A quick device-security list

You don’t need a pile of extra apps to make a phone or computer safer. A few clear steps, done properly, cut down the everyday risks: a lost or stolen device, someone else getting into your accounts, and the kind of malware that arrives through a suspicious file or link. This page puts those first steps in order. For the finer settings of each system, use the guide for that device.

Check whether the operating system is still supported

No antivirus program can replace a system that no longer receives security updates. If the vendor has stopped patching that version, installing extra tools does not fix the underlying problem.

Ordinary support for Windows 10 ended on 14 October 2025. The PC still turns on, but it no longer gets regular security updates unless you enroll it in the Extended Security Updates (ESU) program. ESU delivers critical and important security fixes only; it does not add new features or technical support, and it runs until 12 October 2027. The main path is still an upgrade to Windows 11 if the hardware allows it. Otherwise, look at replacing the device or using ESU as a temporary bridge. Enrollment terms and cost vary by region and account type; the Windows Update page shows what applies to your PC.

The same logic applies to phones, Macs and Linux: a version that no longer gets patches is a poor choice for sensitive work. If you are still on Windows 10, the guide to life after Windows 10 support walks through the options in more detail.

Check the version on the official path

1. On Windows: open Settings > System > About and read the edition and version. Then open Settings > Windows Update to see whether you are offered an upgrade, ESU enrollment or an end-of-support message.
2. On Android: open Settings > About phone or Settings > System > About phone, and note the Android version and the security-patch date.
3. On iPhone or iPad: check Settings > General > About and Settings > General > Software Update.
4. On a Mac: System Settings > General > About and System Settings > General > Software Update.
5. On desktop Linux, Settings > About usually shows the version; take updates from that distribution’s official tool.

Choose a screen lock you will actually use

A screen lock is the first barrier after a device is lost or taken. A long, hard-to-guess PIN or passphrase is better than a pattern that can be read from fingerprints on the glass, or a code based on your birthday.

Fingerprints and face unlock make daily use easier, and they are a reasonable choice for many people. In situations where someone might inspect the device or try to force it open, some people turn biometrics off and use only a passcode, because in some legal systems compelling a fingerprint is treated differently from compelling someone to reveal a password. That depends on local law and on your circumstances; it is not a single rule for everyone.

What matters more than the method is that you will use the lock every day. A lock you constantly bypass is not really there.

Where to set the lock in 2026

1. Windows: Settings > Accounts > Sign-in options. Check the PIN or password, and if Windows Hello is on, make sure you can still sign in without it.
2. Android: Settings > Security and privacy > Device unlock, or Settings > Security > Screen lock — the exact label depends on the manufacturer.
3. iPhone: Settings > Face ID & Passcode or Touch ID & Passcode. Change the code if it is short or easy to guess.
4. Mac: System Settings > Lock Screen and System Settings > Touch ID & Password or Login Password.

Treat account sign-in as separate from the device lock

Your email password, your phone PIN and your disk-encryption recovery key are three different things. Important accounts should each have a long, unique password, and multi-factor authentication where you can turn it on. A password manager makes that practical instead of memorable.

Ask yourself how you would get back into the vault or your recovery codes if the phone disappeared. Do not keep two-factor backup codes and recovery keys only inside the locked device, or only inside the very account they are meant to rescue. See the guide to two-factor authentication for the details.

Get updates from the official path

Keep the operating system, the browser and the apps you rely on updated through the official store or vendor site. Turn on automatic updates if that fits how you work. Being up to date is not the same as being immune, but many widespread attacks still exploit flaws that were patched months earlier.

If a website suddenly claims your device is “definitely infected” and wants you to install an unknown program, ignore it and do not install the file. Before a major update or a significant change, keep a restore-able copy of important files.

The official update path

1. Windows: Settings > Windows Update, then Check for updates. Do not take an ISO or a patch from an unknown site.
2. Android: Settings > System > Software update, or Settings > Security & privacy > System & updates — names differ by manufacturer.
3. iPhone: Settings > General > Software Update.
4. Mac: System Settings > General > Software Update.
5. Update apps from that system’s official store or the vendor’s site, not from a message or a banner inside a news page.

Understand disk encryption together with recovery

Disk encryption makes it much harder for someone to read your files by pulling out the storage when the device is off or locked. It does not replace account passwords, and it does not help if the screen is left unlocked.

On Windows, depending on the edition and hardware, you may have Device Encryption or BitLocker. On many eligible devices, Device Encryption turns on automatically after you sign in with a Microsoft account and stores the recovery key with that account. BitLocker, on Pro and higher editions, gives you more manual control. The recovery key is a 48-digit number; if you lose it and Windows cannot unlock the drive, there is usually no other way back. Keep a copy of the key away from the PC itself — in the Microsoft account only if you can reach that account from somewhere else, or in a safe offline place.

On a Mac, FileVault encrypts the disk. Newer Macs already have some hardware-level protection, but FileVault means the contents are not readable without the login password. Do not store the recovery key only on that same Mac.

On Ubuntu and many other Linux distributions, full-disk encryption is usually done with LUKS and is often chosen during installation. Encrypting the only copy of your data later, without a backup, is a risky move.

On current Android phones and iPhones, storage encryption is usually on by default and tied to the screen lock. What matters is a strong lock, and keeping any recovery account or key somewhere separate. More detail is in the guides to Android, iPhone and iPad, Windows, Mac and Linux.

Find the recovery key today

1. Windows: look at Settings > Privacy & security > Device encryption, or on Pro editions search Settings or Control Panel for BitLocker. Keep a copy of the 48-digit key away from the PC itself.
2. Mac: System Settings > Privacy & Security > FileVault. If FileVault is on, check where the recovery key is kept there or in your Apple Account, and keep a separate copy as well.
3. If the key exists only inside the same device it is meant to rescue, move it to a safe place outside that device.

Use the protection that is already built in

Before you install several scanners at once, see what the system already provides. On Android, Play Protect checks store apps and can warn you about some suspicious software; that is not the same as finding every kind of malware, especially targeted spyware. On Windows, the Windows Security app shows protection status and lets you run a scan. A clean scan is not a forensic certificate that the device is clean. If you are worried about advanced spyware, avoid random tools and get specialized help instead of poking at the device yourself.

1. Android: open the Play Store app, tap your account picture and open Play Protect; or check Settings > Security and privacy > App security.
2. Windows: open Settings > Privacy & security > Windows Security and read the Virus & threat protection status.
3. Do not install several antivirus programs at once; they interfere with each other and produce confusing alerts.

Keep a backup you can actually restore

Locks and encryption only go so far if losing the device also means losing your work. Keep a copy of documents, important photos and your password vault, and restore that copy at least once so you know it works. Cloud sync is not a backup by itself; a deletion can sync too. The guide to backups you can restore covers the details.

Extra hardening is not for everyone

Apple offers Lockdown Mode for people who might be targeted by highly sophisticated, custom spyware. It limits some messaging, browsing and calling features in order to shrink the attack surface. Most people do not need it, and it makes the device harder to live with day to day. Separate tools that lock down network access or harden Windows are useful only if you understand what they block and can keep them maintained.

Common mistakes

• Installing several security apps instead of updating the operating system itself.
• A screen lock so complex that you effectively turn it off.
• Keeping the recovery key only on the same disk that is encrypted.
• Installing a file from a page that suddenly claims your device is infected.
• Relying on cloud sync instead of a copy whose restore you have seen once.

What to do now

1. Establish whether your operating system is still supported. If you are on Windows 10, decide on an upgrade, a replacement, or ESU enrollment.
2. Review the screen lock and make sure it is a method you will actually use.
3. Give your main accounts unique passwords and two-factor authentication, and store recovery codes somewhere safe outside those same accounts.
4. Check disk encryption in settings and find where the recovery key is stored.
5. Apply official updates to the system and to your everyday apps.
6. Make a restore-able copy of essential files and test the restore once.