Your iPhone: the security basics official guidance covers

The main iPhone security settings are automatic updates, a strong passcode, Stolen Device Protection, two-factor authentication for the Apple Account, iCloud Backup and Find My. An iPhone holds email, photos, banking apps and the codes that unlock other accounts. If someone else gets into it, they may be able to get into much of the rest of your digital life. This guide explains the main iPhone security settings, what each one does and how it is turned on.

The steps below are based on Apple’s own help pages and on mobile phone guidance from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC). Each section links to Apple’s page for the latest steps, and the Personal Cyber Safety Checklist gives a way to tick them off.

Why it matters

Each setting covers a different risk. Updates close security weaknesses. A passcode keeps the phone private if it is lost. Two-factor authentication protects the account behind the phone. A backup means photos and messages aren’t lost with the phone. Find My helps locate or lock a missing phone.

Several of these only work if they are set up before something goes wrong: Apple says Find My and Stolen Device Protection both need to be on before a device is lost or stolen, and a backup can only restore what was backed up.

How to turn on automatic updates

Updates fix security weaknesses. The ACSC’s update guidance says: “Cyber criminals hack devices by using known weaknesses in systems or apps”, and “Updates have security upgrades to fix these weaknesses.” Its mobile phone guidance says: “Turn on automatic updates for your phone’s operating system and apps”. With automatic installation on, Apple says an iPhone installs updates overnight while charging and connected to Wi-Fi, and notifies the owner before installing.

Based on Apple’s instructions (checked October 2026). Menus can change between versions; Apple’s update guide has the latest steps.

1. Open Settings, then tap General.
2. Tap Software Update. This shows the installed iOS version and whether an update is waiting.
3. Tap Automatic Updates.
4. Turn on Automatically Install. (Apple says Automatically Download, which downloads updates to install later, appears only when Automatically Install is off.)
5. To update straight away, go back to Software Update and tap Download and Install if an update is available.

Apple’s page suggests backing up first and having the phone plugged in and on Wi-Fi before a manual update.

Phones eventually stop getting updates. The ACSC calls this “end of support”, which it describes as “the expiry date of the software”, and its mobile phone guidance describes replacing outdated devices or operating systems.

How to set a strong passcode

A passcode stops other people opening the phone. It also protects what’s stored on it: Apple’s Personal Safety guide says setting a passcode turns on data protection, which encrypts the iPhone’s data. The ACSC’s mobile phone guidance says: “Lock your phone with a passphrase, password, PIN or biometrics”, and notes that “simple patterns or your date of birth are too easy.” Face ID or Touch ID can unlock the phone most of the time, which also means the passcode is typed less often where others might see it.

Based on Apple’s instructions (checked October 2026). Apple’s passcode guide has the latest steps.

1. Open Settings, then tap Face ID & Passcode (on older iPhones, Touch ID & Passcode).
2. Tap Turn Passcode On, or Change Passcode if one is already set.
3. Enter a six-digit passcode, or tap Passcode Options to choose a four-digit numeric code, a custom numeric code or a custom alphanumeric code.
4. Enter the passcode again to confirm.
5. Optionally, turn on Erase Data. Apple says this erases the phone after ten failed passcode attempts.

By default, Apple says the iPhone asks for the passcode as soon as the screen locks.

How to turn on Stolen Device Protection

Stolen Device Protection is aimed at a specific situation: someone steals the phone and knows the passcode. Apple says that when the iPhone is away from familiar places such as home or work, some sensitive actions need Face ID or Touch ID rather than the passcode, and some, such as changing the Apple Account password, also need a one-hour security delay. Apple says the delay “is designed to prevent a thief from performing critical operations.” It is available on iOS 17.3 or later and, Apple notes, “must be turned on before the device is lost or stolen.”

Apple lists what it needs: two-factor authentication on the Apple Account, a device passcode, Face ID or Touch ID, Significant Locations, and Find My.

Based on Apple’s instructions (checked October 2026). Apple’s Stolen Device Protection page has the latest steps.

1. Open Settings, then tap Face ID & Passcode.
2. Enter the passcode.
3. Tap Stolen Device Protection and turn it on. Apple notes it may already be on.

How to turn on two-factor authentication for your Apple Account

The Apple Account (formerly called Apple ID) is the sign-in behind iCloud, purchases and Find My. Two-factor authentication means that signing in on a new device or on the web needs the password and a six-digit code shown on a trusted Apple device or sent to a trusted phone number. Apple says this protects the account “even if someone else knows your password.”

The ACSC’s multi-factor authentication guide lists Apple ID among the accounts to protect, describes MFA as “one of the best ways to protect against someone breaking into your account”, and says: “Never approve unknown sign-in attempts or share your MFA code.”

Based on Apple’s instructions (checked October 2026). Apple’s two-factor guide has the latest steps.

1. Open Settings.
2. Tap your name, then Sign-In & Security.
3. Check whether two-factor authentication is already on. Apple says most accounts already use it.
4. If not, turn on two-factor authentication and follow the onscreen instructions, including adding a trusted phone number.

Our guides to how to secure your online accounts, how passkeys work and planning account recovery cover the wider picture.

How to back up with iCloud

A backup is a copy of the phone’s data that can be restored to a new or repaired phone. The ACSC’s mobile phone guidance says: “Backups of important information should be kept on at least two other devices.” Apple’s iCloud Backup runs automatically once it’s on, as long as the phone is on power and Wi-Fi with the screen locked. If iCloud storage runs out, Apple says the phone shows an alert.

Based on Apple’s instructions (checked October 2026). Apple’s iCloud backup guide has the latest steps.

1. Open Settings, tap your name, then tap iCloud.
2. Tap iCloud Backup.
3. Turn on Back Up This iPhone.
4. To back up now, connect to Wi-Fi and tap Back Up Now. The date and time of the last backup appear underneath.

Our guide to the 3-2-1 approach to backups explains the idea of keeping more than one copy.

How to turn on Find My

Find My can show a missing iPhone on a map, play a sound, lock it with Lost Mode, or erase it. Apple’s lost iPhone guide says: “If Find My wasn’t turned on for your device before it was lost, it won’t appear at icloud.com/find or in the Find My app”, and “you can’t mark it as lost or remotely erase it”. Apple describes two extra options: the Find My network, which Apple calls “a crowd-sourced network of over a billion Apple devices that use Bluetooth technology” and which can help find a device while it’s offline; and Send Last Location, which sends the phone’s location to Apple when the battery is low.

Based on Apple’s instructions (checked October 2026). Apple’s Find My setup guide has the latest steps.

1. Open Settings.
2. Tap your name, then tap Find My.
3. Tap Find My iPhone and turn it on.
4. Turn on Find My network and Send Last Location if wanted. Apple says Location Services also needs to be on for Find My to show a lost device on a map.

If the phone does go missing, Apple’s lost iPhone guide and stolen iPhone page explain the next steps. Apple’s stolen-device page lists Lost Mode, reporting to local police and contacting the mobile carrier. Our guide to locking and locating a lost iPhone covers this too.

How to review app permissions

Apps ask before using things like Photos, Contacts, the camera, the microphone or location. Apple’s Personal Safety guide explains that an app appears in the privacy settings only once it has asked, and that access can be allowed or removed for each app. The ACSC’s mobile phone guidance says: “Only download apps from an official app store” and “Remove apps when you no longer need them”, and describes removing apps that ask for excessive or suspicious permissions. Our guide to banking and shopping on your phone covers getting the real banking app.

Based on Apple’s instructions (checked October 2026). Apple’s app privacy guide has the latest steps.

1. Open Settings, then tap Privacy & Security.
2. Tap a type of information, such as Photos, Contacts or Microphone.
3. Review the list of apps that have asked for access.
4. Change the setting for any app. For Photos, Apple says the level of access can also be adjusted.

App Privacy Report adds a record. Apple says it shows how often apps accessed things like location, camera and microphone, and which web domains they contacted, over the past seven days, and that the data “is encrypted and stored only on your device.” To turn it on, Apple’s App Privacy Report page describes going to Settings > Privacy & Security, scrolling to App Privacy Report and tapping Turn on App Privacy Report. Apple notes it only starts collecting after it’s turned on.

How to check privacy settings

Two more privacy settings sit in the same menu.

Tracking. Apple describes tracking as linking information about you from one app with information from other companies’ apps and websites, for targeted advertising or ad measurement. Apple says apps must ask permission, and that an app’s full features stay available whether or not tracking is allowed. Based on Apple’s instructions (checked October 2026), from Apple’s tracking page:

1. Open Settings, then tap Privacy & Security.
2. Tap Tracking.
3. Turn permission on or off for each app listed, or turn off Allow Apps to Request to Track to stop the prompts. Apple says apps that ask while this is off are treated as if the owner chose Ask App Not to Track.

Safety Check. Apple describes Safety Check as a way to review and change what is shared with people and apps. It needs iOS 16 or later and an Apple Account with two-factor authentication. Based on Apple’s Safety Check guide (checked October 2026):

1. Open Settings, then tap Privacy & Security.
2. Scroll down and tap Safety Check.
3. Choose Manage Sharing & Access to review people and apps one at a time, or Emergency Reset to stop sharing with all people and apps at once.

Apple’s guide points out that people may notice when sharing stops, and suggests thinking about personal safety before making changes. A Quick Exit button closes Settings straight away.

Things to watch for

• Shoulder surfing. Stolen Device Protection exists because a passcode can be watched over someone’s shoulder. Using Face ID or Touch ID in public places reduces how often the passcode is typed.
• Sign-in requests nobody started. The ACSC says never to approve unknown sign-in attempts or share an MFA code. A six-digit Apple code appearing unexpectedly may mean someone has the password. Our guide to what to do if an account has been hacked explains where official guidance says to start.
• Settings that need to be on beforehand. Find My, Stolen Device Protection and backups can’t be switched on after a phone is gone. Our guide to setting up a new phone securely covers turning them on from the start.
• Full iCloud storage. Automatic backups stop when storage is full; Apple’s backup page says the phone shows an alert.
• End of support. When an iPhone no longer gets iOS updates, the ACSC describes replacing outdated devices or operating systems. Our guide to resetting an iPhone before selling or recycling it covers the old phone.
• Unexpected app permissions. The ACSC describes removing apps that ask for excessive or suspicious permissions.

Common questions

How do I make my iPhone more secure?

Apple’s and the ACSC’s guidance covers a handful of settings: automatic updates, a strong passcode, Stolen Device Protection, two-factor authentication for the Apple Account, iCloud Backup, Find My, and a review of app permissions. Several only work if they’re on before something goes wrong: Apple says Find My and Stolen Device Protection both need to be on before a device is lost or stolen. The steps start at how to turn on automatic updates.

What do I do if my iPhone is lost or stolen?

Find My can show a missing iPhone on a map, play a sound, lock it with Lost Mode or erase it, provided it was turned on beforehand. Apple says that otherwise the phone “won’t appear at icloud.com/find or in the Find My app”. Apple’s stolen-device page lists Lost Mode, reporting to local police and contacting the mobile carrier. The guide to locking and locating a lost iPhone covers the wider steps.

What does Stolen Device Protection do on my iPhone?

It’s aimed at someone who steals the phone and knows the passcode. Apple says that away from familiar places such as home or work, some sensitive actions need Face ID or Touch ID rather than the passcode, and some, such as changing the Apple Account password, also need a one-hour security delay. Apple says the delay may end early once the phone reaches a familiar location. See how to turn on Stolen Device Protection.

Is a six-digit passcode enough on my iPhone?

Official guidance doesn’t set a length. Apple’s default is six digits, and Apple also offers custom numeric and alphanumeric codes, which can be longer. Apple says setting a passcode turns on data protection, which encrypts the iPhone’s data. The ACSC’s mobile phone guidance describes locking a phone with “a passphrase, password, PIN or biometrics”, and says “simple patterns or your date of birth are too easy.” See how to set a strong passcode.

What happens if someone enters the wrong iPhone passcode too many times?

It depends on the Erase Data setting. Apple says that with Erase Data on, the iPhone erases itself after ten failed passcode attempts. With it off, Apple says the phone needs to be restored on a computer after ten failed attempts. Either way, a recent backup is what lets photos and messages come back afterwards, because a backup can only restore what was backed up. See how to back up with iCloud.

Does Find My work if my iPhone is off or offline?

Apple says the Find My network, “a crowd-sourced network of over a billion Apple devices that use Bluetooth technology”, can help locate a device while it’s offline. Send Last Location sends the phone’s location to Apple when the battery is low. Both are options under Settings > your name > Find My, and Apple says Location Services also needs to be on for Find My to show a lost device on a map. See how to turn on Find My.

Where to get official help

• Apple Support (support.apple.com) has the current steps for every iPhone setting.
• ASD’s ACSC publishes mobile phone guidance and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). Cybercrime can be reported through ReportCyber.

Related guides

• If your phone is lost or stolen
• Setting up a new phone
• How to secure your online accounts
• Passkeys explained
• An account recovery plan
• Backups for personal devices: the 3-2-1 approach
• Smartwatches and fitness trackers: the security basics