WhatsApp Privacy and Security Settings to Change Now -

Quick answer: The WhatsApp settings that matter most are two-step verification (a six-digit PIN), a passkey, Silence Unknown Callers, and limiting who can add you to groups and see your profile photo. Run Privacy Checkup under Settings, then Privacy to review the rest in one go. If you face targeted attacks, turn on Strict Account Settings.

Most WhatsApp account takeovers don’t involve clever hacking. Someone tricks you into sharing the six-digit code WhatsApp sends by SMS, or a stranger adds you to a scam group. A few minutes in settings blocks most of that.

Here’s what to change, where to find it and why, updated for October 2026. Menu names can vary slightly between Android and iPhone. For more guides like this, see our social media section.

Which WhatsApp security settings should you turn on first?

1. Two-step verification

This is the single most useful setting. It adds a six-digit PIN that’s needed when your number is registered on a new phone, so a stolen SMS code alone isn’t enough. According to WhatsApp’s Help Center:

Open Settings, then Account, then Two-step verification.
Tap Turn on or Set up PIN.
Enter a six-digit PIN and confirm it.
Add an email address. It’s optional, but it lets you reset the PIN if you forget it.
Confirm the email and save.

Don’t skip the email. WhatsApp says that without one, if you forget your PIN you’ll have to wait seven days before you can reset it.

2. A passkey

A passkey lets you verify your account with your phone’s fingerprint, face recognition or screen lock instead of waiting for an SMS code. It arrived on Android in 2023 and on iPhone in 2024. Android Authority lists the iPhone steps: Settings, then Account, then Passkeys, then Create passkey. Android follows the same path, per TechRadar.

Android Authority notes a passkey is mainly a more convenient sign-in, useful when SMS isn’t arriving, rather than a replacement for two-step verification. Use both.

3. Never share your codes

No setting replaces this habit. WhatsApp’s registration code and your two-step PIN are for you alone. If a friend messages asking you to forward “a code I sent by mistake,” their account has probably been taken over. Call them on a normal phone line to check.

Which WhatsApp privacy settings should you change?

The fastest way is Privacy Checkup, which WhatsApp introduced in 2023 to walk you through the main options in one place. You’ll find it as a banner on the Privacy screen (Settings, then Privacy). These are the settings we’d prioritise:

Setting	Where	Our suggestion
Groups	Settings, Privacy, Groups	My contacts, to stop strangers adding you to scam groups
Profile photo	Settings, Privacy, Profile photo	My contacts
Last seen and online	Settings, Privacy, Last seen and online	My contacts or Nobody
About	Settings, Privacy, About	My contacts
Silence unknown callers	Settings, Privacy (calls section)	On

Silence Unknown Callers

This stops calls from numbers that aren’t in your contacts from ringing. WhatsApp says those calls “will not ring on your phone, but will be visible in your Call list, in case it turns out to be someone important.” It’s a good defence against the international spam calls many Indian users get.

How do you protect sensitive chats?

Advanced Chat Privacy

Launched in April 2025, Advanced Chat Privacy is set per chat or group. When it’s on, others in the chat can’t export the conversation, media won’t auto-download to their phones and messages can’t be used with AI features. Tap the chat name, then Advanced Chat Privacy. It’s useful for family, health or community groups where not everyone knows each other.

Chat Lock and disappearing messages

Chat Lock moves a chat out of your inbox into a separate folder that opens only with your phone’s password or biometric, and hides its content in notifications. Tap the chat or group name and choose the lock option. To open locked chats, pull down slowly on your chat list. It’s handy if family members sometimes use your phone. Disappearing messages, which delete messages after a set time, are another option for sensitive conversations.

What is WhatsApp’s Strict Account Settings?

Strict Account Settings is a one-tap, high-security mode WhatsApp introduced in January 2026. TechRepublic reports it “blocks attachments and media from people outside your contacts and limits features like link previews, unknown calls, and group adds.” It also turns on two-step verification and limits who sees your last seen and profile.

Find it under Settings, then Privacy, then Advanced. WhatsApp designed it for people such as journalists and public figures, but anyone can use it. The trade-off is convenience: links and files from new contacts, such as a delivery agent or a new client, won’t come through normally.

Check linked devices regularly

WhatsApp Web, the desktop app and other linked devices can read your messages. Open Settings, then Linked devices, and log out anything you don’t recognise, such as an office computer you no longer use. Do this after any phone repair or if you suspect someone else had your phone.

What is WhatsApp SIM binding in India?

Indian users may see a prompt saying WhatsApp needs to verify that your SIM card is present in your device. This comes from a Department of Telecommunications directive requiring messaging apps to tie accounts to an active SIM in the phone. MediaNama reported in April 2026 that Meta confirmed testing it with regular Indian users.

The original plan to log users out of WhatsApp Web every six hours was dropped. The government said web sessions would instead be logged out “on the basis of risk-based analysis,” and the compliance deadline was moved to 31 December 2026, according to MediaNama and Beebom. If you use WhatsApp on a phone without the registered SIM, expect changes as that date gets closer.

Parents setting up a teen’s phone can also use WhatsApp’s new family tools; see our explainer on WhatsApp’s parental controls for teens.

Frequently asked questions

What happens if I forget my WhatsApp two-step verification PIN?

If you added an email address, you can reset the PIN using a link sent to it. Without an email, WhatsApp says you’ll need to wait seven days before you can reset it.

Is a passkey better than two-step verification on WhatsApp?

They do different jobs. A passkey makes signing in easier without SMS, while two-step verification adds a PIN that a thief also needs. Turning on both gives you the most protection.

Can someone read my WhatsApp messages from another device?

Only if a device is linked to your account. Check Settings, then Linked devices, and log out anything you don’t recognise. Messages themselves are end-to-end encrypted in transit.

Should everyone turn on Strict Account Settings?

Not necessarily. It’s built for people at higher risk of targeted attacks and blocks media and links from non-contacts. Most people are well protected with two-step verification, Silence Unknown Callers and contacts-only group adds.