How to Secure Your Phone: A Practical Checklist for Android and iPhone

May 30, 2026

A phone stopped being “a thing for calls” long ago. Today it’s the main vault of your life: chats, photos, banking apps, email, passwords, notes, location history, and access to almost every account through confirmation codes. If someone gains control of your smartphone, they gain control of you. So the question of how to secure your phone against hacking isn’t paranoia — it’s basic hygiene.

The good news: most threats are closed off by simple, free actions that take half an hour. This article is one big practical checklist for smartphone security on Android and iPhone. Walk through it once, repeat every few months, and most attacks will pass you by.

Why the phone is the prime target

Before tweaking anything, it helps to understand what you’re protecting and from whom.

It’s a keyring. SMS and push codes for logging into your bank, email, and social networks all land on your phone. With access to the phone, an attacker often gets access to everything else — through “password recovery.”
It’s always with you and always online. The phone is constantly connected, carries your location, and rarely powers off. That makes it an ideal target for both surveillance and theft.
It’s easy to lose. Smartphones get left in taxis, lost in cafés, snatched in crowds. Physical access is the most common threat, and it’s the one most people have no defence against.
It runs dozens of apps. Every app requests access to data, and every one is a potential leak channel — even without a hack.

The principle is the same as everywhere: defence in depth. No single step covers everything, but the layers together turn a breach from a disaster into a minor annoyance.

Step 1. Screen lock, biometrics, and PIN

This is the foundation. If the screen isn’t locked, nothing else matters: anyone can just pick your phone up off the table.

Turn on a screen lock. No “none,” and no pattern “swipes” — they’re easy to glance over your shoulder and reconstruct from finger smudges on the glass.
Use a 6-digit PIN, or better, a password. A four-digit PIN is brute-forced too fast. Six digits are an order of magnitude stronger, and an alphanumeric password is better still, especially as a “master lock” layered over biometrics.
Enable biometrics (fingerprint or face). It’s both convenient and secure: you don’t type a PIN in public where it can be observed. Biometrics complement the PIN rather than replace it — the system still asks for the code periodically.
Shorten auto-lock time. Set 30 seconds or a minute. The longer the screen stays unlocked, the bigger the window for someone else’s hands.
Hide notification contents on the lock screen. Otherwise SMS codes and message text are visible to anyone who picks up the phone, without even unlocking it.
On iPhone, disable lock-screen access to extras (Wallet, Reply with Message, Control Center); on Android, confirm that payments and settings are unavailable without unlocking.

Separately: set a dedicated PIN for the SIM card. Then, if the phone is stolen, the thief can’t move your SIM into another handset and receive your confirmation codes.

Step 2. OS and app updates

Most mass breaches exploit long-known vulnerabilities that victims simply never updated. An update isn’t “new icons” — it’s closed holes in security.

Update the operating system. As soon as an iOS or Android update appears, install it. Vendors patch critical vulnerabilities in them, including the kind that can compromise a phone with no clicks at all.
Enable automatic app updates. The App Store and Google Play both have an auto-update toggle. Turn it on, ideally over Wi-Fi.
Delete what you don’t use. Every installed app is attack surface. An old, abandoned app that no longer gets updates is best removed.
Don’t use a phone with an outdated OS forever. If the vendor has stopped shipping security updates for your model, that’s a signal to consider replacing it — especially if the phone holds your bank and email.
Install apps only from official stores. Sideloaded APKs and “cracked” versions are a common source of malware. On iPhone, don’t jailbreak; on Android, keep installation from unknown sources turned off.

Step 3. App permissions: what to turn off

Apps request far more access than they actually need. A flashlight doesn’t need your contacts, a game doesn’t need the microphone, and a calculator doesn’t need your location. Every extra permission is data the app can collect and transmit.

Open your privacy settings (on Android: Privacy → Permission manager; on iPhone: Settings → Privacy & Security) and go through the categories:

Location. Most apps don’t need it at all. For those that do (maps, taxis), grant “while using the app,” not “always.” Reserve precise location only where it truly matters.
Microphone and camera. These should be on only for messengers, the camera, and calling apps. If an app that has no use for the mic still has access, revoke it.
Contacts. Many apps ask for contacts so they can upload them to their servers. Grant access only if you genuinely need the feature.
Photos. Modern systems let you grant access not to the whole gallery but to a few selected photos. Use that instead of access to the entire album.
Background activity and tracking. On iPhone, turn off “Allow Apps to Request to Track.” On Android, restrict background data for apps that don’t need it.

The rule is simple: if it’s unclear why an app needs a permission, turn it off. If something stops working, the system will ask for access again.

Step 4. Two-factor authentication on your accounts

A password can leak. Two-factor authentication (2FA) is a second lock: even with the password, no one gets into the account without the second factor. It’s arguably the most useful thing you can do for security in ten minutes.

Enable 2FA first where it’s critical: email (it recovers all your other accounts), your bank, your Apple/Google account, messengers, and social networks.
Prefer authenticator apps over SMS. SMS codes can be intercepted via SIM-swap or rerouting. A code-generator app on the phone is more reliable.
Save your backup codes. When you enable 2FA, the service gives you a list of one-time codes for when you lose your phone. Write them down and store them separately — otherwise losing your phone locks you out of yourself.
Consider a hardware key for your most important accounts. A physical token is the most hack-resistant second factor.

Protecting email matters most of all: whoever gets into your inbox can reset passwords to almost everything else. Start there.

Step 5. Strong, unique passwords and a manager

Reusing the same password across services is a leading cause of breaches. A leak from one site hands an attacker every account where you reused that password. And no human can remember dozens of unique, complex passwords — which is exactly why you need a password manager.

Install a password manager. It generates and stores unique, complex passwords, and you only have to remember one master password. On your phone it auto-fills logins into apps and the browser.
Make every password unique. At least for key services: email, bank, main social accounts. One service, one password.
Check whether your passwords have leaked. Find out if your password has appeared in known breaches with the free Password Breach Check. If it has, change it everywhere you used it, immediately.
Rate a new password’s strength. Before you set a password, test it with the Password Strength Check — it shows how quickly it could be cracked.
Length beats “complexity.” A passphrase of several unrelated words is both stronger and easier to remember than a short jumble of special characters.

Step 6. Public Wi-Fi and VPN

In a café, airport, hotel, or on the subway, free Wi-Fi is convenient — but it’s someone else’s network that you don’t control. On an open network your traffic can be seen by outsiders, and a malicious hotspot is nearly impossible to spot by eye.

Traffic interception. On an unencrypted network, a skilled neighbour can capture unprotected data.
Fake access points. An attacker stands up a network named something like “Free_Airport_WiFi.” You connect, and all your traffic flows through their device.
Page tampering. Through a network they control, they push fake login pages to steal passwords.

Modern sites use HTTPS, which helps but doesn’t close everything: DNS queries and site addresses are still visible, and old apps may transmit data without proper protection. The fix is a VPN: it builds an encrypted tunnel from your phone to a server, so neither a Wi-Fi neighbour nor the network owner sees your traffic — only the fact that you’re connected to a VPN.

Simple rules on a public network: turn the VPN on before you open email or banking; don’t disable it “for a second”; use a kill switch so traffic doesn’t escape into the open network if the tunnel drops. More on this in Why You Need a VPN on Public Wi-Fi.

Step 7. Anti-phishing: don’t click the links

Most hacks don’t start with sophisticated hacker wizardry — they start with one link you clicked yourself. Phishing is fake messages disguised as your bank, a delivery service, a government agency, or an acquaintance, designed to make you enter a password or a code.

Don’t follow links in unexpected messages. An SMS saying “your parcel is delayed, tap the link,” an email “confirm your bank login,” a message from the “security team” — all classic phishing. Open the site or app manually, not through the link.
Never read out SMS codes to anyone. No bank, support line, or “employee” ever asks you to read out a confirmation code. Whoever asks for the code is a scammer.
Check the sender’s address and the domain. Fake sites use lookalike but not genuine addresses. One extra character or a different zone, and it’s not your bank.
Don’t install apps at “support’s” request. Remote-access software installed on someone else’s say-so gives a scammer full control of your phone.
Be suspicious of urgency. Phishing leans on emotion: “urgent,” “your account will be frozen,” “10 minutes left.” Haste is the scammer’s main tool. Stop and verify.

Step 8. Backup and “Find My”

If your phone breaks, gets lost, or is stolen, backup and the find feature decide whether you lose your data forever and whether you can defend yourself remotely.

Turn on a cloud backup. On iPhone, an iCloud backup; on Android, Google backup. It saves photos, contacts, and chats through any mishap with the device.
Verify the backup actually runs. Open settings and confirm the last backup date is recent. A backup that doesn’t exist won’t help.
Enable “Find My phone.” Find My on iPhone and Find My Device on Android let you see the phone on a map remotely, lock it, and, if needed, wipe its data.
Encrypt important local data. Modern iPhones and Androids encrypt storage by default when a screen lock is set — one more reason not to disable the PIN.

Step 9. Loss or theft: what to do

If the phone does go missing, act in order and act fast — every minute counts.

Open “Find My phone” from another device (a computer, or a loved one’s phone) and put the device into lost mode: it locks and shows a message on screen with a contact for its return.
Block the SIM card. Call your carrier and suspend the number so the thief can’t receive your confirmation codes or make calls from your number.
Change the passwords of key accounts — email, bank, and your Apple/Google account first. Do this from a device you know is clean.
Sign out of accounts on the lost device remotely — you can do this in the security settings of your Apple ID and Google account.
If you can’t get the phone back, wipe it remotely. Better to lose the data on the device (you have a backup) than to leave it with the thief.
Notify your bank and watch your accounts if the phone held payment apps.

Printable smartphone security checklist

Print this out and walk through each item.

Device access

Screen lock enabled (6-digit PIN or password).
Biometrics enabled (fingerprint / face).
Auto-lock after 30–60 seconds.
Notification contents hidden on the lock screen.
A separate PIN set on the SIM card.

Updates 6. Operating system updated. 7. Automatic app updates enabled. 8. Unused apps deleted. 9. Apps installed only from official stores.

Permissions and accounts 10. App permissions reviewed, extras turned off. 11. Location set to “while using.” 12. 2FA enabled on email, bank, and Apple/Google. 13. An authenticator app used instead of SMS. 14. 2FA backup codes saved separately.

Passwords 15. A password manager installed. 16. Passwords unique for key services. 17. Passwords checked against breaches.

Network and behavior 18. A VPN with a kill switch is turned on for public Wi-Fi. 19. Links in unexpected messages are not clicked. 20. SMS codes are never read out to anyone.

Recovery 21. Cloud backup enabled and recent. 22. “Find My phone” enabled. 23. You know how to remotely lock and wipe the device.

How GANVAS helps on Wi-Fi

Several items on this checklist are about the network, and a VPN is what closes them. When you’re on someone else’s Wi-Fi, GANVAS VPN does two main things: it encrypts all of your phone’s traffic, so neither a network neighbour nor the hotspot owner can see what you’re opening, and it hides your real IP — sites see the VPN server’s address, not yours.

It’s important that the VPN doesn’t “leak”: a DNS leak can expose your sites even with the tunnel on. GANVAS routes DNS inside the tunnel and provides a kill switch that instantly blocks traffic if the connection drops, so not a single packet escapes into the open network. The modern VLESS + Reality protocol helps your traffic stay indistinguishable from ordinary HTTPS — which matters where networks are filtered.

To assess the overall picture of your privacy — whether your real IP is visible, whether there are leaks — use the free Privacy Score tool.

The bottom line

Smartphone security isn’t one heroic sprint — it’s a set of simple habits: a locked screen, fresh updates, revoked excess permissions, 2FA on your main accounts, unique passwords in a manager, a VPN on networks you don’t own, and a healthy suspicion of links. Walk through the checklist once, repeat every few months, and protecting your phone from hacking stops being a problem.

If you want to start without paying, check out the free VPN. And to protect not just your phone but your whole home network, see the guide How to Secure Your Home Network.