Windows Security Hardening Guide 2026: Complete Checklist

Windows 11 is reasonably secure out of the box, but default settings prioritize convenience over protection. This checklist walks through every layer — from account credentials to network traffic — with specific settings to change and tools to install. Every recommendation is free and verifiable.

1. Account Security

Use a Password Manager

Writing passwords in a browser or reusing them across sites is the single biggest security risk most people face. Bitwarden stores encrypted passwords locally and syncs across devices. Generate unique 20+ character passwords for every account. The free tier includes unlimited storage and cross-device sync — there’s no reason to reuse passwords.

For offline-first users, KeePassXC stores passwords in a local encrypted database that never touches the cloud. It’s ideal for highly sensitive accounts where you want complete control over the storage location.

Enable Multi-Factor Authentication

Enable 2FA on every account that supports it — email, banking, social media, cloud storage. Prioritize these services:

• Email accounts — if someone gains email access, they can reset every other password
• Cloud storage (Google Drive, OneDrive, Dropbox) — these often contain sensitive documents
• Financial services — banking, PayPal, investment accounts
• Social media — account takeover can damage reputation and spread phishing

Use an authenticator app (Bitwarden Authenticator, Aegis, or Microsoft Authenticator) rather than SMS-based 2FA, which is vulnerable to SIM swapping attacks.

Switch to a PIN or Passkey

Windows Hello lets you sign in with a PIN or biometric (fingerprint, face). A PIN is local to the device — even if intercepted, it can’t be used on another machine. Passkeys go further by eliminating passwords entirely for supported services. Enable Windows Hello in Settings > Accounts > Sign-in options.

2. Device Security

Enable BitLocker Encryption

BitLocker encrypts your entire drive, making data inaccessible without the recovery key. On Windows 11 Pro, enable it in Settings > Privacy & Security > Device Encryption. On Windows 11 Home, standard device encryption covers the OS drive but not external drives.

For encrypting specific files or external drives, VeraCrypt creates encrypted containers that mount as virtual drives when unlocked. This is useful for sensitive documents on shared computers or portable USB drives.

Configure Windows Defender

Microsoft Defender provides real-time protection, cloud-delivered protection, and automatic sample submission. Verify these settings in Windows Security > Virus & Threat Protection:

• Real-time protection — ON (scans files as they’re accessed)
• Cloud-delivered protection — ON (sends suspicious file hashes to Microsoft for fast analysis)
• Automatic sample submission — ON (helps Microsoft improve detection)
• Tamper protection — ON (prevents malware from disabling Defender)
• Ransomware protection — Enable Controlled Folder Access (blocks unauthorized apps from modifying protected folders)

Enable Automatic Updates

Windows updates include security patches for newly discovered vulnerabilities. Delaying updates leaves known exploits unpatched. Configure in Settings > Windows Update > Advanced Options:

• Active hours — set to your working hours to prevent restart interruptions
• Automatic restarts — enable so updates install promptly
• Driver updates — enable to keep hardware drivers patched

For third-party software, use winget upgrade --all from the command line to batch-update installed applications. Or use Patch My PC Home Updater for a GUI-based update tool.

3. Network Security

Configure Windows Firewall

Windows Firewall blocks unauthorized incoming connections by default. Verify these settings in Windows Security > Firewall & Network Protection:

• Domain network — Firewall ON
• Private network — Firewall ON
• Public network — Firewall ON, all incoming connections blocked

Avoid third-party firewall software unless you need advanced rule management. The built-in firewall handles port filtering and application rules effectively.

Enable DNS over HTTPS (DoH)

DNS over HTTPS encrypts your DNS queries, preventing ISPs and network operators from seeing which websites you visit. Enable in Windows Settings > Network & Internet > DNS server assignment:

• Set DNS to Cloudflare (1.1.1.1) or Google (8.8.8.8)
• Enable “DNS over HTTPS” with preferred provider

This also prevents DNS hijacking attacks where malicious networks redirect you to fake versions of legitimate sites.

Use a VPN on Untrusted Networks

Public Wi-Fi networks (cafes, airports, hotels) expose your traffic to anyone on the same network. A VPN encrypts all traffic between your device and the VPN server. For sensitive browsing on public networks:

• Use a reputable VPN service (ProtonVPN free tier offers unlimited data)
• Tor Browser provides free anonymous browsing for maximum privacy
• Disable automatic Wi-Fi connection to unknown networks

4. Privacy Hardening

Reduce Telemetry

Windows collects diagnostic data by default. Reduce it in Settings > Privacy & Security > Diagnostics & Feedback:

• Diagnostic data — set to “Send required diagnostic data” (minimum)
• Tailored experiences — OFF (stops Microsoft from using diagnostic data for personalized ads)
• Inking & typing — OFF (stops sending typing patterns to Microsoft)

For thorough telemetry reduction, use O&O ShutUp10++ (free) which provides a single interface for all privacy-related Windows settings with recommended, limited, and aggressive presets.

Review App Permissions

Windows apps request permissions for location, camera, microphone, contacts, and files. Audit these in Settings > Privacy & Security:

• Location — disable for apps that don’t need it
• Camera/Microphone — review which apps have access; disable for anything suspicious
• Account info — most apps don’t need your Microsoft account details
• Background apps — disable for apps that don’t need to run when closed

Use a Privacy-Focused Browser

Your browser is your primary attack surface. Brave Browser blocks ads, trackers, and fingerprinting by default. For maximum privacy, Tor Browser routes traffic through three encrypted hops. If you prefer Chrome or Edge, install uBlock Origin (ad blocker) and HTTPS Everywhere (forces encrypted connections).

For a privacy-respecting alternative, Vivaldi offers built-in tracker blocking, a built-in ad blocker, and does not track browsing behavior. Opera includes a free unlimited VPN in the browser.

5. Browser Security

Secure Your Browser Extensions

Browser extensions can read and modify everything on every page you visit. Audit installed extensions:

• Remove extensions you don’t actively use
• Check permissions — be suspicious of extensions that request “read and change all your data on all websites”
• Install extensions only from official browser stores
• Keep extensions updated — outdated extensions are common attack vectors

Enable Secure DNS in Browser

Most modern browsers support DNS over HTTPS independently of Windows settings:

• Chrome/Edge — Settings > Privacy > Security > Use secure DNS
• Firefox — Settings > Privacy & Security > DNS over HTTPS → Enable
• Brave — Enabled by default with Cloudflare

Quick Security Checklist

FAQ

Is Windows Defender enough, or do I need third-party antivirus?

For most home users, Windows Defender with cloud-delivered protection and tamper protection enabled provides adequate real-time protection. The free tier of Malwarebytes complements Defender with on-demand scanning. Avoid running two real-time antivirus products simultaneously — they can conflict and reduce protection.

Should I use a free VPN?

Free VPNs have limitations: bandwidth caps, speed throttling, and in some cases, data logging. ProtonVPN’s free tier is the most reputable — no data limit, no logging, and based in Switzerland with strong privacy laws. For consistent daily use, a paid VPN offers better speed, more server locations, and stronger privacy guarantees. Avoid unknown free VPNs that may log and sell your browsing data.

How often should I update my passwords?

The modern recommendation is to NOT change passwords regularly — instead, change them only when there’s a reason (suspected breach, shared with someone, reused). The exception is your email password, which should be strong and unique. Use Bitwarden’s breach report feature to check if any of your passwords appear in known data breaches.

What is Controlled Folder Access and should I enable it?

Controlled Folder Access is a Windows Defender feature that blocks unauthorized applications from modifying files in protected folders (Documents, Pictures, Desktop). It prevents ransomware from encrypting your files. Enable it in Windows Security > Virus & Threat Protection > Ransomware Protection. You may need to whitelist legitimate applications that save files to these folders.

Is Tor Browser safe for everyday browsing?

Tor Browser provides strong anonymity but is slower than regular browsers due to the three-hop routing. It’s best used for specific privacy needs — research, accessing blocked content, or protecting identity. For everyday browsing, a privacy-focused browser like Brave with tracker blocking provides a better speed-to-privacy balance.

Last updated: August 2026. This checklist reflects Windows 11 24H2/25H2 settings and may change with future Windows updates.