WhatsApp Security Guide
A complete step-by-step guide to protect your WhatsApp account, secure your data, and stay safe from digital threats.
Introduction video
WhatsApp Security Guide · Introduction
1. Two-Step Verification
Two-step verification adds a six-digit PIN to your WhatsApp account. Anyone trying to register your number on a new phone must enter this PIN first. This extra barrier blocks the most common account-takeover and SIM-swap attempts.
Benefits
- Makes account takeover far harder for an attacker.
- Keeps your account safe even if your SIM is stolen.
- Stops anyone logging in with just a stolen SMS code.
- Provides an extra layer of protection.
Why it's important
- Reduces the risk of account takeover.
- Narrows the path for SIM swap fraud.
- Adds strong security to your account.
- Keeps your personal chats and data safe.
Risks if not enabled
- Anyone can register your number on another phone.
- Your account can be hacked easily.
- All chats and media can be read.
- You can lose access to your account permanently.
Expert Recommendation
Enable two-step verification immediately. Choose a strong PIN that you can remember but others cannot guess. Add your email address so the PIN can be recovered, and never share your PIN with anyone.
Screenshots
2. Passkey
A passkey lets you log in with your fingerprint, Face ID or phone PIN instead of an SMS code. It is the newer and safer way to sign in to WhatsApp. Because no code travels over the network, there is no SMS code for an attacker to intercept or redirect.
Benefits
- More secure than SMS verification.
- Reduces your exposure to SIM swap attacks.
- Makes logging in faster and easier.
- No waiting for a code to arrive.
Why it's important
- SMS codes can be intercepted or redirected.
- Your login stays tied to your own device.
- Removes your dependence on network codes.
- Works alongside two-step verification.
Risks if not enabled
- Your account keeps relying on SMS verification.
- An SMS code can be stolen through a SIM swap.
- Account recovery stays comparatively less secure.
- Every login depends on network coverage.
Expert Recommendation
Create a passkey and keep two-step verification switched on as well. Used together, they give you the strongest protection WhatsApp offers. Set the passkey up on the phone you use every day, never on a shared device.
Screenshots
3. Disable Auto Media Download
By default WhatsApp saves every photo, video and file to your phone automatically, even when it arrives from an unknown number. Turning auto-download off puts that decision back in your hands. You then tap only the files you actually trust.
Benefits
- You choose which files reach your phone.
- Harmful media never saves on its own.
- Your storage stays free of unwanted files.
- Mobile data is not spent in the background.
Why it's important
- Unknown numbers can send files straight to you.
- You decide what is downloaded, not the sender.
- Fewer files on the phone means less to go wrong.
- It is the simplest defence against file attacks.
Risks if not enabled
- Malware can hide inside a harmless-looking photo.
- Harmful videos and risky documents save silently.
- Your storage fills up with files you never wanted.
- Mobile data is drained without your consent.
Expert Recommendation
Set Photos, Audio, Videos and Documents to never auto-download. Open a file only when you know the sender and were expecting it. If the sender is unknown, it is safer not to download the file at all.
Screenshots
4. Chat Lock
Chat Lock hides a chosen conversation behind your fingerprint or Face ID. Locked chats move into a separate private folder of their own. Even if someone picks up your unlocked phone, those chats stay closed.
Benefits
- Nobody else can open or read your private chats.
- Personal conversations get much better privacy.
- Notifications hide both the name and the message.
- Locked chats sit in their own separate folder.
Why it's important
- Phones are handed to family, friends and repair shops.
- One glance at an open chat can leak a great deal.
- Sensitive conversations deserve a second lock.
- It protects only what you choose, not the whole app.
Risks if not enabled
- Anyone holding your phone can read private chats.
- Notification previews reveal names and messages.
- Sensitive conversations sit in the main chat list.
- A moment of shoulder surfing is enough to expose them.
Expert Recommendation
Lock the chats that carry personal, financial or work information. To reach them, pull the chat list downwards and unlock with your fingerprint or Face ID. Keep the folder hidden so it never appears in your main list.
Screenshots
5. Screen Lock
Screen Lock asks for your fingerprint, Face ID or phone passcode every time you open WhatsApp. It locks the whole app rather than a single chat. Your phone lock stays in place, and this simply adds a stronger layer above it.
Benefits
- Every one of your chats is protected at once.
- Nobody can open WhatsApp without you.
- It adds a strong layer above your phone lock.
- Setting it up takes less than a minute.
Why it's important
- An unlocked phone should not mean an open WhatsApp.
- It covers every chat, not only the ones you locked.
- A borrowed phone is the most common leak.
- A lost phone stays useless to whoever finds it.
Risks if not enabled
- Anyone who unlocks your phone reads everything.
- A lost phone exposes your full chat history.
- Someone can reply to messages as if they were you.
- Your media and documents are open to anyone nearby.
Expert Recommendation
Turn Screen Lock on and choose Immediately so the app locks the moment you close it. Use the same biometric you already trust on your phone. Avoid longer delays, because that gap is exactly what an intruder needs.
Screenshots
6. Turn Off Link Preview
When you paste a link, WhatsApp shows a small image and title as a preview. To build that preview your phone must first contact the website, which reveals your IP address to it. Turning previews off means that connection no longer happens on its own.
Benefits
- Unknown websites are not contacted on your behalf.
- Nothing loads before you have chosen to trust it.
- Less information about your device reaches the site.
- You keep more control over every link.
Why it's important
- Building a preview hands the site your IP address.
- Content loads before you have judged the sender.
- Attackers can learn that their link was delivered.
- Keeping previews off leaves the choice with you.
Risks if not enabled
- A preview reveals your IP address to the site.
- Unknown sites load content without your consent.
- A normal-looking link can lead somewhere harmful.
- Curiosity turns into a tap before you have thought.
Expert Recommendation
Turn link previews off and treat every unknown link with care. Never tap a link from a stranger in a hurry, and confirm with the sender if anything looks unusual. A link that looks ordinary can still lead to a fake or harmful site.
Screenshots
7. Privacy Settings
These settings decide who can see your personal information on WhatsApp. Reviewing them once is enough to keep you safer every day. The recommended choices use the same labels WhatsApp shows on screen.
Benefits
- Strangers cannot track when you are online.
- Scammers cannot copy your profile photo.
- Spam and fraud calls are silenced automatically.
- Nobody can add you to a group without permission.
Why it's important
- Last Seen tells strangers exactly when you are active.
- A copied photo is enough to impersonate you.
- Unknown callers begin most scam attempts.
- Group invites are a common way to reach victims.
Risks if not enabled
- Anyone can watch your online and offline times.
- Your photo and About text are open to strangers.
- Unknown numbers can call you at any hour.
- You can be pulled into groups run by scammers.
Expert Recommendation
Open Settings → Privacy and run Privacy Checkup to review everything in one place. Set Last Seen & Online to Nobody or My Contacts, and Profile Photo, About, Status and Groups to My Contacts. Turn Silence Unknown Callers on, and share Live Location only when it is genuinely needed. If you want the strictest lockdown, Strict Account Settings under Privacy → Advanced applies all of this at once, though it does limit some of what the app can do.
Step-by-Step Guide
8. Encrypted Backup
Your chats are protected on the way from one phone to another, but a backup stored in Google Drive or iCloud is not end-to-end encrypted until you enable End-to-End Encrypted Backup. That setting locks the backup with a password, a 64-digit key or a passkey that only you hold. Without it, the backup becomes the weakest point in an otherwise encrypted chat.
Benefits
- Your backup is locked with a key only you hold.
- Cloud copies get the same protection as your chats.
- A breached cloud account no longer exposes old chats.
- Restoring still works normally on a new phone.
Why it's important
- Cloud backups sit outside that protection by default.
- Old backups often hold more than recent chats.
- A cloud password is easier to steal than a phone.
- It is a one-time setting with lasting effect.
Risks if not enabled
- A cloud backup is less secure than your live chats.
- Anyone reaching your cloud account can read old chats.
- A leaked cloud password exposes years of messages.
- Your media and documents miss this extra layer.
Expert Recommendation
Turn End-to-End Encrypted Backup on. If you're offered the passkey option, take it. Your fingerprint or Face ID then unlocks the backup, and there's no 64-digit key to remember. If you pick a password or key instead, write it somewhere safe and offline, not in the same cloud account. If you lose it, not even WhatsApp can restore the backup for you.
Screenshots
9. Linked Devices
WhatsApp can run on computers and other devices alongside your phone. Sometimes an old laptop stays logged in, and sometimes an attacker links a device quietly. Checking this list keeps only your own devices connected.
Benefits
- Only your own devices stay connected.
- An old laptop session is closed for good.
- You spot a quiet intruder within seconds.
- The whole check takes under a minute.
Why it's important
- A linked device reads every message you receive.
- Old sessions stay active long after you forget them.
- Attackers link a device and then stay silent.
- Only this list shows who else is connected.
Risks if not enabled
- A stranger can read your chats in real time.
- An abandoned laptop session stays open to anyone.
- Messages can be sent from a device you never see.
- The intrusion can continue unnoticed for months.
Expert Recommendation
Open Linked devices and log out anything you do not recognise, then change your two-step verification PIN. Never scan a QR code or enter a device-linking code that you didn't start yourself. A website offering a prize, a task or a vote is the usual cover for hijacking an account this way. Log out of any device you no longer use, even your own, and repeat this check every few weeks.
Screenshots
10. Never Share Verification Codes
Most accounts are stolen the moment someone is tricked into forwarding a code. WhatsApp never asks for your SMS code, your verification code, your two-step PIN, your passkey or a device-linking code. Keep this rule ahead of every other setting in this guide.
Benefits
- Your account cannot be taken over by a shared code.
- You recognise the request as a scam immediately.
- No setting is needed, only the habit.
- It protects you on every phone you ever use.
Why it's important
- A code is the only key to registering your number.
- Real WhatsApp staff never ask you for it.
- Scammers pose as friends, relatives and support.
- One shared code is enough to lose the account.
Risks if not enabled
- The sender registers your number within seconds.
- You lose access to your own account.
- Your contacts are then targeted from your number.
- Recovery can take days, or fail completely.
Expert Recommendation
Never send your code to anyone: not a friend, not a relative, not "WhatsApp Support" and not an official. A common trick is a message claiming a code was sent to you by mistake, but that code is always yours. Anyone who asks for it is trying to steal your account.
Step-by-Step Guide
11. Recognise Scam Messages
Scammers use fear, greed and urgency to push you into acting at once. Once you recognise the usual phrases, you stay calm and safe. Lines like "you have won a prize", "your account closes today" and "payment is required immediately" all follow the same pattern.
Benefits
- You recognise a scam from its first line.
- Urgency stops working on you.
- Reporting helps WhatsApp act against the account.
- Blocking ends the contact for good.
Why it's important
- Scam messages arrive far more often than real attacks.
- Fear and hurry defeat even careful people.
- The same few phrases appear again and again.
- Reporting protects other people as well.
Risks if not enabled
- A single tap can hand over your account.
- Fake prize links collect your personal details.
- Urgent payment demands lead to real money lost.
- Silence lets the scammer reach your contacts next.
Expert Recommendation
Never tap unknown or shortened links, and verify the sender from a number you already trust. Don't rush, because genuine organisations never force a decision within seconds. Report and block anything that feels suspicious.
Step-by-Step Guide
12. Keep WhatsApp Updated
Each update makes WhatsApp safer than the version before it. Older versions can carry weaknesses that attackers are already aware of. Keeping the app current closes those gaps for you automatically.
Benefits
- Important security fixes reach you first.
- Bug fixes keep the app running smoothly.
- New protective features arrive as they are released.
- Your privacy protection keeps improving.
Why it's important
- Known weaknesses are the easiest ones to attack.
- Old versions stop receiving security fixes.
- Automatic updates remove the need to remember.
- Official stores are the only safe source.
Risks if not enabled
- Attackers exploit known flaws in old versions.
- Missing fixes leave your chats exposed.
- New protections never reach your phone.
- Modified builds like GB WhatsApp can steal your data.
Expert Recommendation
Turn automatic updates on so you never fall behind a release. Install WhatsApp only from the Google Play Store or the Apple App Store. Never use a modified version such as GB WhatsApp, because these are unsafe and can steal your data.
Step-by-Step Guide
Final Security Checklist
14 to go. Each tick is saved on this device only.
The report stays with you. Sharing sends only your score and the guide link, never which steps are still open.
Our Priority
with WhatsApp