iPhone security checklist: ten steps in order of what matters

The ten minutes that matter most

1. Keep iOS up to date

Updates fix security flaws, often ones already being used. In Settings > General > Software Update, turn on Automatic Updates and Automatically Install, as Apple’s update page shows. The phone then updates overnight while charging.

2. Use a real passcode

Six digits is the minimum worth having; a longer code is better. In Settings > Face ID & Passcode, tap Change Passcode, then Passcode Options for a longer numeric or alphanumeric code (Apple Support). Avoid birthdays, years and patterns like 123456.

3. Check two-factor sign-in

In Settings, tap your name, then Sign-In & Security, and make sure two-factor authentication is on and the trusted phone numbers are yours (Apple Support). The two-factor guide covers security keys too.

4. Turn on Stolen Device Protection

Away from familiar places, this asks for Face ID or Touch ID, with no passcode fallback, before some sensitive actions, and adds a delay to changes such as your account password. Find it in Settings > Face ID & Passcode > Stolen Device Protection (Apple Support). It matters most against someone who watched you type your code. More in the Stolen Device Protection guide.

5. Shorten Auto-Lock

In Settings > Display & Brightness > Auto-Lock, pick the shortest time you can live with. A phone left on a table locks itself before anyone picks it up.

The next twenty minutes

6. Add a recovery contact

A person who can give you a code if you are locked out of your Apple Account. In Settings, tap your name, then Sign-In & Security > Recovery Contacts (Apple Support). See the recovery contact guide.

7. Review app access

Go through Settings > Privacy & Security and look at Photos, Location Services, Camera and Microphone. Remove access from apps that don’t need it, and choose limited photo access where you can. The guide to which apps can see your photos walks through it.

8. Learn the signs of phishing

Apple says it never asks for your password or a verification code to provide support (Apple Support). A message that asks for either is fake. The phishing guide has the signs.

9. Back up, and check it

Turn on a backup and make sure it has finished recently. A phone that is lost with no backup takes its photos with it.

10. Put sensitive things behind a second lock

Scans of IDs, medical letters and private photos don’t need to sit in the main photo grid, where anyone holding your unlocked phone can scroll to them. Use a locked album, locked notes or a vault app with its own passcode. The photo privacy settings guide lists the built-in options.

If you only do three

Updates, a six-digit passcode and two-factor sign-in. Those three close the most common doors. For people at higher risk, the guide to the strictest mode is the next step beyond this list.

Where Sealed helps, and where it doesn’t

It helps with step 10: a vault with its own passcode that locks when you leave it. Sealed has a passcode of its own, a gate inside the app that is separate from your iPhone passcode. Sealed locks as soon as you leave it unless you choose a delay, and it covers its contents in the app switcher.

It helps with step 9 for what’s inside it. Encrypted iCloud backup is free. Files, names, notes and record fields are encrypted on your iPhone before they are uploaded, so iCloud receives only ciphertext.

It helps you run the same kind of check on the vault itself. The Security Checkup looks at your recovery key, iCloud Backup, passcode, Auto-Lock, break-in alerts, decoy vault, extra ways back and the originals still in Photos.

It doesn’t do any of steps 1 to 8 for you. Those are your phone’s and your account’s own settings. Sealed has no account, so there is nothing to sign up for.