An iPhone is secure out of the box, but the settings that protect you most when the phone is stolen, when an app oversteps or when someone close to you is watching are mostly off or set loosely until you change them. This guide walks through the iPhone security and privacy settings that matter most: passcode and Face ID, Stolen Device Protection, your Apple Account, app permissions and Location Services, tracking requests, the App Privacy Report, Safety Check, Hide My Email, updates, and Lockdown Mode. For each it says where to find it, what it does and what to watch out for. It is written in plain English for anyone with an iPhone, and for the person who sets up phones for the rest of the family. Menu names change between iOS versions; if a setting is not exactly where we say, use the search bar at the top of Settings. For the basic phone safety routine see the Securing Your Smartphone Guide; this page goes deeper on the iPhone itself.
This is an independent guide from NHI Mgmt Group, based on Apple's public documentation as of November 2026. It is not sponsored or reviewed by Apple. Product features change, so confirm settings against Apple's current documentation.
Key takeaways
- The passcode is the master key. Anyone who learns it can, without Stolen Device Protection, change your Apple Account password and lock you out, so use six digits or more and keep it private.
- Turn on Stolen Device Protection. Away from familiar places it requires Face ID or Touch ID for sensitive actions and adds a one-hour security delay before the most damaging changes.
- Permissions are where privacy is won or lost. Location, photos, contacts, microphone and Bluetooth are each controlled per app, and most apps need far less than they ask for.
- The App Privacy Report shows what apps actually do. It lists when apps used your permissions and which internet domains they contacted.
- Safety Check and Lockdown Mode are for specific situations. Safety Check quickly cuts off sharing with someone you no longer trust; Lockdown Mode is an extreme protection for people who may be personally targeted.
How identity and access work on iPhone
Two things control access: the passcode (with Face ID or Touch ID on top), and the Apple Account signed in to the phone. The passcode also protects the encryption of your data, and the Apple Account controls iCloud data, Find My and Activation Lock.
Passcode and Face ID or Touch ID
| Option | Strength | Notes |
|---|---|---|
| 4-digit numeric code | Weak | Only 10,000 combinations; easy to watch over a shoulder |
| 6-digit numeric code (default) | Good | The US Federal Trade Commission recommends at least six digits; avoid birthdays and 123456 |
| Custom numeric or alphanumeric code | Strongest | Set under Passcode Options when changing the passcode |
| Face ID or Touch ID | Convenience layer | Uses the Secure Enclave; the passcode is still required after a restart and in other set cases |
Change these under Settings, Face ID and Passcode (or Touch ID and Passcode). Set Auto-Lock to a short time under Settings, Display and Brightness. In the same Face ID and Passcode screen, under "Allow access when locked", turn off items you do not need on the lock screen, such as accessories, Wallet and replying to messages.
Stolen Device Protection
Thieves have watched people type their passcode in public, then taken the phone and used the passcode to change the Apple Account password. Stolen Device Protection, available from iOS 17.3, closes that gap. Turn it on in Settings, Face ID and Passcode, Stolen Device Protection. It needs two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Find My and Significant Locations.
| Protection | Examples Apple lists |
|---|---|
| Face ID or Touch ID required, no passcode fallback | Using saved passwords and passkeys, using saved payment cards in Safari, turning off Lost Mode, erasing the iPhone, setting up or moving an eSIM |
| One-hour security delay, then Face ID or Touch ID again | Changing the Apple Account password, signing out of the Apple Account, changing trusted devices or recovery settings, changing the passcode, changing Face ID or Touch ID, turning off Stolen Device Protection |
The extra steps apply when the phone is away from familiar locations such as home or work. Setting "Require Security Delay" to Always applies the delay everywhere, which is stronger but less convenient.
Your Apple Account
- Two-factor authentication: under Settings, your name, Sign-In and Security. Accounts created with it cannot turn it off.
- Recovery options: add a Recovery Contact (up to five people who can give you a code to regain access; they cannot see your data) so you are not stuck if you lose your devices. Security keys and a Recovery Key give stronger protection but put more responsibility on you: Apple warns that losing a Recovery Key can lock you out permanently.
- Devices: the device list at the bottom of the Apple Account screen shows everything signed in. Remove anything you do not recognise.
See the Securing Your Apple ID and Google Account Guide for account recovery in depth.
Admin roles and privileged access: app permissions
An iPhone has no administrator account you sign in to. The "privileges" are the permissions you grant each app, all listed under Settings, Privacy and Security. Tap a category (Location Services, Contacts, Photos, Camera, Microphone, Bluetooth, Local Network and so on) to see every app that asked and change its access.
Location Services
| Choice | Meaning | Good for |
|---|---|---|
| Never | No location access | Most games, shopping and social apps |
| Ask Next Time Or When I Share | Asks each time | Apps you use occasionally |
| While Using the App | Only while the app is open | Maps, ride hailing, weather |
| Always | Also in the background | Only apps you deliberately want tracking you, such as Find My |
- Precise Location: each app's location page has a Precise Location switch. Turn it off for apps that only need your town, such as weather or news.
- System Services: at the bottom of Location Services, review System Services, including Significant Locations. Keep Significant Locations on if you use Stolen Device Protection, which relies on it to recognise familiar places.
- Photos and Contacts: recent iOS versions let you give an app access to selected photos or selected contacts only, rather than your whole library or address book.
- Camera and microphone: a green dot (camera) or orange dot (microphone) appears at the top of the screen when an app is using them.
- Local Network and Bluetooth: apps rarely need these unless they control a device in your home. Refuse when an app has no obvious reason to ask.
Integrations, apps and connected accounts
Tracking requests
Since iOS 14.5, App Tracking Transparency requires apps to ask permission before tracking you across other companies' apps and websites. Under Settings, Privacy and Security, Tracking, turn off "Allow Apps to Request to Track" and every app is told you said no, without asking. Apple's rules also bar developers from fingerprinting a device to get around this choice.
App Store privacy labels
Every App Store listing has an App Privacy section that the developer must complete, including data collected by third-party code inside the app: data used to track you, data linked to you and data not linked to you. Read it before installing apps that will hold sensitive data.
Hide My Email and Sign in with Apple
Hide My Email creates random email addresses that forward to your real inbox, so a shop or newsletter never learns your real address and you can delete the address if it starts receiving spam. Sign in with Apple can use it automatically; with an iCloud+ subscription you can also create addresses for any site. Manage them under Settings, your name, iCloud. Apps you have signed in to with your Apple Account are listed under Sign-In and Security, Sign in with Apple, where you can stop using your account with an app.
Computers and accessories
When you connect the iPhone to a computer and tap "Trust", that computer can sync and read your photos, contacts and other data until you reset the setting. Reset trusted computers with Settings, General, Transfer or Reset iPhone, Reset, Reset Location and Privacy. A locked iPhone must be unlocked before a USB accessory can communicate with it, though it still charges.
Safety Check
Safety Check (Settings, Privacy and Security, Safety Check, from iOS 16) is built for people whose safety may be at risk from someone close to them. Emergency Reset immediately stops sharing your location and other information with everyone, resets app privacy permissions and helps you review your Apple Account. Manage Sharing and Access lets you review, one person and one app at a time, who can see your location, photos, notes and other shared data. If someone may be monitoring your phone, think about whether they will notice sharing stopping before you use it.
Logging and detection: seeing what apps do
- App Privacy Report: from iOS 15.2, turn it on at Settings, Privacy and Security, App Privacy Report. It shows how often and when apps accessed your location, photos, camera, microphone and contacts over the past seven days, which domains apps contacted (including websites visited inside apps) and the domains contacted most often. Apple says the data is encrypted and stored only on your device, and turning the report off clears it. Check it after a week for apps reaching for data they do not need, or contacting domains you would not expect.
- Recording indicators: the green and orange dots show live camera and microphone use; Control Centre shows which app used them most recently.
- Apple Account alerts: Apple sends an email or notification when your Apple Account is used to sign in on a new device. Apple never asks you for your password or verification codes.
- Threat notifications: Apple notifies users it believes have been targeted by state-sponsored mercenary spyware, by email and at account.apple.com. Apple says these come from [email protected] and never ask you to click links.
Signs worth investigating: an unfamiliar device on your Apple Account, a configuration profile you did not install (Settings, General, VPN and Device Management), Find My or location sharing you did not set up, and unexpected security alerts. The Mobile Spyware Response Playbook covers next steps.
Hardening baseline
Updates
Turn on Settings, General, Software Update, Automatic Updates, including security responses and system files. Updates fix security holes that are already being exploited, so install them promptly rather than waiting weeks.
Find My and Activation Lock
Turn on Find My iPhone, the Find My network and Send Last Location under Settings, your name, Find My. With Find My on, Activation Lock stops a thief setting the phone up again without your Apple Account. If the phone goes missing, mark it as lost at icloud.com/find, which locks it and suspends Apple Pay cards. See the Stolen or Lost Phone guide.
Lockdown Mode
Lockdown Mode (Settings, Privacy and Security, Lockdown Mode) is an optional, extreme protection for the small number of people who may be personally targeted by sophisticated spyware, such as journalists, activists and senior officials. It blocks most message attachments and some web technologies, blocks FaceTime calls from people you have not called before, stops automatic joining of non-secure Wi-Fi, turns off 2G and 3G support, blocks wired connections to accessories and computers while locked, and prevents installing configuration profiles. It is set per device, so turn it on for each Apple device you use. Most people do not need it.
Baseline settings
| Setting | Where | Recommended |
|---|---|---|
| Passcode | Face ID and Passcode | 6 digits or more; alphanumeric for higher risk |
| Stolen Device Protection | Face ID and Passcode | On |
| Allow access when locked | Face ID and Passcode | Off for items you do not need |
| Two-factor authentication and recovery | Your name, Sign-In and Security | On, with a Recovery Contact |
| Find My, Find My network, Send Last Location | Your name, Find My | On |
| Automatic Updates | General, Software Update | All options on |
| Location Services | Privacy and Security | While Using or Never; Precise Location off where not needed |
| Allow Apps to Request to Track | Privacy and Security, Tracking | Off |
| App Privacy Report | Privacy and Security | On; review monthly |
| Lockdown Mode | Privacy and Security | Only for people who may be personally targeted |
For children's iPhones, Screen Time adds Content and Privacy Restrictions and Ask to Buy through Family Sharing; see the Parental Controls Guide. Phones managed by an employer may enforce some settings; that is covered in the iOS and iPadOS Enterprise Security Guide.
Common misconfigurations
- Stolen Device Protection never turned on: it is the main defence against a thief who has seen your passcode, and it must be on before the theft.
- A four-digit or obvious passcode: easily watched or guessed, and it unlocks your saved passwords on phones without Stolen Device Protection.
- "Always" location and Precise Location for many apps: builds a detailed record of where you live, work and go.
- Old location or photo sharing left in place: sharing set up with a former partner or friend keeps running until someone stops it; Safety Check finds it.
- A configuration profile installed from a website or "support" caller: profiles can route traffic or change settings; remove any you do not recognise.
- Updates postponed for weeks: Apple regularly fixes flaws it says may have been actively exploited.
Practitioner checklist
- Use a passcode of at least six digits, set Auto-Lock short, and turn off unneeded "Allow access when locked" items.
- Turn on Stolen Device Protection, after confirming two-factor authentication, Find My and Significant Locations are on.
- Add a Recovery Contact and remove unrecognised devices from your Apple Account.
- Go through Privacy and Security category by category; set location to While Using or Never and turn off Precise Location where not needed.
- Turn off "Allow Apps to Request to Track".
- Turn on the App Privacy Report and review it after a week.
- Run Safety Check's Manage Sharing and Access to review who can see your location and shared data.
- Turn on Automatic Updates and Find My with Send Last Location.
- Consider Hide My Email for new sign-ups, and Lockdown Mode only if you may be personally targeted.
Standards and references
- Apple Support: About Stolen Device Protection for iPhone
- Apple Personal Safety User Guide: What is Safety Check?
- Apple Support: About Lockdown Mode
- Apple Support: About App Privacy Report
- Apple Developer: User Privacy and Data Use
- Apple Support: Two-factor authentication for Apple Account
- Apple Support: Update your iPhone or iPad
- US Federal Trade Commission: How To Protect Your Phone and the Data on It
Related NHI Mgmt Group resources: Securing Your Smartphone Guide · Securing Your Apple ID and Google Account Guide · Apple Platform Security Explained · Stolen or Lost Phone