WhatsApp’s new ‘lockdown’ settings add another layer of protection against cyberattacks | The VergeSkip to main contentThe homepageThe VergeThe Verge logo.The VergeThe Verge logo.TechReviewsScienceEntertainmentAIPolicyHamburger Navigation ButtonThe homepageThe VergeThe Verge logo.Hamburger Navigation ButtonNavigation DrawerThe VergeThe Verge logo.Login / Sign UpcloseCloseSearchTechExpandAmazonAppleFacebookGoogleMicrosoftSamsungBusinessSee all techGadgetsExpandLaptopsPhonesTVsHeadphonesSpeakersWearablesSee all gadgetsReviewsExpandSmart Home ReviewsPhone ReviewsTablet ReviewsHeadphone ReviewsSee all reviewsAIExpandOpenAIAnthropicSee all AIVerge ShoppingExpandBuying GuidesDealsGift GuidesSee all shoppingPolicyExpandAntitrustPoliticsLawSecuritySee all policyScienceExpandSpaceEnergyEnvironmentHealthSee all scienceEntertainmentExpandTV ShowsMoviesAudioSee all entertainmentGamingExpandXboxPlayStationNintendoSee all gamingStreamingExpandDisneyHBONetflixYouTubeCreatorsSee all streamingTransportationExpandElectric CarsAutonomous CarsRide-sharingScootersSee all transportationFeaturesVerge VideoExpandTikTokYouTubeInstagramPodcastsExpandDecoderThe VergecastVersion HistoryNewslettersExpandThe Verge DailyInstallerVerge DealsNotepadOptimizerRegulatorThe StepbackArchivesStoreSubscribeFacebookThreadsInstagramYoutubeRSSThe VergeThe Verge logo.WhatsApp’s new ‘lockdown’ settings add another layer of protection against cyberattacksComments DrawerCommentsLoading commentsGetting the conversation ready...NewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechAppsCloseAppsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All AppsWhatsApp’s new ‘lockdown’ settings add another layer of protection against cyberattacksThe new ‘Strict Account Settings’ automatically block attachments and media from senders you don’t know, and also silences calls from unknown contacts.The new ‘Strict Account Settings’ automatically block attachments and media from senders you don’t know, and also silences calls from unknown contacts.by Emma RothCloseEmma RothNews WriterPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Emma RothJan 27, 2026, 6:01 PM UTCLinkShareGiftImage: The VergeEmma RothCloseEmma RothPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Emma Roth is a news writer who covers the streaming wars, consumer tech, crypto, social media, and much more. Previously, she was a writer and editor at MUO.WhatsApp is launching new “Strict Account Settings” that add even more protections against cyberattacks. The feature is built for people at a high-risk of attacks — such as journalists or public figures — and automatically blocks attachments and media from senders you don’t know, while silencing calls from unknown contacts.The new setting limits other functionality inside WhatsApp, including turning off link previews, limiting who can add you to a group, and blocking non-contacts from seeing your profile photo, “about” details, and online status. “You should only turn this on if you think you may be a target of a sophisticated cyber campaign,” WhatsApp says. “Most people are not targeted by such attacks.”Image: WhatsAppWhatsApp has long offered end-to-end encryption, and bolstered its security even more after users were targeted with the NSO Group’s Pegasus spyware, which allowed bad actors to gain access to someone’s device through a phone call. Meta, WhatsApp’s parent company, later sued the NSO Group and received $167.25 million in damages. WhatsApp also shut down a spyware campaign targeting journalists and civil society members last year.Meta is currently facing a lawsuit that claims the company and WhatsApp can access private WhatsApp chats. Andy Stone, Meta’s head of communications, has pushed back on these claims, telling Bloomberg that the lawsuit is “a frivolous work of fiction,” as WhatsApp uses the Signal protocol for encryption.Strict Account Settings will roll out in the coming weeks, and you can turn it on by opening WhatsApp settings, selecting “Privacy,” tapping “Advanced,” and then selecting the option. WhatsApp notes that you can only turn on this feature from your primary device — not on WhatsApp for the web.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Emma RothCloseEmma RothNews WriterPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Emma RothAppsCloseAppsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All AppsMetaCloseMetaPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All MetaNewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsSecurityCloseSecurityPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All SecurityTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechMost PopularMost PopularI grew up with Alex PrettiTikTok USA is brokenPayment processors were against CSAM until Grok started making itEven the big dick subreddit is mad about ICETikTokers are heading to UpScrolled following US takeoverThe Verge DailyA free daily digest of the news that matters most.Email (required)Sign UpBy submitting your email, you agree to our Terms and Privacy Notice. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.Advertiser Content FromThis is the title for the native adMore in NewsTikTok US is mostly back up and runningGoogle Search now lets you ask AI Overviews follow-up questionsPornhub will block new users in the UK next monthDozens of nudify apps found on Google and Apple’s app storesTesla’s robotaxis are cheaper than Waymo, but the wait times are longerAmazon will pay customers $309 million to settle ‘no hassle returns’ lawsuitTikTok US is mostly back up and runningRichard Lawler5:05 PM UTCGoogle Search now lets you ask AI Overviews follow-up questionsRobert Hart5:00 PM UTCPornhub will block new users in the UK next monthEmma Roth4:35 PM UTCDozens of nudify apps found on Google and Apple’s app storesStevie Bonifield4:26 PM UTCTesla’s robotaxis are cheaper than Waymo, but the wait times are longerAndrew J. Hawkins3:00 PM UTCAmazon will pay customers $309 million to settle ‘no hassle returns’ lawsuitEmma Roth2:33 PM UTCAdvertiser Content FromThis is the title for the native adTop Stories4:39 PM UTCI grew up with Alex Pretti3:00 PM UTCYahoo Scout looks like a more web-friendly take on AI search12:00 PM UTCRoland’s TR-1000 is the ultimate drum machine11:30 AM UTCAll rise for JudgeGPT6:30 PM UTCA former Netflix game studio went indie to reach more players1:42 PM UTCTruth and AI in MinneapolisThe VergeThe Verge logo.FacebookThreadsInstagramYoutubeRSSContactTip UsCommunity GuidelinesArchivesAboutEthics StatementHow We Rate and Review ProductsCookie SettingsTerms of UsePrivacy NoticeCookie PolicyLicensing FAQAccessibilityPlatform Status© 2026 Vox Media, LLC. All Rights Reserved

WhatsApp’s new ‘lockdown’ settings add another layer of protection against cyberattacks

WhatsApp has introduced “Strict Account Settings,” a heightened security feature designed to mitigate the risk of sophisticated cyberattacks, particularly targeting high-risk individuals such as journalists or public figures. This new setting implements a suite of restrictions aimed at limiting access and potential exploitation of user accounts. The core functionality of the feature involves automatically blocking attachments and media from senders that are not recognized within a user’s contact list, effectively preventing the unsolicited receipt of potentially malicious files. Simultaneously, the setting silences incoming calls from unrecognized numbers, reducing the likelihood of compromised or fraudulent communications.

Beyond these primary protections, Strict Account Settings impose additional limitations on WhatsApp’s default behavior. Notably, the feature disables link previews, restricting the automatic display of URLs within messages, which can help prevent users from inadvertently clicking on phishing links. Furthermore, it limits the ability for others to add the user to group chats, requiring manual approval, and blocks non-contacts from viewing a user’s profile picture, “About” details, and online status. These combined actions significantly reduce the surface area for potential attacks.

The implementation of Strict Account Settings is directly responsive to a series of high-profile security incidents. Following sustained scrutiny regarding the capabilities of the NSO Group’s Pegasus spyware, and its ability to infiltrate the devices of journalists and civil society members, WhatsApp took decisive action to bolster its defense. The company’s subsequent lawsuit against the NSO Group, resulting in a $167.25 million damages award, underscored the severity of the threats.

Moreover, the introduction of Strict Account Settings builds upon previous efforts to combat spyware campaigns targeting WhatsApp users. Meta, WhatsApp’s parent company, continues to engage in legal battles addressing allegations of unauthorized access to user data. While Meta maintains that WhatsApp utilizes the Signal protocol for encryption, safeguarding communications against eavesdropping, the legal challenges persist.

The “Strict Account Settings” feature represents a proactive and layered approach to security, reflecting a heightened awareness of evolving cyber threats. The settings are designed to be purposefully restrictive, requiring a conscious decision from the user regarding their security posture. Meta’s guidance emphasizes that this feature should only be enabled by individuals who believe they are specifically at risk of a sophisticated cyber assault. The general user population, according to Meta, is not typically targeted by such campaigns.

The rollout of Strict Account Settings is scheduled for the coming weeks, accessible through a straightforward process within WhatsApp’s settings menu. Critically, the feature can only be activated on the user’s primary device, preventing its utilization on WhatsApp for the web. This constraint reinforces the importance of safeguarding the device itself, the primary entry point for potential attacks. The introduction of this feature highlights WhatsApp’s ongoing commitment to user security and demonstrates a tangible response to the escalating dangers of cyber espionage and malicious communications.