Harden your Android phone
You don’t need a new phone or a custom system to be far safer. Modern Android has strong protections built in - most of them switched off or tucked away. Half an hour in Settings closes most of the door, and your banking apps keep working. Paths below are for a recent Pixel; Samsung and others keep these in much the same places - if a name differs, search your Settings for it.
Keep it current - the single biggest one
In Settings → Security & privacy → System & updates, turn on automatic updates and install the monthly security update and any Google Play system update. Then open the Play Store, tap your profile, and check Play Protect is on - it scans apps for known malware. An up-to-date phone shrugs off most attacks, because nearly all of them rely on a bug that’s already been fixed.
Lock the front door properly
Use a PIN or password, not a pattern - patterns are easy to read over your shoulder. Six digits is the minimum; a short word-and-number password is better. Keep fingerprint or face unlock for convenience, but the PIN is what actually protects you when the phone is off or freshly restarted. Then hide notification contents on the lock screen: Settings → Notifications → Notifications on lock screen, and don’t show sensitive content. Set the screen to lock quickly.
Turn on theft protection
Android now has a proper kit for a stolen phone. In Settings → Security & privacy → Theft protection (on some phones it sits under Settings → Google → All services), turn on Theft Detection Lock (locks if the phone is snatched from your hand), Offline Device Lock and Remote Lock. Make sure Find Hub (previously Find My Device) is on, so you can locate, lock or wipe it remotely. This is what turns “someone stole my phone” from a crisis into a nuisance.
Take back app permissions
Settings → Security & privacy → Permission manager: go through Location, Camera, Microphone and Contacts. Most apps don’t need what they asked for. For location, give “while using” and turn off “precise” unless an app genuinely needs it, like maps. Turn on auto-reset of permissions for apps you don’t open, and delete the apps you’ve forgotten - those are the ones that quietly leak.
Cut the ad tracking
Settings → Security & privacy → Ads - delete your advertising ID. That one tap stops a lot of cross-app tracking. While you’re at it, a filtering DNS blocks many trackers and dodgy domains across the whole phone: Settings → Network & internet → Private DNS, and enter a filtering resolver (we list a couple on the Tools page). Small changes; a good deal less of you sold on.
Lock down the Google account - it is your phone
Whoever controls your Google account controls the phone: mail, photos, backups, the lot. Turn on two-step verification and prefer a passkey or an authenticator app over a text message. Run Google’s Security Checkup and remove old devices and app access you don’t recognise. Set a recovery method you actually control.
Google Security Checkup →If you want to go further
For higher risk, Android 16’s Advanced Protection flips every top setting on at once and stops them being switched off: Settings → Google → Advanced Protection. It’s excellent, but know the trade-offs - it blocks installing apps from outside the Play Store, drops 2G, and tightens Chrome. There’s also Private Space (Settings → Security & privacy → Private Space): a separate, locked, encrypted area for your most sensitive apps, hidden from the main phone. The power-user tier - a Pixel running GrapheneOS - is a bigger step we’ll cover on its own; just know some banking and streaming apps resist custom systems.
If you only do three
Update, a proper PIN with lock-screen notifications hidden, and theft protection with Find Hub. Those cover the three things that actually happen: the phone being out of date, being read over your shoulder, and being stolen.
Last reviewed: 12 October 2026.