Security health check

Most real-world compromises use a flaw that a released update already fixed.

• Every family device is on the latest OS version

  iOS/iPadOS, Android, Windows and macOS all publish security fixes monthly.

  Fix: Turn on automatic updates: iPhone Settings → General → Software Update → Automatic Updates. Android Settings → System → System update.

• App updates install automatically

  Out-of-date apps are the second most common entry point.

  Fix: App Store → your profile → Automatic Downloads → App Updates. Play Store → Settings → Network preferences → Auto-update apps.

• Every device has a screen lock (6+ digit PIN or passcode)

  A four-digit PIN can be shoulder-surfed and brute-forced quickly.

  Fix: Use a 6-digit PIN minimum, or an alphanumeric passcode on shared family devices.

• Biometrics (Face ID / fingerprint) are enabled where available

  Biometrics make a long passcode practical day to day.

  Fix: Set up Face ID / Touch ID / fingerprint unlock, and keep the passcode strong as the fallback.

• Find My / Find My Device and remote wipe are switched on

  A lost phone is the most likely 'breach' a family will ever have.

  Fix: iPhone: Settings → Apple Account → Find My. Android: Settings → Security → Find My Device.

• No family device is jailbroken or rooted

  Jailbreaking removes the sandbox that keeps one bad app from reading everything else.

  Fix: Signs to look for: sideloaded app stores (Cydia, Sileo, Magisk), 'unknown sources' installs, disabled OS updates. Back up and factory reset if in doubt.

• Device storage is encrypted

  On by default with a passcode on modern iOS/Android; needs enabling on some PCs.

  Fix: Windows: turn on BitLocker or Device Encryption. macOS: enable FileVault.

We never ask for a password, and nothing you tick here identifies an account.

• Multi-factor authentication is on for the main family email

  Email resets everything else — secure it first.

  Fix: Prefer an authenticator app or passkey over SMS. Save the backup codes offline.

• Multi-factor authentication is on for social and gaming accounts

  Account takeover is the most common way a child's contacts get targeted.

  Fix: Check Roblox, Snapchat, Instagram, TikTok, Discord, Xbox/PlayStation one at a time.

• No password is reused across two or more accounts

  Reuse is what turns one leaked site into ten compromised accounts. We never ask what your passwords are.

  Fix: Change reused passwords starting with email, banking, then social. Use a password manager to make each one unique.

• The family uses a password manager

  It is the only realistic way to keep every password unique.

  Fix: Built-in options: iCloud Keychain, Google Password Manager. Cross-platform: Bitwarden, 1Password.

• Accounts have been checked against known breaches

  Breach checks tell you which passwords must change today.

  Fix: Use the built-in check: iPhone Settings → Passwords → Security Recommendations, or Chrome → Password Manager → Checkup.

• Recovery email and phone number are current on every account

  Out-of-date recovery details are how people get locked out permanently.

  Fix: Review recovery details on the main email account and any account a child owns.

Review these together with your child so it is a conversation, not an inspection.

• Location access is reviewed — 'While Using' or 'Never', not 'Always'

  Games and social apps rarely need background location.

  Fix: iPhone Settings → Privacy & Security → Location Services. Android Settings → Location → App permissions.

• Camera and microphone permissions have been reviewed

  Any app with camera access can prompt for a photo at any time it is open.

  Fix: Revoke camera/mic for anything that is not a camera, calling or video app.

• Contacts and photo-library access are limited

  Contact upload is how strangers get suggested to your child as 'people you may know'.

  Fix: Use 'Selected Photos' on iOS; deny contacts access to social apps.

• Ad tracking is turned off

  Reduces profiling of a child across apps.

  Fix: iPhone: Settings → Privacy → Tracking → off. Android: Settings → Privacy → Ads → Delete advertising ID.

• Installing from unknown sources is disabled

  Sideloaded APKs are the main malware route on Android.

  Fix: Android Settings → Apps → Special access → Install unknown apps → off for every app.

• Home Wi-Fi uses a changed admin password and WPA2/WPA3

  Default router admin passwords are published online.

  Fix: Log into the router, change the admin password, confirm encryption is WPA2 or WPA3, and rename the network so it does not include your surname or address.