How to make your Android phone secure: 12 settings that actually matter

TL;DR

The pick: Theft Detection Lock plus always-on VPN with the system kill switch plus Identity Check. These three close the three biggest exposure windows on any current Android phone.

Runner-up: the rest of the twelve below add real but smaller increments: stronger PIN, faster auto-lock, phishing protection in Messages and Gmail, app-source restriction, regular OS updates.

Skip if: you only use the phone for offline tasks. The full twelve is overkill there; the three above are still worth it.

Android security playbook

Twelve settings. Five minutes. One materially harder phone to compromise.

The Android security model in 2025 is good. The hard part is finding the toggles that activate it. Here are twelve, in priority order.

0settings

Ranked by what they actually protect

0windows

Snatched phone, leaking VPN, factory-reset attempt

0minutes

Total setup on a clean phone

Modern Android ships with most of the security it needs out of the box. The twelve toggles below activate the parts that aren't on by default. Run through them once on a new phone, and the device you put back in your pocket is materially harder to steal, harder to wipe, and harder to phish than the one you took out.

1. Theft Detection Lock

Settings > Security & privacy > Device unlock > Theft protection > Theft Detection Lock. On-device ML model that locks the phone the moment a snatch motion pattern fires. The single most important setting added to Android in years; not on by default on every device. Battery overhead under 1% per day.

2. Always-on VPN with the system kill switch

Settings > Network & internet > VPN > gear icon > Always-on VPN AND Block connections without VPN. The OS-level kill switch is stronger than any in-app kill switch. Together they cover the leak windows during reboot, sleep, and Wi-Fi-to-LTE handoffs that the in-app toggle can't catch.

3. Identity Check

Settings > Security & privacy > Identity Check. Requires biometrics for sensitive actions (factory reset, screen-lock change, Find Hub disable) outside trusted locations. A thief with your unlocked phone still can't wipe it for resale. Set home as the only trusted location; never the office.

4. A 6-digit PIN minimum, password better

Settings > Security & privacy > Device unlock > Screen lock. A 4-digit PIN takes about half a day to brute-force; a 6-digit PIN takes 25 days; a 6-character password is borderline uncrackable for opportunistic theft. Move past 4 digits today.

5. Auto-lock under 30 seconds

Same menu. Anything longer creates a window for the phone sitting on the cafe table to be unlocked when grabbed. Failed Authentication Lock (also same menu) auto-locks after a short burst of bad PINs without burning your retry counter.

6. Phishing protection in Messages and Gmail

Google Messages > Settings > Spam protection. Gmail > Settings > account > link warnings. On-device classifiers flag suspicious links before they render. Both ship off on plenty of older devices.

7. App-source restriction

Settings > Security & privacy > More security and privacy > Install unknown apps. Set every app to "Not allowed" except a developer environment if you actually need one. Most Android malware in the past three years arrived as a sideload through this vector.

8. Quarterly app cleanup

Settings > Apps. Uninstall anything you haven't used in 90 days. Apps you don't open still receive silent updates and request fresh permissions; their attack surface stays live.

9. Find Hub setup

Settings > Google > Find My Device. The rebranded Find My Device with crowd-sourced offline finding via every nearby Android phone (more than a billion devices). Enable, verify with the find.google.com browser tool, and confirm the offline-finding network is on.

10. Auto-updates for the OS

Settings > System > System update > Auto-download. Most Android security incidents in the past two years exploited bugs that had patches available; users just hadn't installed them. Auto-download cuts the delay between patch and protection by weeks.

11. Encrypted backups

Settings > Google > Backup. Verify the backup is on (Pixel and most newer Samsung devices have it on by default). End-to-end encrypted with a key derived from your screen lock; if you lose the phone, you can restore on the next one without exposing the data to Google.

12. Lock-screen notification privacy

Settings > Notifications > Notifications on lock screen > Don't show notifications. The default is to show them. A snatched-but-still-locked phone reveals incoming SMS codes, banking alerts, and message previews to whoever is holding it. Hide-on-lockscreen is the simplest fix.

All twelve settings ranked

Setting impact scorecard.

Setting	Impact	Setup time	Default state on Pixel 9
Theft Detection Lock	High	30 sec	Off until enabled
Always-on VPN + system kill switch	High	1 min	Off
Identity Check	High	30 sec	Off
6-digit PIN minimum	Med	1 min	Whatever you set
Auto-lock under 30s	Med	10 sec	Often 1 min default
Phishing protection	Med	30 sec	Sometimes off
App-source restriction	Med	30 sec	Often permissive
Quarterly app cleanup	Low	5 min /qtr	Manual
Find Hub	High	30 sec	On but unverified
OS auto-updates	High	10 sec	Off on some carriers
Encrypted backups	Med	30 sec	Usually on
Lock-screen privacy	Med	20 sec	Show all by default

Common questions

Android security FAQ

For most users, no. Google Play Protect (built-in) scans installed apps for malware. Third-party antivirus on Android exists mostly to upsell unrelated features. The twelve toggles above plus sticking to the Play Store close the gaps Play Protect can't on its own.
Requires Android 15 or later. Pixel 8a+, Galaxy S24+, OnePlus 12+, Xiaomi 14+, current Motorola flagships. Older phones running Android 14 or below don't get the feature.
Once when you set up a new phone, then quarterly thereafter. The settings sometimes reset after major OS updates; the quarterly check catches that.

Verdict

Twelve settings, 5 minutes total on a clean phone. The first three (Theft Detection Lock, always-on VPN with the system kill switch, Identity Check) carry the most weight; the next nine add real but smaller increments. Once configured, the only ongoing maintenance is the quarterly app cleanup, which takes 5 minutes and is the cheapest security work you can do.