How To Protect an iPhone From Spyware. Full iOS 16 Lockdown Guide Here!

Updated Lockdown Mode Guidance for Current Supported iOS Versions

ORIGINAL PUBLICATION: 26 September 2023 SUBSTANTIVE REVISION: 3 September 2026 (AEST)

IMPORTANT EVIDENCE AND SAFETY NOTICE

If you believe your iPhone may be monitored and the matter could involve personal safety, criminal conduct, employment action or court proceedings, do not erase or restore the device, delete applications or profiles, install “spyware removal” software, or make unnecessary changes. These actions can alter or destroy potential evidence. Use a different trusted device and a safe location to obtain advice. If there is immediate danger, call 000 in Australia, Police 999 or Ambulance 998 in the UAE, or the appropriate emergency service where you are. For specialist assistance, contact NSI Global: telephone 1300 000 NSI (674) from Australia, or +971 (0)4 409 6824 from the UAE.

Apple introduced Lockdown Mode with iOS 16 as an optional protective setting for the small number of people who may face exceptionally sophisticated, highly targeted cyberattacks. It remains available on current supported versions of iOS and has gained additional protections since its original release.

Lockdown Mode is valuable, but its purpose must be understood precisely. It reduces the attack surface by restricting selected features and services. It is not a spyware scanner, does not establish whether an iPhone has been compromised, does not remove every threat and does not preserve evidence by itself.

This updated guide explains when Lockdown Mode may be appropriate, how to enable and disable it, what it changes, and what to do when a suspected compromise may require forensic investigation.

What Is iOS 16 Lockdown Mode?

Image note: The original iOS 16 screens below are retained because they clearly show the control and workflow. Wording and screen design may differ slightly on later supported iOS releases.

Lockdown Mode information screen on iPhone, retained from the original iOS 16 guide.

Lockdown Mode is an extreme, optional security configuration available on iPhone and iPad from iOS 16 and iPadOS 16 onward. It is designed primarily for people whose identity, occupation, relationships or activity could make them targets of advanced mercenary spyware. This may include journalists, activists, political figures, diplomats, senior executives, lawyers, investigators and others facing a credible targeted threat.

Most iPhone users will never be targeted by attacks of this sophistication. Enabling Lockdown Mode changes how parts of the device work, so it should be applied according to the user’s risk rather than treated as a universal setting.

How Does Lockdown Mode Protect an iPhone or iPad?

Lockdown Mode restricts functions that have historically created potential pathways for highly targeted exploitation. On current supported Apple software, its protections include:

1. Messages: Most attachment types are blocked other than certain images, video and audio. Links, link previews and some other capabilities are unavailable.
2. Web browsing: Certain complex web technologies are disabled. Some sites may load slowly, display differently or fail to work.
3. FaceTime: Incoming calls are limited unless the user has previously called that person or contact within Apple’s specified period. SharePlay and Live Photos are unavailable.
4. Apple services: Unsolicited invitations for certain Apple services are restricted. Some connected experiences do not operate normally.
5. Photos: Location information is removed when photos are shared. Shared Albums are removed from the Photos app and new invitations are blocked on the protected device.
6. Device connections: An iPhone or iPad must be unlocked before connecting to an accessory or another computer.
7. Wireless connectivity: The device does not automatically join non-secure Wi-Fi networks and disconnects from one when Lockdown Mode is enabled. Apple also states that 2G and 3G cellular support is disabled on iPhone and iPad.
8. Configuration and management: New configuration profiles cannot be installed, and the device cannot be newly enrolled in Mobile Device Management or supervision while Lockdown Mode is active.

Phone calls, ordinary SMS messages and emergency functions remain available. An iPhone placed in Lockdown Mode automatically applies it to a paired Apple Watch, while a supported iPad or Mac must be enabled separately.

Summary of Lockdown Mode feature restrictions retained from the original guide.

When Should You Use Lockdown Mode?

Lockdown Mode is most relevant when there is a credible risk of highly targeted compromise. Examples include receiving an authentic Apple threat notification; being advised by a qualified security professional; working in a role or matter known to attract advanced targeting; or experiencing a threat environment in which a sophisticated actor has both intent and capability.

It can also be used preventatively by an elevated-risk person before sensitive travel, negotiations or exposure to a known threat. Organisations should make that decision as part of a wider executive-protection, communications-security or incident-response plan rather than relying on the handset setting alone.

Battery drain, heat, poor performance, unusual messages or unexplained data use can justify investigation, but none proves spyware is present. Conversely, sophisticated spyware may leave no obvious symptom. A finding should be based on relevant artefacts and context, not a checklist of generic warning signs.

If Apple Sends a Threat Notification

Apple describes its mercenary-spyware notifications as high-confidence alerts that a person has been individually targeted. Verify the notification by signing in directly at account.apple.com and checking for the banner; do not follow links or telephone numbers in an unexpected message claiming to be Apple.

An authentic alert should be preserved and treated seriously. It indicates targeting, but does not by itself answer whether an exploit succeeded, what information was accessed or who was responsible. Those questions may require a properly scoped forensic examination of the iPhone and associated accounts, backups and enterprise records.

Before Enabling Lockdown Mode: Decide Whether Evidence Matters

Apple recommends current software for the complete set of Lockdown Mode protections. That is sound preventative advice for a device with no suspected incident. A potentially evidentiary device presents a different decision: installing an update, restarting, deleting content or changing accounts can alter its state.

If the immediate objective is personal safety or urgent containment, protective action may take priority. If the objective includes establishing what happened for police, lawyers, an employer or a court, obtain advice from a separate trusted device before making avoidable changes. Record the date and time of any action that cannot wait.

Do not assume that switching on Lockdown Mode will isolate an already-compromised phone or preserve everything of potential value. Connectivity can expose a device to ongoing access, but disconnecting it can also affect volatile information, remote activity and investigative opportunities. The correct handling decision depends on the circumstances.

How to Enable Lockdown Mode on an iPhone or iPad

On a supported device:

1. Open Settings.
2. Tap Privacy & Security.
3. Scroll down and tap Lockdown Mode.
4. Tap Turn On Lockdown Mode.
5. Review the restrictions, then tap Turn On & Restart.
6. Enter the device passcode when prompted.

After the restart, notifications may appear when an application or feature is limited. Safari displays a banner when Lockdown Mode protections apply.

Original iOS 16 sequence showing how to turn on Lockdown Mode.

How to Disable Lockdown Mode

Only disable Lockdown Mode after considering the reason it was enabled. If a live threat or investigation remains unresolved, seek appropriate advice first.

1. Open Settings.
2. Tap Privacy & Security.
3. Tap Lockdown Mode.
4. Tap Turn Off Lockdown Mode, followed by Turn Off & Restart.
5. Enter the passcode if requested.

Turning Lockdown Mode off restores restricted functions after the device restarts. It does not prove that any earlier compromise has ended or that the iPhone is free from spyware.

Original iOS 16 sequence showing how to turn off Lockdown Mode.

Can Apps or Websites Be Excluded?

Apple permits selected applications and Safari websites to be excluded from certain web-browsing restrictions. On iPhone or iPad, exclusions can be reviewed under Settings > Privacy & Security > Lockdown Mode > Configure Web Browsing. A website can also be excluded through Safari’s page controls.

Every exclusion restores functionality but also narrows the protection. Exclude only a service that is trusted and operationally necessary. Review exemptions periodically, particularly after travel, an incident or a change in role.

Lockdown Mode and Managed Corporate iPhones

Lockdown Mode prevents new device-management enrolment and new configuration profiles while active. It does not remove an existing Mobile Device Management enrolment. Apple states that administrators can continue installing and removing profiles on a device that was already managed.

For a corporate iPhone, do not remove a profile merely because it is unfamiliar. It may be legitimate organisational infrastructure and its removal may delete settings, applications or data. The owner, issuer, authority and purpose of the profile should be established first. A suspected executive-device compromise should be coordinated with legal, security and digital-forensic personnel so that handset evidence can be considered alongside identity, email, cloud, VPN, MDM and network records.

Lockdown Mode Is Not the Same as Safety Check

Lockdown Mode is intended to reduce exposure to highly sophisticated technical attacks. Apple’s Safety Check addresses a different problem: reviewing or stopping information sharing with people and applications, checking connected devices and changing selected account-security settings.

Safety Check is available on iPhone with iOS 16 or later at Settings > Privacy & Security > Safety Check. Its Emergency Reset can quickly stop sharing, while Manage Sharing & Access supports a more selective review.

These changes can be important in situations involving coercive control or family violence, but they may alert another person or modify potential evidence. Plan for safety first and, where circumstances permit, obtain assistance through a separate trusted device before changing a monitored phone.

What Lockdown Mode Cannot Tell You

Lockdown Mode cannot determine:

1. whether an iPhone was previously infected or accessed;
2. which exploit or surveillance pathway may have been used;
3. whether an Apple Account, email account, cloud service or another linked device is compromised;
4. what information may have been viewed, collected or transmitted;
5. who was responsible; or
6. whether evidence will be accepted in a legal proceeding.

A negative forensic result must also be interpreted within its limits. It means no reportable indicator was identified within the commissioned scope, methods, available artefacts, device condition and relevant period. It is not a guarantee that every possible surveillance channel was absent.

What to Do After Suspected iPhone Spyware

If a compromise is suspected and evidence may matter:

1. Prioritise immediate safety. Move to a safe place and use another trusted device if the suspected person could monitor communications.
2. Minimise unnecessary interaction. Do not erase, restore, update, delete applications or profiles, or run unverified scanning tools.
3. Preserve the context. Record relevant dates, suspicious events, Apple alerts, people with physical access and changes already made.
4. Establish authority. Confirm who owns the handset and Apple Account and who may lawfully authorise collection and examination.
5. Scope beyond the phone when justified. Relevant evidence may sit in the Apple Account, email, backups, linked devices, MDM, identity systems, carrier records or network logs.
6. Use qualified assistance. The methods, reporting standard and chain of custody should match the decisions the investigation must support.

NSI Global’s Forensic Spyware and Malware Detection service examines authorised devices and related evidence for indicators of spyware, malware, suspicious applications, profiles and other compromise. Where the concern forms part of a wider organisational incident, NSI Global’s Digital Forensics capability can coordinate handset findings with other evidence sources.

Contact NSI Global using a separate trusted device. Within Australia, telephone 1300 000 NSI (674); from the UAE, telephone +971 (0)4 409 6824.

iPhone Lockdown Mode Questions Answered

Does Lockdown Mode Remove Spyware?

No. It reduces exposure by restricting selected features. It is not a removal tool, and turning it on or off does not establish whether spyware was present.

Should Everyone Enable Lockdown Mode?

No. Apple designed it for the small number of people facing exceptionally sophisticated targeted attacks. Most users are better served by current software, a strong passcode, two-factor authentication, disciplined sharing controls and appropriate account security.

Can an iPhone Be Targeted Without the User Clicking a Link?

Yes. Publicly documented mercenary-spyware operations have used zero-click exploit chains. They are rare and highly targeted. More common surveillance concerns can involve phishing, account compromise, unwanted sharing, physical access or misuse of legitimate features.

Will a Factory Reset Preserve Evidence?

No. Erasing an iPhone can destroy artefacts needed to determine what happened. If legal or investigative use is possible, seek advice before resetting the device unless immediate safety requires urgent action.

Is an Apple Threat Notification Proof of Infection?

No. Apple treats it as a high-confidence indication of individual targeting. It should be authenticated, preserved and assessed, but targeting and successful compromise are different conclusions.

Sources and Further Reading

1. Apple: About Lockdown Mode
2. Apple: Threat notifications and mercenary spyware
3. Apple Personal Safety User Guide: using Safety Check
4. Apple: About Stolen Device Protection for iPhone
5. eSafety Commissioner: Online safety checklist

Personal-safety support: In Australia, call 000 in an emergency or 1800RESPECT on 1800 737 732. In the UAE, call Police 999, Ambulance 998, or the Dubai Foundation for Women and Children helpline on 800 111. Use a device and location the suspected person cannot access where possible.

Service eligibility: NSI Global assesses each proposed engagement for lawful authority, scope, safety and conflicts. It does not accept instructions intended to obstruct or interfere with a law-enforcement investigation.