Windows 11 includes strong security features, but they work best when updates, sign-in protection, encryption, backups, and everyday account habits reinforce one another. You do not need a collection of “PC security” utilities to build a safer computer.
This guide explains 14 practical ways to secure Windows 11 using built-in protections and a few account-level precautions. Menu names apply to current Windows 11 releases and may vary slightly by device or organization.
Use it as your starting point for Windows security. Each step links to a detailed TechSavvyHelp guide when you need to go further.
To secure Windows 11, install updates, keep Microsoft Defender and Firewall enabled, use Windows Hello or a passkey, turn on multifactor authentication, encrypt the device, maintain an offline backup, use a standard account for daily work, review app permissions, and download software only from trusted sources. No single setting replaces these security layers.
Open Settings > Windows Update and install available security and quality updates. Restart when required, then check again. Windows Update also supplies many signed drivers and Microsoft Defender intelligence updates.
Update browsers, Microsoft 365, PDF readers, password managers, communication apps, and other internet-facing software. Remove programs you no longer use, especially products that no longer receive security fixes. Microsoft’s Windows Update FAQ explains the current update controls.
Browsers matter too; the Chrome zero-day CVE-2026-85046 is a recent example of why.
2. Check Windows Security
Open Start, search for Windows Security, and review the dashboard. The Virus & threat protection, Account protection, Firewall & network protection, App & browser control, Device security, and Device performance sections should not show unresolved warnings.
Keep real-time protection, cloud-delivered protection, and automatic sample submission enabled unless an organization manages them differently. Run a quick scan when you suspect a problem, and use Microsoft Defender Offline for persistent malware. See Microsoft’s current Windows Security guidance.
If Windows Security says Defender is turned off while it still appears active, see Microsoft Defender is turned off warning before installing anything else.
If another antivirus product is active, Microsoft Defender Antivirus may enter a limited mode. Do not run several real-time antivirus engines together merely to increase protection; conflicts can reduce stability without guaranteeing better detection.
3. Keep Microsoft Defender Firewall Enabled
In Windows Security > Firewall & network protection, confirm the firewall is on for Domain, Private, and Public network profiles. The firewall limits unsolicited network connections; it does not replace antivirus or safe account practices.
When an app requests firewall access, allow it only if you recognize the app and need its network feature. Avoid disabling the entire firewall to solve one connection problem. Remove an incorrect app exception instead.
4. Use Windows Hello or a Passkey
Configure a PIN, fingerprint, or face recognition under Settings > Accounts > Sign-in options. A Windows Hello PIN is tied to that device and protected by its security hardware, so it is not the same as reusing an account password.
Use passkeys when a trusted service supports them. Passkeys reduce exposure to phishing because the credential is associated with the legitimate service. Microsoft’s Windows Hello instructions cover supported sign-in methods.
New to passkeys? Our passkeys setup guide explains how they work and how to add one to your Microsoft, Google and Apple accounts.
5. Protect Your Microsoft Account with MFA
Turn on two-step verification for the Microsoft account connected to Windows, OneDrive, Outlook, and Microsoft 365. Prefer an authenticator app or passkey over SMS when practical, and store recovery codes somewhere separate from the computer.
Review recent sign-in activity and remove devices or sessions you do not recognize. Microsoft provides current two-step verification instructions.
Compare authentication methods and set up a stronger second factor.
6. Turn On Device Encryption
Encryption protects files when a laptop is lost or a drive is removed. Check Settings > Privacy & security > Device encryption when your device supports it. Windows Pro, Enterprise, and Education editions may expose additional BitLocker controls.
Before relying on encryption, confirm that the recovery key is backed up somewhere you can access without the computer. Encryption cannot protect you from losing the only recovery key. Microsoft explains eligibility and recovery-key handling in its Device Encryption guide.
Encryption is one of several steps in our guide to protecting personal data online.
Do not enable encryption and ignore the recovery key. Firmware changes, hardware replacement, or account problems can trigger recovery. Verify the key location before you need it.
7. Use a Standard Account for Everyday Work
An administrator account can make system-wide changes. Use a standard user account for browsing, email, documents, and routine work, and approve elevation only when you intentionally install or change something.
Do not disable User Account Control. A prompt is a checkpoint: verify the app name and publisher before approving it. If an unexpected prompt appears while opening an email, document, or website, cancel it.
8. Use Smart App Control and Reputation Protection
Open Windows Security > App & browser control and review reputation-based protection. These controls can warn about suspicious downloads, phishing, potentially unwanted apps, and unrecognized software.
Smart App Control is available only in specific Windows 11 conditions and may require a clean installation to enter evaluation mode. Do not reinstall Windows solely to chase one feature; keep the other protections active. Microsoft’s Smart App Control FAQ explains its limitations.
9. Download Software Safely
Use the Microsoft Store or the developer’s official website. Avoid repackaged installers, cracks, “driver updater” sites, browser pop-ups claiming the PC is infected, and search advertisements that imitate legitimate download pages.
Check the publisher shown by Windows before approving installation. Decline unrelated bundled software and browser extensions. Remove extensions you no longer use and keep the remaining ones updated.
10. Make Reliable Backups
Keep multiple copies of important files, including one copy that is offline or otherwise isolated from the PC. A continuously connected drive can be damaged, deleted, or encrypted along with the computer.
Test restoration instead of assuming a backup works. Cloud synchronization helps with access and may provide version history, but synchronization alone is not a complete backup because unwanted changes can also synchronize.
Follow the correct isolation and recovery order if files are encrypted or a ransom warning appears.
Build a backup routine that survives device failure and ransomware.
11. Review Privacy, Permissions, and Sharing
Open Settings > Privacy & security and review access to location, camera, microphone, contacts, and files. Remove permissions an app no longer needs. Review shared folders, nearby sharing, Remote Desktop, and remote-support tools.
Turn off remote access you do not use. If remote access is required, restrict who can connect, use MFA where supported, update the service, and avoid exposing it directly to the internet without appropriate network protection.
12. Secure the Browser and Home Network
Keep the browser updated, enable its phishing and malicious-download protection, and use a password manager to create unique passwords. Our best free password manager comparison and password management best practices help you choose and set one up. Do not approve unexpected notification, extension, or sign-in prompts.
Change the router’s default administrator password, install firmware updates, use WPA2 or WPA3 encryption, and disable insecure legacy options such as WPS when possible. Our Wi-Fi security guide covers each router setting. Use a guest network for visitors and untrusted smart devices.
On public Wi-Fi, a reputable VPN adds a layer of protection for your traffic. See our best free VPN comparison for options that respect your privacy.
13. Learn to Spot Scams and Fake Security Alerts
Many attacks on Windows PCs never exploit a technical flaw. They persuade you to do the work: call a fake support number, paste a command into the Run box, approve a sign-in prompt or install “remote help” software.
Treat any pop-up with a phone number, any web page that asks you to press Windows + R, and any unexpected request for a code as a scam until proven otherwise. Close the page, then check through a channel you started yourself.
Microsoft does not display error messages with phone numbers, and Windows Security alerts never ask you to call anyone.
See how a tech support pop-up scam can escalate into gold bar fraud.
The warning signs, a one-minute safety routine and guides to every common scam type.
14. Know What to Do If Windows Is Infected
Fast, calm action limits the damage. If you see a ransom note, files with strange extensions, a browser you cannot close or unknown remote-access software, follow this order:
- Disconnect the PC from Wi-Fi and unplug network cables to stop the spread.
- Do not pay a ransom or call any number shown on screen.
- From a separate, clean device, change the passwords for email, banking and your Microsoft account, and sign out of other sessions.
- Run Microsoft Defender Offline scan from Windows Security > Virus & threat protection > Scan options.
- Restore files from a backup that was disconnected at the time, and only after the PC is clean.
The correct isolation and recovery order if files are encrypted or a ransom warning appears.
Is Microsoft Defender Enough, or Do You Need Antivirus?
For most home users, Microsoft Defender Antivirus, Windows Firewall, SmartScreen and regular updates provide solid protection at no cost. Independent test labs regularly give Defender strong detection results.
A paid security suite can still make sense if you want extras such as a VPN, identity monitoring, parental controls or protection for several devices and platforms under one account. Run only one real-time antivirus at a time, because two can conflict and slow the PC.
Our best antivirus software comparison compares Defender with the main paid options.
Windows 11 Security Guides by Topic
| Topic | Guide | Covers |
|---|---|---|
| Antivirus | Best Antivirus Software | Defender versus paid suites, using current lab results |
| Defender warnings | Defender Is Turned Off Warning | False “turned off” alerts and real Defender problems |
| Ransomware | Remove Ransomware from Windows | Isolation, cleanup and file recovery |
| Passwords | Best Free Password Manager | Choosing and setting up a password manager |
| Password habits | Password Management Best Practices | Strong, unique passwords that are easy to manage |
| Passkeys | Passkeys Explained | Phishing-resistant sign-in for your main accounts |
| Two-factor authentication | Two-Factor Authentication | Which second factors actually protect you |
| Home Wi-Fi | Secure Your Wi-Fi Network | Router passwords, WPA3 and guest networks |
| VPN | Best Free VPN | Free VPNs that hold up on privacy |
| Backups | Data Backup Hacks | A backup routine that survives ransomware |
| Scams | Protect Yourself From Online Scams | Warning signs and guides to every common scam |
Security is strongest when routine actions are predictable: update regularly, pause before approving prompts, use unique sign-ins, and keep a tested backup disconnected from the computer.
Frequently Asked Questions
Does Windows 11 need third-party antivirus?
For many home users, Microsoft Defender Antivirus, Windows Firewall, browser protections, updates, and safe account practices provide a strong baseline. Specialized needs or organizational policy may justify another reputable product.
Is a Windows Hello PIN safer than a password?
A Windows Hello PIN is tied to one device and protected by its security hardware. It is not transmitted like an account password and can be combined with fingerprint or face recognition.
Does BitLocker stop hackers?
Encryption protects data when a device or drive is lost or physically accessed. It does not stop phishing, malware running while you are signed in, or account theft.
Should I disable Windows Firewall when an app will not connect?
No. Confirm the network works and create or correct a narrowly scoped app rule. Disabling the entire firewall exposes unrelated services.
What is the most important Windows 11 security setting?
There is no single setting. Timely updates, protected accounts, Microsoft Defender, firewall, encryption, safe software sources, and tested backups work together.
Final Secure Windows 11 Security Checklist
- Windows, apps, browsers, and firmware are current.
- Windows Security shows no unresolved warnings.
- Defender Antivirus and Firewall are active.
- Windows Hello or a passkey protects sign-in.
- MFA is enabled and recovery methods are stored safely.
- Device Encryption or BitLocker is enabled with a verified recovery key.
- Daily work uses the least privilege needed.
- Software comes from trusted official sources.
- Backups include an isolated copy and have been tested.
- Unneeded permissions, sharing, and remote access are disabled.
- You verify unexpected security alerts and payment requests on a channel you started.
- You know how to disconnect and scan a PC that may be infected.
Securing Windows 11 is an ongoing process, not a one-time switch. Review this checklist after major updates, new device setup, account changes, or any suspected security incident.
