Windows 11 Security Checklist: 12 Settings to Change Now

Windows 11 is more secure out of the box than any previous version of Windows, but the default settings leave several important protections disabled or misconfigured. This checklist covers the most impactful security changes you can make in under an hour — no technical expertise required.

1. Enable BitLocker Drive Encryption

BitLocker encrypts your entire drive, meaning if your laptop is stolen the data is unreadable without your password. On Windows 11 Pro and Enterprise it is built in.

1. Open Settings → Privacy & Security → Device Encryption
2. If Device Encryption is available, turn it on
3. For full BitLocker controls: search for Manage BitLocker in the Start menu
4. Save your recovery key to your Microsoft account or print it — do not lose it

Windows 11 Home has a simplified version called Device Encryption — enable it the same way. BitLocker (full version) requires Pro or higher.

2. Set Up Windows Hello with a PIN or Biometrics

A strong PIN or fingerprint/face login is more secure than a password for local sign-in because Windows Hello credentials never leave your device.

1. Settings → Accounts → Sign-in options
2. Set up Windows Hello PIN (minimum 6 digits, enable letters and symbols for stronger security)
3. If your device supports it, enable fingerprint or facial recognition

3. Enable Two-Factor Authentication on Your Microsoft Account

Your Microsoft account controls access to OneDrive, email, and potentially your Windows licence. Protect it with 2FA.

1. Go to account.microsoft.com/security
2. Select Advanced security options
3. Enable Two-step verification
4. Use the Microsoft Authenticator app rather than SMS for stronger protection

4. Keep Windows Update on Automatic

The majority of successful attacks exploit known vulnerabilities that already have patches available. Automatic updates are your most important single security measure.

1. Settings → Windows Update
2. Ensure Get the latest updates as soon as they’re available is on
3. Check Advanced options → Optional updates and install driver updates too

5. Check Microsoft Defender Is Active and Up to Date

Microsoft Defender Antivirus is built in and free. For most home users it is sufficient — you do not need to pay for third-party antivirus.

1. Open Windows Security from the Start menu
2. Verify all items show green ticks — Virus protection, Firewall, etc.
3. Run a Quick Scan if you have not done one recently

6. Enable Ransomware Protection (Controlled Folder Access)

Controlled Folder Access prevents unknown apps from modifying files in your Documents, Pictures, and other protected folders — blocking a common ransomware attack vector.

1. Windows Security → Virus & threat protection → Ransomware protection
2. Turn on Controlled folder access
3. If apps you trust get blocked, add them to the allowed list

7. Review App Permissions

Apps on Windows 11 can request access to your camera, microphone, location, and contacts. Review what has access.

1. Settings → Privacy & Security
2. Go through Camera, Microphone, and Location — revoke access for any app that does not need it

8. Enable the Windows Firewall

The Windows Firewall should be on by default, but check it has not been disabled by another application.

1. Windows Security → Firewall & network protection
2. Ensure Domain, Private, and Public network profiles all show the firewall as on

9. Use a Standard Account for Day-to-Day Use

Using an Administrator account for daily tasks means any malware that runs has full system access. Create a standard user account for everyday work.

1. Settings → Accounts → Family & other users → Add account
2. Create a new standard (non-admin) account
3. Use your admin account only when installing software or changing system settings

10. Check for and Remove Bloatware

Pre-installed apps you do not use are attack surface. Uninstall what you do not need.

1. Settings → Apps → Installed apps
2. Sort by publisher — remove anything from your device manufacturer that you do not use
3. Remove browser toolbars, games, and trial software

11. Review Startup Apps

Some malware and potentially unwanted programs add themselves to startup. Review what runs when Windows starts.

1. Open Task Manager → Startup apps
2. Disable anything you do not recognise or need at startup

12. Back Up Your Data

Security is not just about preventing attacks — it is about recovering from them. A good backup means ransomware cannot hold your data hostage.

• Use Windows Backup (Settings → System → Windows Backup) to back up to OneDrive
• For an offline backup: use File History with an external drive (Control Panel → File History)
• Follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite

Related Guides

• MFA Security: A Simple Layer That Stops Attacks
• What Are Passkeys? The Replacement for Passwords Explained
• How to Spot a Phishing Email