How to Secure Your Apple ID

Open Settings and tap your name at the very top to open your Apple Account. This is the home for everything that follows — your sign-in details, trusted devices and recovery options all live here.

Your Apple Account is reached through the addresses listed under Sign-In & Security → Email & Phone Numbers — whoever can receive a reset code at one of them can take the account over. The strongest move is to put it on a private inbox no one else can touch. Tap Add Email or Phone Number → Existing Email Address, enter your Proton Mail address, and verify it with the code Apple sends. Then switch on Primary Email so your new address becomes the one the account runs on.

Change your password to something long and unique that you use nowhere else, so an old data breach can't unlock it — a password manager like Proton Pass can generate and store it for you. On your iPhone, tap Sign-In & Security → Change Password and confirm with your device passcode. Changing it also signs out most other active sessions, which is a clean break if someone has quietly been signed in elsewhere.

Apple's two-factor authentication works differently from most services — there is no authenticator app. A new sign-in is approved by one of your existing Apple devices, or by a code sent to a trusted phone number. So tightening it means tidying that list: under Sign-In & Security → Two-Factor Authentication, remove any trusted phone number that isn't yours, and sign out old devices that can no longer update to the latest version (roughly six years and older) along with anything you no longer use. Every device on the list is another place your approval codes can appear.

A recovery contact is someone you trust to help you back into your account if you're ever locked out. It's a genuinely useful feature — but it also means your account's security now leans on the security of their account and device, which is completely out of your control. If one is set, weigh that up and consider removing it: under Sign-In & Security → Recovery Contacts, tap the contact and choose Remove Contact.

With recovery contacts cleared, a recovery key hands recovery back to you alone — a 28-character code only you hold. Turn it on under Sign-In & Security → Recovery Key, then write the code down and store it somewhere safe and offline, away from your devices. The trade-off: switching it on turns off Apple's standard account recovery, so this key becomes your way back in if you ever forget your password and passcode — lose it and even Apple can't restore the account. Kept safe, it's the strongest lock you can put on your Apple Account.

Finally, switch on Advanced Data Protection — the strongest setting Apple offers. Normally Apple holds the keys to most of your iCloud data (backups, Photos, Notes and more), which means it can be handed over or exposed in a breach. With Advanced Data Protection on, that data becomes end-to-end encrypted: only your trusted devices can unlock it, and not even Apple can read it. From your Apple Account → iCloud, scroll to Advanced Data Protection and turn it on — you'll confirm with the recovery key you just made and your passcode. This is exactly why the recovery key matters: it becomes the master key only you hold.

One door is still open: your iCloud data can be reached from any web browser at iCloud.com, using just your email and password. If you only ever use your own Apple devices, shut that gateway. From Apple Account → iCloud, scroll down and tap iCloud.com, then switch off Allow Data Access and Allow Search. Your data stays reachable on your trusted devices, but the browser sign-in that an attacker could use is closed off.

One gap is left that nothing above can close on its own: someone who has your unlocked iPhone and your passcode — a thief who watched you type it in, or anyone you've shared it with — could sit down and quietly undo everything, changing your password and these very settings in seconds. Stolen Device Protection is built for exactly that situation.

Turn it on under Settings → Face ID & Passcode → Stolen Device Protection. It defaults the delay to Away from Familiar Locations — we'd change Require Security Delay to Always, so the protection applies everywhere, not just away from places your iPhone treats as home or work.