox: the menu button, Add-ons and themes), search for the manager by name, and click Add or Install. Check that the publisher shown is the real company before adding.
   • Mac: install from the App Store, then enable the Safari extension under Safari, Settings, Extensions. For Chrome or Firefox on a Mac, add the extension as above.
   • iPhone/iPad: install the app from the App Store, then open Settings, General, AutoFill & Passwords, turn on AutoFill Passwords and Passkeys, and check your manager in the list.
   • Android: install the app from the Play Store, then open Settings, Passwords & accounts (Samsung: General management, Passwords, passkeys and autofill), tap Autofill service (or the gear next to it), and choose your manager.
4. Turn on two-step verification for the password manager itself. In Bitwarden: sign in at vault.bitwarden.com, click Settings, then Security, then Two-step login. In 1Password: 1password.com, My Profile, More Actions, Manage Two-Factor Authentication. Apple and Google managers are protected by the account two-step verification you set up above.
5. Over the next few weeks, each time you log in to a site, the manager will offer to save the password. Say yes. When it flags a weak, reused, or breached password (Bitwarden: Reports; 1Password: Watchtower; Apple: Passwords app, Security; Google: Password Checkup), go to that site, change the password, and let the manager generate a new one.

Do not save passwords in a notes app, a spreadsheet, or an email draft, and do not let your web browser be the only place they live unless it is the Apple or Google manager described above.

Step 3: Turn on two-step verification for your other important accounts (20 minutes)

Once email is done, do the same for the accounts that hold money or your identity. The setting is usually under Security, Login, or Privacy in the account settings. Here is where it is on the most common ones:

After turning on two-step verification anywhere, most services show backup codes or recovery codes. Save these in your password manager under that account’s entry. They let you in if you lose your phone.

Windows PC (Windows 10 and 11)

Windows comes with good built-in protection. The work is making sure it is turned on, that you are current on updates, and that only you can sign in. Open Settings by clicking the Start button and then the gear icon, or by pressing the Windows key + I.

If you are still on Windows 10: Microsoft stopped providing free security updates for Windows 10 in October 2025. A PC without security updates gets riskier every month. Check whether your PC can upgrade to Windows 11 for free (Settings, Update & Security, Windows Update will tell you). If it cannot, enroll in Microsoft’s Extended Security Updates program if offered, or plan to replace the computer.

Step 1: Install updates and turn on automatic updates

1. Open Settings, then Windows Update (on Windows 10: Update & Security).
2. Click Check for updates. Install everything offered and restart when asked. Repeat until it says you are up to date.
3. Click Advanced options and turn on Get the latest updates as soon as they’re available and Receive updates for other Microsoft products.
4. Under Active hours, set the hours you normally use the PC so restarts happen while you are not using it.

Step 2: Confirm Windows Security is on

Windows Security (also called Microsoft Defender) is built-in antivirus and is good enough for most homes. You do not need to buy a separate antivirus product.

1. Open Settings, then Privacy & security, then Windows Security, then Open Windows Security.
2. Every tile should show a green check mark. If any shows a yellow or red mark, click it and follow the fix.
3. Click Virus & threat protection, then Manage settings. Make sure these are On: Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper Protection.
4. Scroll down to Controlled folder access and turn it On. This blocks ransomware from changing your documents and photos. If a trusted program later complains it cannot save, click Allow an app through Controlled folder access and add it.
5. Go back and click App & browser control, then Reputation-based protection settings. Turn everything On. This blocks known malicious downloads and fake apps.
6. Click Firewall & network protection. All three networks (Domain, Private, Public) should say Firewall is on.

If you already pay for a third-party antivirus (Norton, McAfee, Bitdefender, and so on), keep only one. Running two antivirus programs at once causes problems. If you let a trial expire, uninstall it so Windows Security takes over.

Step 3: Protect your sign-in

1. Open Settings, then Accounts, then Sign-in options.
2. Set up PIN (Windows Hello). Use at least 6 digits, not a date of birth or 1234. If your PC has a fingerprint reader or face camera, set that up too; it is faster and safer than typing.
3. Under Additional settings, set If you’ve been away, when should Windows require you to sign in again? to Every time or the shortest option. Turn on Dynamic lock if you have a phone paired by Bluetooth.
4. Open Settings, then System, then Power & battery (or Power & sleep), and set the screen to turn off after 10 minutes or less.
5. Give each person who uses the PC their own account. Open Settings, then Accounts, then Other users, and click Add account. For a child, use Settings, Accounts, Family, then Add someone, which also turns on parental controls. To check an existing account’s type, click its name under Other users, then Change account type, and choose Standard User. Children should always be Standard users. If you are the only user, your own account can stay as Administrator.

Step 4: Turn on disk encryption

Encryption scrambles everything on the drive so a thief who removes it cannot read your files.

1. Open Settings, then Privacy & security, then Device encryption. If you see it, turn it On.
2. If you do not see Device encryption, search the Start menu for Manage BitLocker. If it is available, click Turn on BitLocker for your C: drive and follow the prompts.
3. When asked where to save the recovery key, choose to save it to your Microsoft account and print it or write it down and keep it with your important papers. If you ever lose this key and Windows asks for it, your data is gone.
4. Windows 11 Home PCs often turned this on automatically when you signed in with a Microsoft account. Either way, check that the recovery key is saved by visiting account.microsoft.com/devices/recoverykey.

Step 5: Clean up programs and startup items

1. Open Settings, then Apps, then Installed apps. Scroll the list. Uninstall anything you do not recognize or no longer use, especially browser toolbars, “PC cleaner” or “driver updater” utilities, and trial software. If you are unsure what something is, search its name online before removing it.
2. Keep the programs you do use updated. Most update themselves; for the rest, open the program and look for Help, then Check for updates. Browsers, Zoom, Adobe Reader, and Java are the most important to keep current.

Step 6: Secure your web browser

1. Use Microsoft Edge, Google Chrome, or Firefox, and let it update itself (it does this when you close and reopen it; restart it when it shows an “Update” button).
2. Install your password manager’s browser extension.
3. Install an ad blocker; ads are one of the most common paths to malware. In Edge: click the three dots (top right), Extensions, Get extensions for Microsoft Edge, search uBlock Origin Lite, click Get. In Chrome: three dots, Extensions, Visit Chrome Web Store, search uBlock Origin Lite, click Add to Chrome. In Firefox: the menu button (three lines), Add-ons and themes, search uBlock Origin, click Add to Firefox. Confirm the publisher is Raymond Hill before adding.
4. Remove any other extensions you do not recognize: in Edge, click the puzzle-piece icon, then Manage extensions; in Chrome, click the three dots, then Extensions.
5. Turn on the browser’s built-in protection. Chrome: three dots, Settings, Privacy and security, Security, choose Enhanced protection. Edge: three dots, Settings, Privacy, search, and services, scroll to Security, turn on Enhance your security on the web and Microsoft Defender SmartScreen. Firefox: menu button, Settings, Privacy & Security, set Enhanced Tracking Protection to Strict and make sure Block dangerous and deceptive content is checked.

Step 7: Set up backups

1. Cloud backup for your important files: Open Settings, then Accounts, then Windows backup. Next to OneDrive folder syncing, click Set up syncing (or Manage sync settings) and turn on Desktop, Documents, and Pictures, then click Start backup. You can also check this from the OneDrive cloud icon in the bottom-right corner of the taskbar: click it, then the gear, Settings, Sync and backup, Manage backup. The free OneDrive plan is small (5 GB); a Microsoft 365 Basic or Personal subscription includes 100 GB to 1 TB. Google Drive, Dropbox, or Backblaze work too.
2. Full backup to an external drive: Buy an external USB drive at least twice the size of your PC’s storage. Plug it in. Click Start, type File History, and open File History (it opens in Control Panel). Click Select drive, choose the external drive, click OK, then click Turn on. It will back up your user folders automatically whenever the drive is connected. Click Advanced settings to set how often (every hour is the default) and how long to keep versions. Plug the drive in at least weekly.
3. Keep the external drive unplugged when you are not backing up, or ransomware can encrypt the backup along with the PC. Cloud plus an occasional offline drive is the ideal combination for a home.
4. Once a year, open the backup and confirm you can actually open a few files from it.

Step 8: Turn on Find My Device

Open Settings, then Privacy & security, then Find my device, and turn it On. If a laptop is lost, you can see its location and lock it from account.microsoft.com/devices.

Mac (macOS)

Macs are secure out of the box, but a few important protections are off until you turn them on. Open System Settings by clicking the Apple menu in the top-left corner of the screen, then System Settings (on older Macs it is called System Preferences). Use the search box in the top-left of that window if a setting is not where this guide says.

Step 1: Install updates and turn on automatic updates

1. Open System Settings, then General, then Software Update.
2. Install any update shown and restart when asked.
3. Click the (i) button next to Automatic Updates and turn on every switch, including Install Security Responses and system files. Click Done.
4. Apple supports roughly the three most recent versions of macOS. If your Mac says it is up to date but is running a version more than three years old, it may no longer get security fixes and should be replaced.
5. Open the App Store, click your name at the bottom left, and make sure apps update automatically (App Store, Settings, Automatic Updates).

Step 2: Protect your sign-in

1. Open System Settings, then Users & Groups. To give each person their own account, click Add User (or Add Account), enter your password, and choose Standard for everyone except yourself. To turn off the guest account, click the (i) next to Guest User and turn off Allow guests to log in to this computer. Set Automatically log in as to Off so the Mac asks for a password every time it starts.
2. Set a strong login password. Open System Settings, then Users & Groups, click the (i) next to your own account, then Change Password. Use a phrase you can type quickly but that nobody could guess; you will enter it often.
3. If the Mac has Touch ID, set it up under System Settings, then Touch ID & Password.
4. Open System Settings, then Lock Screen. Set Require password after screen saver begins or display is turned off to Immediately or After 1 minute, and set the display to turn off after 10 minutes or less on battery and power.
5. Children should have Standard accounts, not Administrator. To check or change an account’s type, in Users & Groups click the (i) next to the account and turn off Allow this user to administer this computer. To set content and time limits for a child, open System Settings, then Screen Time, choose the child’s account from the menu at the top, and set up Content & Privacy, App Limits, and Downtime. Lock those settings with a Screen Time passcode.

Step 3: Turn on FileVault (disk encryption)

FileVault scrambles your drive so a stolen Mac cannot be read. It does not slow a modern Mac down.

1. Open System Settings, then Privacy & Security, and scroll to FileVault.
2. Click Turn On.
3. Choose Allow my iCloud account to unlock my disk if you use iCloud, or create a recovery key. If you create a key, write it down and store it with your important papers. Without your password or recovery key, the data cannot be recovered by anyone, including Apple.
4. Encryption runs in the background and may take an hour or more. Keep the Mac plugged in.

Step 4: Turn on the firewall

1. Open System Settings, then Network, then Firewall (on older versions: Security & Privacy, then Firewall).
2. Turn the firewall On.
3. Click Options. Leave Block all incoming connections off (it breaks file sharing and AirDrop), but turn on Enable stealth mode.

Step 5: Only install trusted software

1. Open System Settings, then Privacy & Security. Under Allow applications downloaded from, choose App Store or App Store and identified developers. Never choose Anywhere.
2. If a website tells you to open Terminal and paste a command, or to “right-click and choose Open” to bypass a warning, close it. That is how most Mac malware gets installed. Real software never needs you to work around Apple’s warnings.
3. Macs do not need third-party antivirus for most households; the built-in XProtect and Gatekeeper do that job. If you want an extra layer, Malwarebytes for Mac (free scanner) is a reasonable choice. Avoid “Mac cleaner” apps that pop up in ads.
4. Remove apps you do not use. Open Finder, click Applications in the left sidebar, drag the app to the Trash in the Dock, then right-click the Trash and choose Empty Trash. Apps from the App Store can also be removed by opening Launchpad, holding the app icon until it wiggles, and clicking the X.

Step 6: Review privacy permissions

1. Open System Settings, then Privacy & Security.
2. Click through Location Services, Camera, Microphone, Screen Recording, Full Disk Access, and Accessibility. Turn off any app you do not recognize or that has no good reason for that access. Full Disk Access, Screen Recording, and Accessibility are the most sensitive; very few apps truly need them.

Step 7: Secure your web browser

1. Safari updates with macOS. If you use Chrome or Firefox, let it update itself and restart it when it asks.
2. In Safari, open Settings (Safari menu, then Settings), then Security, and make sure Warn when visiting a fraudulent website is checked. Under Privacy, check Prevent cross-site tracking and Hide IP address from trackers.
3. Install your password manager’s browser extension (Apple Passwords is built into Safari already).
4. Under Settings, then Extensions, remove anything you do not recognize. Consider adding a content blocker such as AdGuard for Safari or Wipr from the App Store.

Step 8: Turn on Find My

1. Open System Settings, click your name at the top, then iCloud, then Find My Mac, and turn it On, including Find My network.
2. If the Mac is lost, go to icloud.com/find from any device to locate, lock, or erase it.

Step 9: Set up backups

1. Time Machine (full backup to an external drive): Buy an external drive at least twice the size of your Mac’s storage. Plug it in, open System Settings, then General, then Time Machine, click Add Backup Disk, and choose the drive. Check Encrypt Backup when offered and save that password in your password manager. Time Machine then backs up every hour while the drive is connected.
2. iCloud for your everyday files: Open System Settings, your name, iCloud, then iCloud Drive, and turn on Desktop & Documents Folders. Also turn on iCloud Photos if you keep photos on the Mac. Free iCloud storage is only 5 GB; a 50 GB or 200 GB plan is inexpensive and worth it.
3. Unplug the Time Machine drive when you are not backing up, or plug it in weekly. A backup that is always connected can be hit by the same ransomware that hits the Mac.
4. Once a year, open Time Machine and confirm you can restore a file.

Android phone or tablet

Android menus vary more than any other platform because Samsung, Google, Motorola, and others each arrange Settings differently. The setting names below are the standard ones; if you cannot find one, pull down the Settings screen and use the search box at the top.

Step 1: Install updates

1. Open Settings, then System, then System update (Samsung: Settings, then Software update). Install anything offered and restart.
2. Also open Settings, then Security & privacy (or Security), and look for Google Play system update. Tap it and install.
3. Turn on automatic download of updates where offered (Samsung: Software update, then Auto download over Wi-Fi).
4. Check your phone’s update status: Settings, About phone, Android version, and look at the Android security update date. If it is more than a few months old and no update is offered, the phone is likely no longer supported. Most phones get 3 to 7 years of security updates from release; after that, replace it, because it will not get fixes for new attacks.
5. Open the Play Store, tap your picture, then Settings, then Network preferences, then Auto-update apps, and choose Over Wi-Fi only or Over any network.

Step 2: Set a strong screen lock

1. Open Settings, then Security & privacy, then Device unlock or Screen lock (Samsung: Lock screen and AEOD, then Screen lock type).
2. Choose PIN (at least 6 digits) or Password. Avoid Pattern; it is easy to watch over your shoulder and smudges give it away. Do not use your birthday or part of your phone number.
3. Set up fingerprint or face unlock for everyday convenience. The PIN remains the fallback, so it still needs to be strong.
4. Set Screen timeout (under Display) to 1 minute or less, and under the lock settings set Lock after screen timeout to Immediately or 5 seconds.
5. Turn off lock screen notifications that show content so messages and codes do not display to anyone who picks up the phone: Settings, Notifications, Notifications on lock screen, choose Hide sensitive content or Don’t show.

Step 3: Confirm Play Protect and app safety settings

1. Open the Play Store, tap your picture (top right), then Play Protect. Tap the gear icon and make sure Scan apps with Play Protect and Improve harmful app detection are On. Tap Scan once.
2. Only install apps from the Play Store (or the Samsung Galaxy Store). Never install an app from a link in a text message, a website, or a QR code; that process is called “sideloading” and it is how most Android malware arrives. If a website says you must download its APK file, close it.
3. Open Settings, then Apps, then Special app access, then Install unknown apps. Every app, including your browser and messaging apps, should show Not allowed.
4. In Settings, Apps, scroll the full list and uninstall anything you do not recognize or no longer use. Pre-installed apps you cannot uninstall can usually be Disabled.

Step 4: Review app permissions

1. Open Settings, then Security & privacy, then Privacy, then Permission manager (on some phones: Settings, Privacy, Permission manager).
2. Go through Location, Camera, Microphone, Contacts, SMS, Phone, and Files. For each, look at the apps allowed and ask: does this app need this to do its job? A flashlight or game does not need your contacts or location. Change anything doubtful to Don’t allow or Ask every time.
3. For Location, prefer Allow only while using the app over Allow all the time for everything except Find My Device and perhaps weather.
4. Check Settings, Security & privacy, Privacy, Privacy dashboard every so often to see which apps actually used your camera, microphone, or location recently.
5. Under Special app access, check Device admin apps, Accessibility, and Display over other apps. Only apps you deliberately installed for those purposes (a screen reader, a parental control app) should be listed.

Step 5: Turn on Find My Device and theft protection

1. Open Settings, then Security & privacy, then Device finders or Find My Device, and turn it On. Also turn on Location in Settings. If the phone is lost, go to android.com/find from any browser to locate, lock, or erase it.
2. On Android 15 and newer, open Settings, Security & privacy, Device unlock or Theft protection, and turn on Theft Detection Lock, Offline Device Lock, and Remote Lock. These lock the phone automatically if it is snatched from your hand.
3. Samsung phones: also turn on Settings, Security and privacy, Lost device protection, and set up SmartThings Find.
4. Open Settings, Security & privacy, More security settings, then SIM card lock, and set a SIM PIN. This stops a thief from moving your SIM to another phone to receive your verification texts. Your carrier’s default SIM PIN is usually 1234 or 0000; change it, and save the new one in your password manager. Entering it wrong three times locks the SIM and requires a code from your carrier, so write it down.

Step 6: Secure your Google account on the phone

1. Open Settings, then Google, then Manage your Google Account, then Security.
2. Run the Security Checkup. It will walk you through anything that needs attention: two-step verification, recovery info, old devices to sign out, and risky third-party apps to remove.
3. If a stranger could get your phone and PIN, they could reset your Google password. Two-step verification plus a strong PIN limits that risk.

Step 7: Browser and messaging

1. Open Chrome (or Samsung Internet), tap the three dots, Settings, Privacy and security, then Safe Browsing, and choose Enhanced protection.
2. Install your password manager’s app and set it as the autofill service: Settings, Passwords & accounts (or General management, Passwords, passkeys and autofill), then Autofill service.
3. In the Messages app, open Settings and make sure Spam protection is On. Never tap links in text messages about packages, tolls, bank alerts, or prizes; go to the company’s app or website directly instead.
4. In the Phone app settings, turn on Caller ID & spam and Filter spam calls.

Step 8: Back up your phone

1. Open Settings, then Google, then Backup (Samsung: also Settings, Accounts and backup, Back up data). Turn on Backup by Google One and tap Back up now. This saves apps, settings, call history, contacts, and texts.
2. Open the Google Photos app, tap your picture, then Photos settings, then Backup, and turn it On. This is the backup that matters most to most people. The free 15 GB fills up; a Google One plan with 100 GB is inexpensive.
3. Confirm backups are actually happening every few months by checking the date under Settings, Google, Backup.

iPhone and iPad (iOS and iPadOS)

iPhones and iPads are the easiest devices to secure because Apple turns most protection on by default and all apps come from the App Store. The work here is making your passcode strong, locking down what a thief could do with the phone in hand, and backing up. Open the Settings app (the gray gear icon).

Step 1: Install updates

1. Open Settings, then General, then Software Update. Install any update shown.
2. Tap Automatic Updates and turn on all switches: Download iOS Updates, Install iOS Updates, and Security Responses & System Files.
3. Open Settings, then App Store, and turn on App Updates under Automatic Downloads.
4. iPhones get updates for about 6 to 7 years from release. If Software Update says you are up to date but your device cannot install the current major version of iOS, it is nearing the end of support. Plan to replace it within a year or so.

Step 2: Set a strong passcode and Face ID or Touch ID

1. Open Settings, then Face ID & Passcode (or Touch ID & Passcode). Enter your current passcode.
2. Tap Change Passcode. When asked for the new one, tap Passcode Options and choose Custom Numeric Code (at least 6 digits, not a date) or Custom Alphanumeric Code (a short word-and-number combination). Four digits is too short.
3. Make sure iPhone Unlock, Wallet & Apple Pay, and Password AutoFill are turned on for Face ID or Touch ID.
4. Scroll down to Allow Access When Locked. Turn off anything you do not need, especially Control Center, Wallet, Reply with Message, and Accessories. This stops someone from turning on Airplane Mode (which blocks Find My) or reading messages on a locked phone.
5. Turn on Erase Data at the bottom so the phone wipes itself after 10 wrong passcode attempts. This is safe as long as you have a backup (Step 7); a child cannot trigger it by accident because the delays between attempts grow to over an hour.
6. Set Auto-Lock to 1 minute or less: Settings, Display & Brightness, Auto-Lock.
7. Hide message previews on the lock screen: Settings, Notifications, Show Previews, choose When Unlocked.

Step 3: Turn on Stolen Device Protection

This is the single most important iPhone setting added in recent years. Thieves who watch you type your passcode can otherwise change your Apple Account password and lock you out of everything.

1. Open Settings, then Face ID & Passcode, and scroll to Stolen Device Protection.
2. Tap it and turn it On. Choose Always for the security delay rather than Away from Familiar Locations.
3. Now changing your Apple Account password, turning off Find My, or viewing saved passwords requires Face ID or Touch ID (no passcode fallback) and, for the most sensitive changes, a one-hour wait.

Step 4: Confirm Find My and your Apple Account security

1. Open Settings, tap your name at the top, then Find My, then Find My iPhone. Turn on Find My iPhone, Find My network, and Send Last Location.
2. Go back and tap Sign-In & Security. Confirm Two-Factor Authentication is On and that your Trusted Phone Number is current.
3. Tap Account Recovery and add a Recovery Contact (a trusted family member with an iPhone). If you are ever locked out, they can help you get back in without losing your data.
4. Scroll down on the main account screen to see the list of devices signed in to your account. Tap any you no longer own and choose Remove from Account.
5. If the device is lost, go to icloud.com/find or use the Find My app on another Apple device to locate it, play a sound, mark it as lost, or erase it.

Step 5: Review app privacy and permissions

1. Open Settings, then Privacy & Security.
2. Tap Location Services. For each app, choose While Using the App or Never. Only Find My and perhaps weather or maps need Always. Turn off Precise Location for apps that only need your general area (weather, news, shopping).
3. Tap Tracking and turn off Allow Apps to Request to Track.
4. Go through Contacts, Photos, Microphone, and Camera. Remove access from any app that does not need it. For Photos, choose Limited Access or Add Photos Only where possible instead of Full Access.
5. Tap App Privacy Report and turn it on. Check back in a week to see which apps have been using your camera, microphone, and location.
6. Tap Safety Check if you want a guided review of everything you are sharing with people and apps.
7. Delete apps you no longer use: press and hold the app icon on the Home Screen, tap Remove App, then Delete App.

Step 6: Browser, mail, and messages

1. Open Settings, then Apps, then Safari (on older versions Safari is listed directly in Settings). Under Privacy & Security, turn on Prevent Cross-Site Tracking, Fraudulent Website Warning, and Hide IP Address from Trackers.
2. Apple’s built-in Passwords app stores your passwords and two-step codes and fills them in automatically. If you use a different password manager, open Settings, General, AutoFill & Passwords, and turn it on there.
3. Open Settings, Apps, Messages, and turn on Filter Unknown Senders. Never tap links in texts about packages, unpaid tolls, bank alerts, or Apple ID problems. Apple never texts you about your account.
4. Open Settings, Apps, Phone, and turn on Silence Unknown Callers if you can live with unknown numbers going to voicemail. Also check Call Blocking & Identification and turn on your carrier’s spam blocker if listed.
5. Open Settings, Apps, Mail, Privacy Protection, and turn on Protect Mail Activity.

Step 7: Back up your device

1. Open Settings, tap your name, then iCloud, then iCloud Backup. Turn on Back Up This iPhone and tap Back Up Now. It will then back up automatically every night while charging and on Wi-Fi.
2. On the same iCloud screen, turn on Photos (iCloud Photos). Your photos are almost certainly the most important data on the phone.
3. The free 5 GB of iCloud storage is not enough for a full backup. A 50 GB or 200 GB iCloud+ plan costs a few dollars a month and is the best money you can spend on your phone’s security.
4. Check the Last successful backup date under iCloud Backup every couple of months.

Step 8: Optional extra protection

• Lockdown Mode (Settings, Privacy & Security, Lockdown Mode) is designed for people who may be personally targeted by sophisticated attackers. It turns off many features and is not needed for most households.
• Advanced Data Protection (Settings, your name, iCloud, Advanced Data Protection) encrypts your iCloud backup so that even Apple cannot read it. It is a good choice, but if you lose your devices and your recovery key or recovery contact, your data is unrecoverable. Only turn it on after setting up a Recovery Contact in Step 4.
• Screen Time (Settings, Screen Time) lets you set content limits and prevent app purchases on a child’s device, and lock those settings behind a separate passcode.

Your home Wi-Fi router

Every device in your home connects through the router, so a weak router undoes much of the work above. This takes about 20 minutes and only needs to be done once, then checked yearly.

Most routers are managed one of two ways: through an app from the maker (Eero, Google Home, Netgear Nighthawk, TP-Link Tether, Linksys, Spectrum, Xfinity, AT&T Smart Home Manager) or through a web page. For the web page, look at the sticker on the bottom of the router for an address such as 192.168.1.1 or 192.168.0.1 and the default login, then type that address into a browser on a device connected to your Wi-Fi.

1. Change the router’s admin password. This is the password that controls the router’s settings, separate from the Wi-Fi password. The default (often “admin” or “password” or printed on the sticker) is public knowledge. Look for Administration, System, or Account and set a long, unique password. Save it in your password manager.
2. Use WPA3 or WPA2 security with a strong Wi-Fi password. Under Wireless or Wi-Fi settings, set Security to WPA3 or WPA2/WPA3 if available, otherwise WPA2-AES. Never WEP or “Open.” Set the Wi-Fi password to a long phrase (at least 12 characters). You will type it rarely, so length costs nothing.
3. Turn on automatic firmware updates. Look for Firmware, Software update, or Auto update and turn it on. If there is no automatic option, check for updates now and set a yearly reminder. If the router is more than 6 or 7 years old or the maker no longer provides updates, replace it. Routers provided by your internet company are usually updated automatically.
4. Create a guest network and put visitors and smart-home gadgets on it. Smart TVs, doorbells, thermostats, cameras, and plugs are rarely updated by their makers and are a favorite way into home networks. Keeping them on the guest network means a compromised gadget cannot reach your computers and phones. Give the guest network its own password.
5. Turn off features you do not use: WPS (the push-button connect feature), UPnP, and Remote management or Remote access (which lets the router settings be reached from the internet). Each has a history of security problems.
6. Rename the network if the name reveals the router brand or your family name (for example, “NETGEAR47” or “The Smiths”). Any neutral name is fine.
7. Look at the connected devices list once in a while. Most router apps show every device on your network. If something is there you cannot identify, change the Wi-Fi password.

If your router came from your internet provider and you cannot find these settings, call their support line and ask them to change the admin password, confirm WPA2 or WPA3, and enable a guest network. They do this routinely.

Everyday habits that keep you safe

Settings stop automated attacks. Habits stop the human ones, which today are the bigger threat to home users. Almost every successful attack on a household starts with a message that convinces someone to click, call, or pay.

Spotting a scam

Treat any message as suspicious if it has one or more of these signs:

• Urgency or fear: “Your account will be closed,” “a warrant has been issued,” “suspicious login detected,” “your grandson is in jail.”
• An unexpected request to pay or verify, especially by gift card, wire transfer, cryptocurrency, Zelle, or Venmo. No real company or government agency takes payment in gift cards.
• A link or attachment you were not expecting, even from someone you know. Their account may be compromised.
• A phone number to call inside a pop-up, email, or text. Microsoft, Apple, Amazon, and your bank do not put phone numbers in pop-ups.
• A request for a code that was just texted to you. That code is the key to your account; anyone asking for it is trying to break in.
• Slightly wrong details: a sender address that is close to but not exactly the real company, a greeting like “Dear Customer,” or a web address with extra words (amazon-support-help.com instead of amazon.com).

The one rule that defeats nearly all of them: never act on contact you did not start. If a message or call claims to be from your bank, Amazon, Microsoft, Medicare, or the IRS, hang up or close it, then contact the company yourself using the number on your card or statement, or by typing the website address you already know into your browser. If it was real, they will tell you. If it was not, you just avoided the scam.

Safe browsing and downloads

• Only download software from the maker’s own website or the official app store. Search results often show paid ads for fake download sites above the real one.
• If a website says your computer is infected, your browser needs an update, or you must call a number, close the browser. If it will not close, hold the power button to restart. These pages are always fake.
• Look for https and the lock icon before entering a password or card number, but understand that scam sites have locks too; the lock means the connection is private, not that the site is honest.
• Use a credit card rather than a debit card for online shopping. Credit cards have stronger fraud protection and a stolen number does not drain your checking account.
• Do not plug in USB drives you did not buy yourself.

Public Wi-Fi and travel

• Hotel, airport, and coffee shop Wi-Fi is fine for general browsing on an updated device, because almost all sites now encrypt traffic. Avoid banking or anything sensitive on it anyway, or use your phone’s cellular connection or hotspot instead.
• A VPN app is optional for most home users. It is useful on public Wi-Fi and for privacy from your internet provider, but it does not stop scams, malware, or phishing, and “free” VPNs often sell your data. If you want one, pay for a reputable one (Proton VPN, Mullvad, or the one included with your password manager or security suite).
• Turn off Bluetooth and Wi-Fi auto-join when traveling if you do not need them.

Protect the people in your household

• Set up every family member with their own account on shared computers and their own password manager login.
• Talk with older relatives about the scam signs above; they are targeted most heavily. Agree on a family rule: no one sends money or gift cards in response to a call or message without first calling another family member.
• For children, turn on parental controls: on iPhone and Mac, Settings, Screen Time, and set up Family Sharing so you manage it from your own device; on Android, install the Google Family Link app on your phone and follow its setup to link the child’s device; on Windows, Settings, Accounts, Family, add the child, then manage limits at family.microsoft.com. Keep devices in shared spaces, and talk about not sharing personal information or meeting online contacts.

If something goes wrong

If you are ever unsure, stop and ask someone you trust before acting. Scammers rely on you not doing that.

Quick checklists

Print this page or keep it on your phone. Tick each item as you finish it.

Accounts (do first)

• Main email has a long, unique password
• Two-step verification on for email
• Recovery phone and email added
• Password manager installed on every device and browser
• Two-step verification on for banking and social media

Windows PC

• Windows 11 (or Windows 10 with Extended Security Updates); all updates installed
• Automatic updates on, active hours set
• Windows Security: all green, Tamper Protection on, Controlled folder access on
• Only one antivirus product installed
• Windows Hello PIN (6+ digits) or fingerprint/face; screen locks after 10 minutes
• Everyday account is Standard; each person has their own account
• Device encryption or BitLocker on; recovery key saved to Microsoft account and on paper
• Unused programs and browser extensions removed
• Browser Enhanced protection on; ad blocker installed
• OneDrive (or other cloud) backing up Desktop, Documents, Pictures
• File History to an external drive; drive unplugged between backups
• Find my device on

Mac

• Current macOS; automatic updates all on
• Strong login password; Touch ID set; automatic login off; guest user off
• Screen locks immediately or after 1 minute
• FileVault on; recovery key or iCloud recovery saved
• Firewall on with stealth mode
• Apps allowed only from App Store and identified developers
• Privacy permissions reviewed (Full Disk Access, Screen Recording, Accessibility)
• Safari fraud warning and tracking prevention on
• Find My Mac on
• Time Machine to an encrypted external drive, plus iCloud Drive and Photos

Android

• Android and Google Play system updates installed; still receiving security updates
• Play Store auto-update on
• 6+ digit PIN or password (no pattern); fingerprint or face set; locks within 1 minute
• Sensitive lock screen notifications hidden
• Play Protect on; Install unknown apps set to Not allowed for every app
• Unused apps removed; permissions reviewed in Permission manager
• Find My Device on; Theft Detection Lock and Remote Lock on
• SIM PIN set and saved in password manager
• Google Security Checkup completed
• Chrome Enhanced protection on; Messages spam protection on; call screening on
• Google One backup and Google Photos backup on

iPhone and iPad

• Current iOS; automatic updates all on; App Store auto-update on
• 6+ digit or alphanumeric passcode; Face ID or Touch ID set
• Lock-screen access trimmed (Control Center, Wallet, Reply off); Erase Data on
• Auto-Lock 1 minute; notification previews only when unlocked
• Stolen Device Protection on, set to Always
• Find My iPhone, Find My network, and Send Last Location on
• Two-factor authentication on; Recovery Contact added; old devices removed
• Location, Tracking, Photos, Contacts, Microphone permissions reviewed
• Safari fraud warning and tracking prevention on; Filter Unknown Senders on
• iCloud Backup and iCloud Photos on; enough iCloud storage purchased

Home router

• Admin password changed from the default
• WPA3 or WPA2 with a 12+ character Wi-Fi password
• Automatic firmware updates on (or checked this year)
• Guest network on; smart-home gadgets and visitors use it
• WPS, UPnP, and remote management off

Monthly, 10 minutes

• Restart each computer and phone so pending updates finish
• Glance at the backup date on each device
• Delete apps you have not opened this month
• Review any password-manager alerts about weak, reused, or breached passwords

Yearly, 1 hour

• Open a backup and restore a file to prove it works
• Check for router firmware updates; review connected devices
• Review signed-in devices on Google, Microsoft, and Apple accounts and remove old ones
• Check whether any device has stopped receiving security updates and plan its replacement
• Re-read the scam signs with the whole household