Start here if you’re in immediate danger
If you suspect someone is currently monitoring you and could react badly to changes on your phone, stop and read Safety first before touching anything below. Locking down your iPhone is the fast version of this guide — a Safety Check walkthrough built for exactly that situation, and it’s the better starting point if you need answers in the next ten minutes.
This guide is the full picture, verified against Apple’s current documentation, for when you have time to do it properly. It’s organized so you can jump to any section — baseline device security, your Apple Account, what’s stored in iCloud, device-level protections, and the extreme option almost nobody needs.
Baseline: passcode, Face ID, updates, backups
A real passcode. A four-digit code has ten thousand possible combinations; a six-digit numeric code has a million. Apple’s passcode settings also offer a Custom Alphanumeric Code and Custom Numeric Code, which it lists as “the most secure options” (Apple Support). Set or change yours at Settings → Face ID & Passcode → Change Passcode, then tap Passcode Options to pick a longer or alphanumeric code (Apple Support). While you’re there, you’ll also see Erase Data, which wipes the device after ten failed passcode attempts if you turn it on (Apple Support). Think before you enable it: it’s a real safeguard against someone trying to brute-force their way in, but it’s also irreversible and indiscriminate — a curious child, a butt-dial, or your own mistyped attempts can trigger it just as easily as an attacker, and if the phone holds evidence you might need later, a wipe destroys it along with everything else. This one is optional, and it’s worth deciding deliberately rather than turning on by default.
Apple still requires the passcode itself, not Face ID or Touch ID, right after the phone restarts, after 48 hours without an unlock, after 6.5 days without a passcode unlock combined with 4 hours without Face ID or Touch ID, after a remote lock command, or after five failed Face ID or Touch ID attempts (Apple Support). That explains why the phone sometimes demands a passcode instead of your face.
Face ID. Set it up at Settings → Face ID & Passcode → Set Up Face ID, and you can control exactly what it’s allowed to unlock — iPhone Unlock, Apple Pay, Password AutoFill, and specific third-party apps under Other Apps — from the same screen (Apple Support). If you’d rather it not unlock the phone just because someone holds it up to your face while you’re not paying attention, turn on Require Attention for Face ID at Settings → Accessibility → Face ID & Attention — it’s on by default unless VoiceOver was enabled during setup (Apple Support).
Software updates. Apple has said plainly that “keeping your software up to date is one of the most important things you can do to maintain your Apple product’s security” (Apple Support). Check for updates at Settings → General → Software Update, and set up automatic installation at Settings → General → Software Update → Automatic Updates (Apple Support). Back up before you update — Apple recommends it as the first step (Apple Support).
Backups. Turn on iCloud backup at Settings → [your name] → iCloud → iCloud Backup → Back Up This iPhone; once on, your iPhone backs up automatically once a day while charging, locked, and on Wi-Fi, and you can trigger one manually with Back Up Now (Apple Support). A current backup mainly protects you against loss or damage — it lets you restore your information to a new or erased iPhone. Keep in mind that restoring from a backup also restores whatever was on the phone when it was made, including an app or setting you were trying to get rid of — a factory reset only helps if you set the phone up as new afterward instead of restoring the old backup. See what a factory reset does and doesn’t do before you rely on either one, since no backup or reset can promise a phone is completely clean of every possible risk.
Account layer: the Apple Account is the real target
Whoever controls your Apple Account password can often reach far more than whoever has your device passcode — photos, backups, Find My, and more, depending on what’s turned on. This layer deserves as much attention as the phone itself. For phishing, sign-in alerts, and what an attacker who already has your password can see, if someone gets into your iCloud goes deeper than this section does.
Two-factor authentication. This is the default for most accounts and it’s worth confirming it’s on: Settings → [your name] → Sign-In & Security. With it on, signing in on a new device or browser requires your password plus a six-digit code sent to a trusted device or trusted phone number (Apple Support).
Trusted phone numbers and devices. A trusted phone number is where Apple sends that verification code; a trusted device is an iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac already signed in with two-factor authentication turned on (Apple Support). Review and add numbers at Settings → [your name] → Sign-In & Security → Two-Factor Authentication → Add a Trusted Phone Number. Apple suggests considering at least one trusted number that isn’t tied to the iPhone you’re securing, since a phone that’s lost, damaged, or taken is otherwise your only way to receive codes (Apple Support). If a number on that list belongs to someone you no longer trust, remove it here or at account.apple.com.
Recovery contact vs. recovery key — pick one, understand the trade-off. These solve the same problem (getting back into your account if you’re locked out) in very different ways.
- A recovery contact is a person you trust — a family member or close friend with an Apple device — who can get you a six-digit recovery code over the phone or in person when you’re locked out (Apple Support). Set one up at Settings → [your name] → Sign-In & Security → Recovery Contacts → Add Recovery Contact. You can add up to five (Apple Support), and they don’t get standing access to your account or data — they only generate a code when you ask them to.
- A recovery key is a secret 28-character code you generate, print or write down, and store somewhere safe — no other person involved (Apple Support). Turning it on replaces Apple’s standard account-recovery process: if you lose the key and don’t have a trusted device, Apple states you’ll be “locked out of your account permanently” (Apple Support). Set it up at Settings → [your name] → Sign-In & Security → Recovery Key.
The trade-off is blunt: a recovery contact means a trusted person can help you back in, but that person has some role in your account security. A recovery key removes any other person from the loop entirely, but there is no safety net if you lose it — not even Apple can override it (Apple Support). If you turn on Advanced Data Protection below, you’re required to have at least one of the two, because Apple can no longer help recover end-to-end encrypted data any other way (Apple Support).
Legacy contact. A different problem entirely — this is about what happens to your Apple Account after you die, not about locking yourself out. A Legacy Contact you choose can request access to your account’s data using a QR-code access key you generate and share with them in advance, plus a death certificate (Apple Support). Set it up at Settings → [your name] → Sign-In & Security → Legacy Contact → Add Legacy Contact. Apple notes the access key doesn’t include what’s needed to decrypt iCloud Keychain, so access is narrower than full account control (Apple Support, Platform Security Guide). It’s worth knowing mainly because it’s easy to confuse with a recovery contact — they live in the same menu and solve completely different problems.
Data layer: iCloud, Advanced Data Protection, and permissions
Advanced Data Protection. By default, iCloud already encrypts your data in transit and at rest, but Apple holds the keys for many categories so it can help you recover data if you’re ever locked out. Advanced Data Protection changes that: it raises the number of end-to-end encrypted iCloud data categories from 14 to 23, covering things like device backups, Photos, and Notes, so that only your own trusted devices — not Apple — hold the keys (Apple Support, Platform Security Guide). Turn it on at Settings → [your name] → iCloud → Advanced Data Protection.
The recovery risk is the direct cost of the extra security: because Apple no longer holds the keys, Apple states that if your recovery methods — recovery contact or recovery key — fail or you forget them, “Apple can’t help recover the user’s end-to-end encrypted iCloud data” (Apple Support, Platform Security Guide). That’s why setting up a recovery contact or recovery key beforehand is a requirement, not an option, for turning this on. One more detail worth knowing: turning on Advanced Data Protection automatically turns off web access to your data at iCloud.com, because Apple’s web servers no longer have the keys to decrypt it — you can turn web access back on, but each visit then requires authorizing it from one of your trusted devices (Apple Support, Platform Security Guide). iCloud Calendar, Contacts, and Mail stay outside end-to-end encryption even with this on, because they need to interoperate with the wider email and calendar ecosystem (same source).
App Privacy Report. This shows how often the apps on your phone have actually used the permissions you granted them — location, camera, microphone, and more — over the past seven days, plus which web domains your apps and in-app browsing have contacted most (Apple Support). Turn it on at Settings → Privacy & Security → App Privacy Report → Turn on App Privacy Report. It only starts collecting data from the moment you enable it, and the data is stored encrypted, on-device only (Apple Support). If something in the report looks off — an app hitting your microphone at odd hours, unexpected network contacts — that’s your cue to revoke the permission or dig into what app permissions actually mean.
A full permission audit. Beyond the report, go category by category: Settings → Privacy & Security, then tap through Location Services, Contacts, Photos, Microphone, Camera, Bluetooth, and the rest. Each shows every app that has requested that type of access, and you can turn any of them off (Apple Support). Our guide on what app permissions actually mean covers which ones are worth prioritizing if you’re short on time.
Tracking. Separate from the permission list above, Settings → Privacy & Security → Tracking controls whether apps can ask to track your activity across other companies’ apps and websites for advertising or data-broker purposes (Apple Support). Turning off Allow Apps to Request to Track at the top of that screen means you’ll stop getting the prompts altogether, and every app is treated as if you’d tapped “Ask App Not to Track” (Apple Support). This setting can be greyed out under a few conditions Apple lists explicitly: child or under-18 accounts, accounts managed by a school or employer, a managed device with a restrictive configuration profile, or an account created in the last three days (Apple Support). If yours won’t toggle and none of those apply to you, a management profile is worth checking — see the device layer below.
Device layer: Stolen Device Protection, Find My, and profile checks
Stolen Device Protection. This is aimed at physical theft by someone who has watched you enter your passcode, not remote monitoring — but it matters anywhere a device passcode alone shouldn’t be enough. When it’s on, away from places iOS recognizes as familiar (like home or work), certain actions require Face ID or Touch ID with no passcode fallback — viewing saved passwords, for instance — and other actions require a Face ID or Touch ID check, a one-hour wait, and a second check: changing your Apple Account password, signing out of your Apple Account, updating Apple Account security settings, adding or removing Face ID or Touch ID, changing your iPhone passcode, using Reset All Settings, enrolling in Mobile Device Management, and turning off Stolen Device Protection itself (Apple Support). Turning off Find My isn’t on that list — it’s not possible at all while Stolen Device Protection is on (more below). Apple’s stated purpose for the delay: giving you time to mark the device lost and secure your account before a thief can act (Apple Support).
Turn it on at Settings → Face ID & Passcode → Stolen Device Protection, which requires two-factor authentication, and having a device passcode, Face ID or Touch ID, Significant Locations, and Find My already set up (Apple Support). If home isn’t reliably safe, choose Always under Require Security Delay on that same screen so the protections apply everywhere, not just away from familiar locations (Apple Support). One consequence worth knowing before you rely on it: Find My can’t be turned off at all while this feature is enabled (Apple Support).
Find My. Turn it on at Settings → [your name] → Find My → Find My iPhone, and enable Find My network so the device is locatable even offline, using nearby Apple devices anonymously (Apple Support). This is also where to review who can see you, though not in Settings itself: open the Find My app and tap People at the bottom of the screen to see who you’re sharing your location with, tap a name, then Stop Sharing My Location to stop (Apple Support). For the full walkthrough on auditing and revoking Find My sharing, along with the Family Sharing nuances that complicate it, see locking down your iPhone.
Check for a configuration profile. A profile or Mobile Device Management (MDM) enrollment can quietly extend control over the device — usually legitimate (a school or employer), sometimes not. Check at Settings → General → VPN & Device Management; nothing listed means no profile is installed (Apple Support). If something is there that you don’t recognize or didn’t knowingly install, our dedicated guide on configuration profiles and MDM covers what it can and can’t actually see, and how to safely remove one.
Extreme layer: Lockdown Mode
Lockdown Mode comes up often in tracking-related searches, so it’s worth being precise about who it’s for. Apple describes it as “an optional, extreme protection” built for “the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats” — and adds that “most people are never targeted by attacks of this nature” (Apple Support). Journalists, human rights workers, and dignitaries facing state-sponsored mercenary spyware are the intended audience, not someone worried about a partner, ex, or family member with access to their passcode.
Turning it on changes how the phone works day to day. Apple’s own list of what breaks: most message attachment types are blocked except certain images, video, and audio, and link previews disappear; complex web technologies are blocked, which can slow some sites or break them outright, and web fonts may not display; FaceTime calls are blocked from anyone you haven’t called in the past 30 days; shared photo albums are removed from the Photos app and new invitations are blocked; the device won’t auto-join insecure Wi-Fi networks; and — notably — new configuration profiles can’t be installed and the device can’t be enrolled in Mobile Device Management while it’s on (Apple Support). Phone calls, plain text messages, and emergency features like SOS keep working normally (same source).
Turn it on at Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, and it prompts you to enable it on your other Apple devices too (Apple Support). If a partner, family member, or anyone with physical access or shared passwords is the actual concern, everything earlier in this guide — Stolen Device Protection, the Apple Account layer, Find My, the permission audit — will do more for you day to day than Lockdown Mode, without breaking how you use the phone.
Putting it together
None of these layers substitutes for another. A strong passcode doesn’t help if the Apple Account password is weak and reused; a locked-down Apple Account doesn’t stop someone who already knows your device passcode and has it in hand. Work through them in order — passcode and updates first, then the account, then iCloud and permissions, then the device-specific protections — and treat Lockdown Mode as the answer to a different, much rarer question. None of this tells you whether something is already installed and watching.