WhatsApp Strict Account Settings: What It Does, How to Enable It, and Should You Turn It On (2026)
WhatsApp Strict Account Settings is a one-tap security lockdown launched January 27, 2026. It automatically applies the most restrictive privacy controls to your account, including blocking media from unknown contacts, silencing unknown calls, disabling link previews, forcing two-step verification, and locking your profile visibility. Find it at Settings > Privacy > Advanced. It is off by default and optional.
WhatsApp launched Strict Account Settings on January 27, 2026. Every article written about it that day describes the announcement, lists the five main restrictions, and stops. None of them explains why each restriction exists, what specific attack it closes, or whether a normal user should actually turn it on.
This guide covers all of that. You get the full list of every setting this mode changes, the specific cyber threats each restriction is designed to block, and a direct answer to the question the announcement articles never address: should you enable it if you are not a journalist or activist?
Also Read on Axeetech: WhatsApp CRM
What Is WhatsApp Strict Account Settings?
WhatsApp Strict Account Settings is an optional high-security mode that locks your account to the most restrictive privacy and security configuration in a single step. WhatsApp describes it as protection for users who face “rare but highly sophisticated cyberattacks.” The primary audience is journalists, activists, public figures, human rights defenders, and dissidents who face targeted surveillance.
The feature sits within a broader industry trend. Apple launched Lockdown Mode for iOS and macOS in July 2022. Google launched Advanced Protection Mode in 2017. WhatsApp’s Strict Account Settings is the messaging-app version of the same concept: trade a small amount of convenience for a significant reduction in attack surface.
Navigation path on both iOS and Android:
Settings > Privacy > Advanced > Strict account settingsThe setting can only be enabled or disabled from your primary WhatsApp device. It is not accessible on WhatsApp Web or linked devices. It is off by default and can be deactivated at any time. Alongside this feature, Meta also migrated WhatsApp’s media-handling library from C++ to Rust in the backend, a change that strengthens security for all 3 billion users whether they enable Strict mode or not.
How to Enable WhatsApp Strict Account Settings (Step by Step)
The full enable sequence takes under one minute on iOS and Android.
- Open WhatsApp on your primary device
- Tap Settings (gear icon at the bottom right on iOS; three-dot menu at the top right on Android)
- Tap Privacy
- Tap Advanced
- Tap Strict account settings
- Tap Next on the information screen that explains what the mode does
- Tap Turn On
- Confirm by tapping Turn On again on the popup confirmation
After confirming, the mode activates immediately. You do not need to restart WhatsApp.
Tip: If you do not see Strict account settings under Settings > Privacy > Advanced, WhatsApp has not yet delivered the feature to your account. The global rollout started January 27, 2026 and reached accounts gradually. Update WhatsApp to the latest version through the App Store (iOS) or Google Play (Android) and check again in the coming days.
Every Setting WhatsApp Strict Mode Changes (The Complete Breakdown)
This is the table that no announcement article built. Every control the mode changes, what the state was before, and what Strict mode locks it to.
Account Security
| Control | Default (Before Strict Mode) | After Strict Mode Enabled |
|---|---|---|
| Two-step verification | Off for many users | Forced ON, locked |
| Security notifications | Optional | Forced ON, locked |
| E2E encrypted backups | Optional | Strongly encouraged |
Messaging and Media
| Control | Default (Before Strict Mode) | After Strict Mode Enabled |
|---|---|---|
| Link previews | ON | Turned OFF |
| Messages from unknown accounts (high volume) | Received | Blocked |
| Media and attachments from unknown contacts | Received | Blocked |
| Calls from unknown contacts | Ring normally | Silenced |
Profile and Presence
| Control | Default (Before Strict Mode) | After Strict Mode Enabled |
|---|---|---|
| Who can add you to groups | Customizable | Locked to most restrictive |
| Last seen and online status | Customizable | Locked to contacts only |
| Profile photo visibility | Customizable | Locked to contacts only |
| About section | Customizable | Locked to contacts only |
| Profile links | Customizable | Locked to contacts only |
Two-step verification and security notifications are not just turned on; they are locked. You cannot disable them while Strict mode is active. This is intentional. The mode removes the ability to accidentally weaken your own security.
Why Each Restriction Exists (What Attack Each Control Closes)
Every control in Strict Account Settings targets a named attack vector. Competing articles list the restrictions. This section explains the threat behind each one.
Media and attachments from unknown contacts blocked
This closes zero-click spyware delivery via maliciously crafted media files. NSO Group’s Pegasus spyware has been delivered through specially crafted WhatsApp images and videos that exploited vulnerabilities in the media parsing layer. The attack executed before the target ever opened the file. No tap, no download, no user action was required. Blocking media from unknown contacts removes this delivery path entirely.
Link previews disabled
This closes two separate threats. The first is metadata leakage. When WhatsApp generates a link preview, its server fetches the target page. The destination server receives your IP address during this fetch. Attackers can use a custom link to fingerprint your real location. The second is zero-click web exploits, where the preview fetch itself encounters a malicious page designed to exploit the preview rendering process.
Calls from unknown contacts silenced
This closes the zero-click call delivery vector. In 2019, attackers exploited WhatsApp by calling targets. The call itself was the attack mechanism. No answer was required. The phone did not need to be picked up. Simply receiving the call triggered the exploit. Silencing calls from unknown contacts removes this entire delivery path while keeping calls from your contacts active.
Two-step verification forced ON
This closes SIM swap account takeover. Without two-step verification, an attacker who obtains control of your phone number through a SIM swap or SS7 infrastructure attack can re-register your WhatsApp on their own device. The platform treats the new registration as legitimate because the phone number matches. With two-step verification active, the attacker also needs your six-digit PIN. The phone number alone is no longer enough.
Security notifications forced ON
This closes undetected man-in-the-middle interception. Your WhatsApp contacts each have a security code tied to their device. If a contact’s security code changes unexpectedly, it means they switched devices or, in a more concerning scenario, their account was re-registered by an attacker. Security notifications alert you to this change. Without them, you could unknowingly send sensitive content to a compromised account.
Profile visibility locked
This closes OSINT (Open Source Intelligence) reconnaissance. Before attacking a specific target, attackers gather information using public-facing data. Last seen timestamps reveal behavioral patterns. Online status confirms when the target is active. Profile photos, About sections, and profile links provide identification and social engineering material. Locking all of these to contacts only removes the reconnaissance layer.
Group add restrictions
This closes forced entry into phishing and surveillance group chats. Without restrictions, any account can add you to a group. Attackers use this to expose you to malicious content, track group membership, or run social engineering campaigns against you in a group context you did not choose to join.
What Strict Account Settings Does NOT Affect
Understanding what the mode does NOT change is just as important as understanding what it does.
Warning: Strict Account Settings only restricts interactions with accounts NOT in your contacts. Your existing conversations with people you know are completely unaffected. Media from friends, family, and work contacts continues to arrive normally. Calls from your contacts ring as usual.
The following remain unchanged regardless of whether Strict mode is on:
End-to-end encryption is already active for all WhatsApp users. Strict mode does not add or change encryption. It was already there before this feature existed.
Messages, media, and calls from people in your contacts are fully unaffected. The restrictions apply only to unknown accounts.
Existing chat histories are not touched. Strict mode does not delete, hide, or alter any conversation already in your account.
WhatsApp Web sessions remain usable. Strict mode only prevents you from managing the setting from WhatsApp Web. You can still browse, send, and receive through WhatsApp Web normally.
Should You Enable WhatsApp Strict Account Settings?
No announcement article gave a direct answer to this question. Here is one.
Enable it immediately if:
- You are a journalist, activist, lawyer, politician, corporate executive, nonprofit worker, or public figure
- You communicate with sources, whistleblowers, or any contact whose information puts them at risk
- You receive regular unsolicited messages, calls, or media from unknown numbers
- You have not already enabled two-step verification and want a guaranteed way to enforce it
Consider enabling it if:
- You want maximum privacy and the restrictions on unknown contacts do not affect your actual use
- You want all four profile visibility settings locked at once without adjusting each one manually
- You want the profile lockdown, forced 2SV, and silenced unknown calls without thinking about it again
The trade-offs are minor:
- Unknown contacts cannot send you media (your contacts are completely unaffected)
- Link previews from strangers do not appear (you can still open any link manually)
- Unknown calls are silenced and appear in missed calls (they do not disappear; they just do not ring)
For most average users, the restrictions only affect contacts NOT in your phonebook. If you mostly communicate with known contacts, the practical effect of Strict mode on your day-to-day WhatsApp experience is close to zero. The forced two-step verification alone is worth enabling for the account security improvement.
The individual controls option: If you want specific protections without the full lockdown, go to:
Settings > Privacy > AdvancedThere you can individually toggle off link previews, block unknown account messages, or block unknown media without activating full Strict Account Settings.
Advanced Chat Privacy (The Companion Feature That Launched the Same Day)
WhatsApp launched Advanced Chat Privacy on the same day as Strict Account Settings: January 27, 2026. They are two distinct features targeting different concerns.
The key difference: Strict Account Settings is an account-wide lockdown you set once. Advanced Chat Privacy is a per-conversation setting that any participant can enable for a specific chat.
What Advanced Chat Privacy does:
- Prevents any participant in the chat from exporting the conversation to a file
- Prevents copying messages out of the conversation
- Prevents AI features from accessing the chat content
What it does NOT prevent:
- Screenshots (WhatsApp cannot block screen captures at the OS level)
- Manual retyping of messages
How to enable it for a specific chat:
- Open the individual chat or group chat
- Tap the contact name or group name at the top of the chat
- Tap Advanced Chat Privacy
- Toggle it ON
Advanced Chat Privacy can be set differently for each conversation. You might enable it for sensitive work chats while leaving it off for casual group conversations. Strict Account Settings applies to your whole account in one switch.
The Rust Migration: What Changed in WhatsApp’s Backend for All Users
Alongside the user-facing features, Meta announced a backend change that protects all 3 billion WhatsApp users whether or not they enable Strict Account Settings.
Meta migrated WhatsApp’s media-handling library, called wamedia, from C++ to Rust. This replaced 160,000 lines of C++ code with 90,000 lines of Rust. Meta described it as “the largest rollout globally of any library written in Rust.”
Why this matters: Rust is a memory-safe programming language. Memory-safety vulnerabilities are the most commonly exploited category of software bugs. When an application processes a file, memory management errors can allow attackers to hijack execution. C++ is prone to these errors. Rust eliminates entire categories of memory bugs by design.
What wamedia does specifically: The library validates that incoming media files actually match the format they claim to be. A file claiming to be a JPEG that contains something else is caught before it reaches the OS-level media libraries. This acts as a filter for maliciously crafted files before they ever enter the vulnerable processing layer.
Historical context: The 2015 Stagefright vulnerability exploited media parsing at the Android OS level. Attackers sent specially crafted media files that executed code before the user opened them. Similar techniques were used in WhatsApp exploits over the following years. The wamedia Rust library places a validation checkpoint between incoming media and the libraries that Stagefright-style attacks targeted.
This change required no action from users. It is active for every WhatsApp account on the planet.
How WhatsApp Strict Mode Compares to Apple Lockdown Mode and Google Advanced Protection
WhatsApp Strict Account Settings is the third major platform to offer an optional high-security mode for users facing targeted attacks.
| Feature | WhatsApp Strict Settings | Apple Lockdown Mode | Google Advanced Protection |
|---|---|---|---|
| Platform scope | WhatsApp app only | iOS, iPadOS, macOS system-wide | Android system and Google account |
| Launch date | January 27, 2026 | July 2022 | 2017 |
| Blocks unknown media | Yes | Yes (in Messages app) | Not applicable |
| Disables link previews | Yes | Yes | Not applicable |
| Forces 2FA | Yes | Not applicable | Yes (hardware key required) |
| Default state | OFF (opt-in) | OFF (opt-in) | OFF (opt-in) |
| Who it is for | High-risk WhatsApp users | High-risk device users | High-risk Google account users |
| Can be deactivated | Yes | Yes | Yes |
Apple Lockdown Mode applies system-wide restrictions across all apps and system features. WhatsApp Strict Account Settings is scoped only to the WhatsApp app. For users who need platform-level protection, Lockdown Mode or Advanced Protection Mode provides broader coverage. For users whose primary concern is their messaging security specifically, WhatsApp Strict Account Settings addresses the relevant attack surface.
For more detail on managing privacy and security settings at the system level, the AxeeTech privacy settings guide covers Windows 11 system-wide privacy controls that complement app-level settings like Strict Account Settings.
Why WhatsApp Launched This in January 2026 (The Context)
The timing of Strict Account Settings in January 2026 came with significant context around WhatsApp’s security claims.
A lawsuit was filed in San Francisco federal court in January 2026 alleging that Meta can access WhatsApp messages despite the platform’s end-to-end encryption assurances. The suit claimed that certain message content is accessible by Meta employees.
In the same period, Elon Musk publicly stated that “WhatsApp is not secure” and directed users to switch to X Chat. Telegram founder Pavel Durov also publicly questioned WhatsApp’s security posture in early 2026.
WhatsApp head Will Cathcart responded directly to these claims. He stated that encryption keys are stored on users’ devices and are not held on Meta’s servers, making it technically impossible for the company to read private messages.
Security analysts noted the timing of the Strict Account Settings announcement. Meta’s official position is that the feature adds protection beyond encryption specifically for users facing nation-state level or highly sophisticated attacker threats. The feature does not address the content of the lawsuit’s allegations, which concern encryption implementation rather than user-configurable settings.
Troubleshooting: Cannot Find WhatsApp Strict Account Settings
Problem: Strict account settings does not appear under Settings > Privacy > Advanced
Cause: WhatsApp is rolling the feature out gradually to accounts and regions. Not every account received it on January 27, 2026.
Fix: Update WhatsApp to the latest version through the App Store or Google Play. After updating, return to Settings > Privacy > Advanced and check again. If it still does not appear, the rollout has not reached your account yet. Check back over the following weeks.
Problem: The Advanced section does not appear under Privacy
Fix: Update WhatsApp. Older versions do not have the Advanced section. After updating, Settings > Privacy > Advanced becomes available.
Problem: Strict Account Settings appears on one phone but not on another linked device
This is by design. The feature is accessible only from your primary WhatsApp device. WhatsApp Web, desktop clients, and linked secondary devices do not show the Strict Account Settings option. Any change you make on the primary device applies account-wide.
Frequently Asked Questions
What does WhatsApp Strict Account Settings do?
WhatsApp Strict Account Settings locks your account to the most restrictive privacy and security configuration with one toggle. It blocks media and attachments from unknown contacts, silences calls from unknown numbers, disables link previews, forces two-step verification on and locks it, forces security notifications on and locks them, restricts who can add you to groups, and locks your last seen, profile photo, About section, and profile links to contacts only. It does not affect communications with people already in your contacts.
How do I enable WhatsApp Strict Account Settings?
Open WhatsApp on your primary device. Tap Settings, then Privacy, then Advanced, then Strict account settings. Tap Next on the information screen, then Tap Turn On, then confirm by tapping Turn On again on the popup. The setting is active immediately. It can only be enabled or disabled from your primary device and cannot be accessed from WhatsApp Web.
Why can’t I find WhatsApp Strict Account Settings?
WhatsApp rolled the feature out gradually beginning January 27, 2026. If it is not visible under Settings > Privacy > Advanced, two steps may help. First, update WhatsApp to the latest version through the App Store or Google Play. Second, the rollout may simply not have reached your account or region yet. Check again over the following days or weeks after updating.
Should regular users enable WhatsApp Strict Account Settings?
Yes, for most users the trade-offs are minor enough to justify enabling it. The restrictions only apply to accounts NOT in your contacts, so existing conversations with friends, family, and work contacts are completely unaffected. The forced two-step verification alone is worth enabling as an account security improvement. If you regularly receive messages or calls from unknown numbers, enabling Strict mode also silences unknown callers and blocks unknown media automatically.
Does WhatsApp Strict Account Settings affect messages from contacts?
No. Strict Account Settings only restricts interactions from accounts that are not in your contacts. Messages, media, calls, and group activity from people you have saved in your phonebook are completely unaffected. Your existing conversations continue normally. The mode applies restrictions to unknown or unsaved accounts only.
Can I disable WhatsApp Strict Account Settings after turning it on?
Yes. Go back to Settings > Privacy > Advanced > Strict account settings on your primary device and toggle it off. The mode can be deactivated at any time. After deactivation, your settings return to your previous configuration, though two-step verification remains enabled regardless because disabling it would reduce your security level.
What is the difference between Strict Account Settings and Advanced Chat Privacy?
Strict Account Settings is an account-wide lockdown that applies across all conversations and interactions in a single toggle. Advanced Chat Privacy is a per-conversation setting that any participant can enable for a specific chat. Advanced Chat Privacy prevents exporting chat content and stops AI features from accessing the conversation. It does not block unknown contacts or enforce 2SV. Both features launched on January 27, 2026.
Does WhatsApp Strict Account Settings work on WhatsApp Web?
WhatsApp Web sessions remain fully usable with Strict Account Settings enabled. The restriction is only that you cannot manage or toggle Strict Account Settings from WhatsApp Web or a linked device. The setting must be accessed from your primary WhatsApp device. Once enabled, it applies to your entire account including Web sessions.
What is Advanced Chat Privacy in WhatsApp?
Advanced Chat Privacy is a per-conversation feature that prevents participants from exporting chat content to an external file and prevents AI features from accessing conversation content. It is enabled inside individual chats by tapping the contact or group name, then tapping Advanced Chat Privacy and toggling it on. It does not prevent screenshots. Each chat has its own Advanced Chat Privacy setting that any participant can control independently.
What is the Rust migration in WhatsApp and does it affect me?
Meta migrated WhatsApp’s media-handling library, called wamedia, from C++ to Rust. This replaced 160,000 lines of C++ with 90,000 lines of Rust and applies to all 3 billion WhatsApp users regardless of any settings you change. Rust eliminates entire categories of memory-safety bugs that have historically been exploited to deliver spyware through maliciously crafted media files. The wamedia library validates incoming media before it reaches vulnerable OS-level processing libraries. This change required no user action and is active on your account already.
Is a freelance tech writer based in the East Continent, is quite fascinated by modern-day gadgets, smartphones, and all the hype and buzz about modern technology on the Internet. Besides this a part-time photographer and love to travel and explore. Follow me on. Twitter, Facebook Or Simply Contact Here. Or Email: info@axeetech.com