If you are worried that your iPhone has been hacked, avoid treating one unusual symptom as proof of a compromise. Fast battery drain, a warm phone, an app crash, or higher data use can have ordinary explanations. A better approach is to look for concrete account or device changes you did not make, secure anything suspicious, and install current security updates.
Signs that deserve closer attention
Start with events that are difficult to explain through normal iPhone use. Examples include an Apple Account sign-in or verification request you did not initiate, a device you do not recognize on your account, an unexpected password change, messages or purchases you did not make, or a configuration profile you did not install.
Unexpected behavior can still matter, but it needs context. A battery that suddenly drains faster might come from a new app, poor cellular reception, background processing, or an aging battery. A warm iPhone can result from charging, navigation, gaming, video calls, or an iOS update. These symptoms alone do not establish that someone hacked the phone.
Install the latest iOS security updates
Open Settings > General > Software Update and install the newest update available for your iPhone. Security fixes are an important part of iOS updates, and keeping the device current is one of the most useful steps you can take after a security concern.
Also review Automatic Updates so future security and system updates are installed promptly. An outdated iPhone is not automatically hacked, but continuing to run software with known vulnerabilities creates unnecessary risk.
Review the devices connected to your Apple Account
Open Settings and tap your name. Scroll through the devices associated with your Apple Account. Select any device you do not recognize and review its information before removing it from the account.
If you see an unfamiliar sign-in, receive verification codes you did not request, or believe another person knows your Apple Account password, change the password and review your trusted phone numbers. Make sure two-factor authentication is enabled. Never give an unsolicited caller or message sender your password or verification code.
Check for unfamiliar apps and management profiles
Review your installed apps and remove software you do not recognize or no longer trust. Installing apps from the App Store reduces exposure to many common software risks, although no platform can guarantee that every security problem is impossible.
You can also open Settings > General > VPN & Device Management. A configuration or mobile device management profile can legitimately be present on a work or school iPhone. On a personal iPhone, investigate a profile you do not recognize before making changes. Do not remove a profile required by an employer or school without checking with its administrator.
Use Safety Check when another person may have access
If your concern involves an ex-partner, family member, or another person who may have had legitimate access to your information, use Apple’s Safety Check. Go to Settings > Privacy & Security > Safety Check.
Safety Check can review people and apps that receive shared information, devices connected to your Apple Account, account security, and privacy permissions. It also provides an Emergency Reset option for situations where you need to stop sharing broadly and quickly.
Turn on Stolen Device Protection
Stolen Device Protection is useful if you are concerned about someone stealing your iPhone and also learning its passcode. Go to Settings > Face ID & Passcode, enter the passcode, and open Stolen Device Protection.
When enabled, sensitive actions can require Face ID or Touch ID without a passcode fallback, and some account or security changes can require a Security Delay. You can use the standard protection away from familiar locations or choose the option that requires the additional protection everywhere.
Do not rely on consumer antivirus scans to prove the iPhone is clean
iOS isolates apps and restricts the kind of system access that traditional desktop antivirus programs use. An iPhone security app can provide useful services such as unsafe-site warnings, account monitoring, or network features, but a normal App Store app cannot perform an unrestricted forensic scan of every part of iOS.
For the same reason, a security app reporting no problems should not be treated as definitive proof that a sophisticated compromise never occurred.
What to do if Apple sends a threat notification
Apple sends threat notifications to users it believes may have been individually targeted by mercenary spyware. This is very different from seeing a pop-up on a random website that says your iPhone has a virus.
If you receive an Apple threat notification, verify it through your Apple Account rather than following links from an unexpected message. Apple recommends that notified users seek expert security assistance. Preserve potentially relevant evidence instead of repeatedly resetting or altering the device before an expert can evaluate the situation.
Use Lockdown Mode only for serious targeted-threat concerns
Lockdown Mode is an optional, extreme security feature intended for the small number of people who may be personally targeted by highly sophisticated attacks such as mercenary spyware. Most iPhone users do not need it.
If your risk warrants it, open Settings > Privacy & Security > Lockdown Mode and follow the prompts. Lockdown Mode deliberately limits certain websites, messages, invitations, connections, and other features to reduce the attack surface, so it comes with usability tradeoffs.
Be skeptical of fake iPhone security warnings
A webpage claiming that it scanned your iPhone and found several viruses is not reliable evidence of infection. Do not call a phone number, install a profile, download an unknown app, or enter an Apple Account password because a browser pop-up tells you to do so.
Close the page and avoid interacting with the warning. If you already entered a password or verification code into a suspicious site, change the affected password promptly and review the account for unfamiliar devices or activity.
When an erase and restore makes sense
Erasing an iPhone is a major step and should not be the automatic response to ordinary battery or performance problems. First update iOS, secure the Apple Account, review devices and profiles, and determine whether there is concrete evidence of compromise.
If you have a credible security incident and decide to erase the phone, make sure important information is backed up or otherwise preserved first. For a highly targeted or potentially forensic case, seek qualified help before erasing because a reset can destroy evidence that could help determine what happened.
How to reduce the risk of future compromise
Keep iOS updated, use a strong device passcode, protect your Apple Account with two-factor authentication, and turn on Stolen Device Protection. Install apps from trusted sources and be cautious with unexpected links, attachments, configuration profiles, verification-code requests, and sign-in prompts.
For most people, these practical protections are more useful than constantly looking for vague signs of hacking. Focus on verifiable account activity and security settings, and escalate to expert help when there is credible evidence that you have been specifically targeted.
Matthew Roberts created this site to help his friends and family with questions that they might have about how to change the settings on their iPhones. It now serves as an archive of iPhone how-to guides to help anyone that stumbles upon this website.