Android Security Settings: A Checklist With Trade-offs

The quickest way to tighten an Android phone is to set a screen lock, keep Google Play Protect and updates on, review app permissions in the Privacy dashboard, and turn on Find Hub and the Theft Protection features your phone supports. Then secure the Google Account behind the phone. This checklist goes through the settings that matter most, says what each one does, and says what it costs you.

One caveat comes first. Android is made by many companies, so menu names and positions differ between Pixel, Samsung and other makers, and between Android versions. Where Google's pages give a path we quote it; where we could not confirm one on an official page we describe the idea and tell you to use the Settings search box. If you already suspect something is wrong, start with how to know if your phone is hacked and the Phone Hacked Triage Lab. This page is about getting the settings right before anything goes wrong. iPhone owner? See the iPhone checklist.

Do this now: the 15-minute pass

1. Set a screen lock (PIN, pattern or password) and add a fingerprint or face unlock only if you want it.
2. Check Play Protect: in the Play Store, tap your profile icon, then Play Protect, then Settings, and confirm Scan apps with Play Protect is on.
3. Update: open Settings, then About phone, then Android version to see your security patch level, and check Settings, System, Software updates.
4. Open the Privacy dashboard (Settings, then Security and Privacy or Privacy) and review which apps used your camera, microphone and location.
5. Confirm Find Hub is on and turn on Theft Protection where available (Settings, Google, All services, Theft protection).
6. Review your Google Account with the Google Account security checkup guide.

You can rehearse these choices in the Android Security Lab, a scenario with fictional people where nothing real is at stake.

Screen lock and biometrics

Google's help page says a screen lock helps protect your phone from unauthorised access; you unlock with a PIN, pattern or password, and some devices also support fingerprint unlock. It calls a strong password the most secure option, and it notes that backups are encrypted with your screen lock only when you use a PIN, pattern or password. Google's Pixel help suggests a 6-digit PIN for stronger protection. Fingerprint or face unlock still relies on a main screen lock behind it, and Google notes a fingerprint can be less secure than a strong PIN, pattern or password. The trade-off is simple: a longer lock is a little slower to type, and biometrics are quicker but a weaker fallback if someone can force or copy them.

Theft Protection: when someone grabs the phone

Google's Theft Protection page lists several features. They need a screen lock set first, some need Android 10 or 15 or later, and Google says they are not available on Android Go devices, tablets or wearables, and support varies by phone model. You find them under Settings, then Google, then All services, then Theft protection.

• Theft Detection Lock uses AI, motion sensors, Wi-Fi and Bluetooth to detect a snatch-and-run and lock the screen. If the setting is greyed out, your device does not support it.
• Offline Device Lock locks the screen after the phone has been used offline for a short time, which can stop a thief cutting the connection to block Find Hub. Google says it can lock twice in 24 hours.
• Remote Lock locks the screen from another device; if the phone is offline it locks once it reconnects. It needs a screen lock, an active SIM, a verified phone number, Find Hub on and an internet connection.
• Identity Check requires biometrics for sensitive actions outside trusted places, plus biometric checks before changing your Google Account password or recovery options.

The costs: you must verify a phone number for Remote Lock, and Identity Check means extra steps when you are away from the trusted places you add. Remember your screen lock, because after a remote lock only your screen lock unlocks the phone.

Find Hub

Google says Find Hub (formerly Find My Device) is turned on automatically when you add a Google Account. To secure or erase a phone, it must have power, be online, be signed in to a Google Account, have Find Hub on and be visible on Google Play. From another device or the Find Hub website you can see its location, play a sound at full volume for five minutes, mark it as lost (locks it with its PIN, pattern or password and can show a message) or erase it. Google warns an erase is permanent and may not wipe SD cards. Location is an estimate, and an offline phone may only show a last known position. Set the lock now: Google says a PIN, pattern or password is needed to get help from the Find Hub network.

Play Protect and installing apps

Google says Play Protect checks apps from the Play Store before you download them and scans your device for harmful apps from other sources. If it finds one it may warn you, disable the app until you uninstall it, or remove it. It is on by default and Google recommends keeping it on. A separate setting, Improve harmful app detection, lets it send unknown apps installed from outside the Play Store to Google; that is a privacy trade-off you can weigh.

Installing apps from outside the Play Store (often called sideloading) is controlled by a per-app permission, usually named something like Install unknown apps. We could not confirm its menu path on an official page, so search Settings for it. Grant it only for a source you trust, and turn it back off afterwards. The cost of blocking is that you cannot install files from random links, which is usually the point.

App permissions and the Privacy dashboard

Google says to open Settings, tap Security and Privacy or Privacy, then Privacy dashboard. It shows which apps accessed your data and when, and which permissions they used. Select a permission such as camera or microphone to see the apps, then tap an app to change its permission. Google notes the history window differs by Android version (24 hours on Android 12, 7 days on Android 13) and that some steps work only on newer versions. Grant what the feature needs and nothing more; an app can usually ask again if you deny, at the cost of a feature not working until you allow it.

Location and nearby devices

Location and nearby-device access are permissions like any other: check them in the Privacy dashboard and the app's permission page. A map app needs location while you use it; a torch app does not. We did not verify the exact wording of the options on every maker's phone, so use the Settings search box for Location and Nearby devices.

Lock screen notifications

Notification previews can show message text and one-time codes to anyone who glances at the phone. Android lets you hide sensitive content on the lock screen; the setting's name and place differ by maker and version, and we have not confirmed a path on an official page, so search Settings for notifications on the lock screen. The cost is one extra tap to read a message.

Updates and security patch level

Google says to check with Settings, About phone, Android version, where you see the Android version, the Android security update (patch level) and the Google Play system update. To update, open Settings, System, Software updates. Before updating, connect to Wi-Fi and charge to at least 75%. Google says most system updates and security patches install automatically, and how often your model gets them depends on the maker or carrier. The fragmentation cost is real: an older phone that no longer gets updates cannot be fully protected by settings alone.

Safe Browsing

In Chrome for Android, Google's help says Standard protection is the default and checks sites, extensions and downloads against Google's lists of unsafe content. Enhanced protection sends more browsing data to Google in real time for protection against known and new dangers. The setting is under Chrome, Privacy and security, Safe Browsing. Choose Standard if you prefer to share less; choose Enhanced if you want the stricter checks.

Private Space

Private Space needs Android 15 or later. Google says it holds apps and data separately, hides the space when locked (including from All Apps and search) and uses its own lock. Setup is Settings, then Security and privacy, then Private space. The limits, in Google's words: concealment is not guaranteed, apps inside cannot run or notify while it is locked, there are no widgets, Find Hub or Quick Share receiving, its apps bypass the device VPN, and if you forget its lock the only option is to delete the space, which erases its apps and data. Use a dedicated Google Account for it, as Google recommends.

SIM PIN and eSIM

A SIM PIN asks for a code whenever the phone restarts or the SIM is moved, which makes a stolen SIM less useful. Carrier guides say a wrong code entered three times can block the SIM until you enter a PUK from your carrier, so get that first. The menu name varies by maker (often under Security and privacy, then More security settings), and an eSIM is managed through your phone and carrier, so ask your carrier how to protect it. We did not verify these on a Google page.

Google Account security

Your phone is only as safe as the account signed in on it. Run the Security Checkup, use a passkey or two-step verification and review the devices listed. Our Google Account security checkup guide walks through it, and the Passkey Lab shows how passkeys work.

How to tell your settings are working

• Play Protect shows scanning is on and finds no harmful apps.
• The Privacy dashboard shows only apps you recognise using sensitive permissions.
• Your security patch level is recent for your model.
• Find Hub lists the phone, and Theft Protection shows the features your device supports as on.
• Your Google Account lists only your own devices.

If something looks wrong, change your Google Account password and follow how to know if your phone is hacked.

Prevent it next time: a checklist

• Use a strong screen lock and keep a recovery option for your Google Account.
• Install updates; replace a phone that no longer receives them.
• Review the Privacy dashboard after installing a new app.
• Install apps from the Play Store; leave Install unknown apps off.
• Keep Find Hub and your supported Theft Protection features on.
• Hide sensitive lock screen notifications.
• Check what is publicly findable about you with the Digital Footprint Check.

Frequently asked questions

What are the most important Android security settings?

Set a screen lock, keep Google Play Protect and automatic updates on, check the Privacy dashboard for app permissions, make sure Find Hub is on, and turn on Theft Protection features where your phone supports them. Then secure the Google Account behind the phone.

What is Theft Detection Lock?

Google says it uses AI, motion sensors, Wi-Fi and Bluetooth to detect when someone grabs your phone and runs off with it, then locks the screen. It needs a supported device; if the setting is greyed out, your device does not support it.

Is Google Play Protect enough on its own?

No. Google says it checks Play Store apps and scans for harmful apps from other sources and may warn you, disable or remove them. It does not replace updates, a screen lock or careful choices about what you install.

Why do the menus on my phone look different from the guides?

Android is made by many companies. Pixel, Samsung and other makers name and place settings differently, and menus change between Android versions. Use the search box in Settings and the official help pages for your phone.

Should I use Private Space?

It can help if others use your phone. Google says it needs Android 15 or later, hides the space when locked and stops its apps running in the background. If you forget its lock, you cannot recover access and the only option is to delete the space, which erases its apps and data.

How do I check my Android security patch level?

Google says to open Settings, tap About phone, then Android version, where you will see the Android security update (patch level) and Google Play system update. Check for updates under System, then Software updates.

Sources

• Android Help: Theft Protection features
• Android Help: Find, secure or erase a lost device with Find Hub
• Google Play Help: Protect against harmful apps with Play Protect
• Android Help: Privacy dashboard and app permissions
• Android Help: Check and update your Android version
• Android Help: Set a screen lock
• Android Help: Hide sensitive apps with private space
• Chrome Help: Choose your Safe Browsing protection level

This is general guidance. Menus and wording differ by phone maker and Android version; follow the official pages above and your maker's support site for the current steps.