You have many features to protect your computer for free on Windows 11. For example, you can use the Microsoft Defender Firewall to secure your device from unauthorized network access and add two-step verification and biometric authentication to strengthen the account sign-in process. It’s also possible to enable data encryption with BitLocker to make your files unreadable to others. The Microsoft Defender Antivirus is among the best antivirus you can use to keep viruses, spyware, rootkits, and ransomware out. You can create regular backups to protect the device and files from any form of attacks and hardware failure. Updating your apps and Windows can also help keep the computer secured as they provide security patches and improvements. And you can use common sense habits to stay protected, such as don’t click unknown links from emails, don’t download unlicensed software, and don’t use USB or external drives that you don’t own. In this guide, you will learn the best ways to protect your device and files from malware and hacker attacks on Windows 11.
Protect your computer securing account on Windows 11 Protect your computer in the network on Windows 11 Protect your computer using data encryption on Windows 11 Protect your computer against viruses and ransomware on Windows 11 Protect your computer by installing updates for apps and Windows 11 Protect your computer by creating periodic backups on Windows 11 Protect your computer with common sense tips on Windows 11
Protect your computer securing account on Windows 11
On Windows 11, you can protect your account in many ways. If you use a local account, you can improve security by switching to a Microsoft account. You can enable two-step verification to add a physical layer of sign-in security. You can enable the modern passwordless option to sign in by simply using the Microsoft Authentication app. And you can set up Windows Hello to secure access to your account using biometric authentication, such as your face. Another way you can protect your account is by switching to a standard account to limit system access to prevent misconfiguration or apps running in administrator mode that could cause problems. You would still have an administrator account, but only to perform administrative tasks. Finally, if you are in an environment with a lot of people, you can also configure “dynamic lock,” a feature that uses Bluetooth devices (such as your phone or watch) to lock the computer automatically as you step away from the device.
Switch from local account to Microsoft account
Although it might sound illogical, switching to a Microsoft account can improve security since you can implement other security features like two-step verification and passwordless sign-in. Also, it makes it easier to reset the login password if ever lost or compromised. To link a Windows 11 local account with a Microsoft account, use these steps: Once you complete the steps, the local account will link to your Microsoft account.
Enable two-step verification authentication
The two-step verification (or “two-factor authentication” (2FA)) feature adds a second form of identification using the Microsoft Authenticator app on your phone to sign in to your account on Windows 11, making it virtually impossible for someone else to gain unauthorized access to your computer. To set up two-step verification on your Microsoft account, use these steps: After you complete the steps, the next time you try to sign in to Windows 11 with a password, you will need to authenticate with the Microsoft Authenticator app on your phone.
Enable passwordless option
If you use a Microsoft account to sign in to Windows 11, you can also remove your password from the account to enable the passwordless experience. This means that you will use the Microsoft Authenticator app, Windows Hello, security key device, text message by phone, or email verification to sign in to your account without a password. This feature works in combination with two-step verification. If you don’t have the feature enabled, turn on two-step verification and continue with the steps below. To enable the passwordless experience on Windows 11 with your Microsoft account, use these steps: Once you complete the steps, you can start signing in to your account without a password.
Enable Windows Hello authentication
To configure Windows Hello facial recognition to unlock a computer with your face, use these steps: After you complete the steps, you can lock your device (Windows key + L) and then look into the camera to sign in.
If the sign-in experience is not working as expected, under the “Facial recognition (Windows Hello)” setting, you will now find an “Improve recognition” option that you can use to keep training the system to detect your face better. Alternatively, you can also set up a fingerprint reader if you don’t have a camera that supports Windows Hello.
Switch to standard account and use admin only for management
Windows 11 offers two types of accounts, including “Administrator” and “Standard User,” with different levels of permissions to manage apps and the system. The Administrator account has unlimited access, giving users the ability to change system settings, run elevated tasks, and everything else. The Standard User account offers a more restrictive environment. A user with this level of privileges can work with apps, but it cannot install anything else. Also, they can change settings, but not system settings or settings that will affect all users. Since using an account without limits can be a security risk, switching to a standard account is recommended to improve security. You can create a new “Administrator” account that you will only use for management and then change your account type to “Standard User.”
Create local administrator account
To create an administrator local account through the Settings app, use these steps: Once you complete the steps, the new account will appear on Windows 11.
Switch to standard account
To change an Administrator account to a Standard Users account on Windows 11, use these steps: After you complete the steps, the original account will switch types from “Administrator” to “Standard User.” If you ever need to make system changes or install new apps, you will be prompted to confirm the administrator credential. Or you can also sign in to the administrator account to perform system changes.
Enable Dynamic Lock
Dynamic Lock is a feature that locks your device when you step away from your desk based on the proximity of a Bluetooth-paired device, such as your phone or wearable, adding another layer of security. There are two parts to this security feature. You first need to pair a Bluetooth device (such as your iPhone or Android phone) to the computer, and then you have to enable Dynamic Lock in the Settings app. To connect a supported Bluetooth like Android or iPhone to Windows 11, use these steps: Once you complete the steps, if your Bluetooth device isn’t near the computer, Windows 11 will wait 30 seconds and then turn off the screen and lock the account to secure your computer.
Protect your computer in the network on Windows 11
On Windows 11, hackers usually gain access to a device by exploiting software vulnerabilities and poor security configuration. To keep your computer secure, you want to ensure that the default Microsoft Defender Firewall is turned on. You want to change the network profile to “Public” mode when in a public place or untrusted environment. Also, if you are not using Bluetooth, you should keep it disabled as it could be another backdoor that nearly malicious individuals can exploit to steal information or gain unauthorized access to your computer. (It’s rare, but it could happen.)
Enable firewall to block ports
On Windows 11, the Microsoft Defender Firewall is a feature that checks incoming and outgoing network traffic to allow or block traffic depending on predefined rules to protect your device from unauthorized access. The feature is enabled by default, but it’s always a good idea to check and enable it as necessary. To enable the firewall on Windows 11, use these steps: After you complete the steps, the Windows 10 firewall will enable again on your device.
Change network profile type to Public mode
On Windows 11, you can use different network profile types with specific settings to improve security or share files, printers, and other resources in the network. The feature provides three network profiles, including Private, Public, and Domain. The Private and Public are available for all computers, and the Domain is only available when a device is joined to the domain. The Private profile is tailored for trusted networks like your home or work. This profile makes the computer discoverable for file sharing, network printing, and sharing other resources with people you trust. The Public profile makes the device invisible in the local network. This option is recommended for most locations, including public places, work, and home. If you want to add an extra layer of security, you should always set the profile type to Public. Unless you need to share resources in the network with people you trust.
Change network profile type for Ethernet
To change the Windows 11 network profile type to protect your computer, use these steps:
Change network profile type for Wi-Fi
To change the network profile type for a wireless connection, use these steps:
Public: Your device is not discoverable in the local network. You should use this option in most locations, such as home, work, or public places. Private: Your device is discoverable in the local network. You would use this option to share files or other resources like printers over a trusted local area network.
Once you complete the steps, the connection will apply the profile type you select.
You can only change profile type per network. If you have an Ethernet and Wi-Fi connection connected to the same network, the new setting will not apply to all network adapters when changing the profile type. On Windows 11, it’s also possible to change the network profile type using the Registry and PowerShell.
Turn off Bluetooth and Wi-Fi when not needed
Any available wireless connection can be used to attack a device. If you are in a public place like a coffee shop or airport, and you only need to use an application without internet, you can always turn off Bluetooth and Wi-Fi to work more securely. Once you are in a secure environment, you can turn the wireless radios back on.
Disable Bluetooth on Windows 11
To turn off Bluetooth to protect your computer, use these steps: Alternatively, you can open the Quick Settings flyout using the Windows key + A keyboard shortcut and click the Bluetooth button to disable it. You can click the button to enable the feature again.
Disconnect Wi-Fi on Windows 11
On Windows 11, you can disconnect from a wireless network in several ways. You can turn off the wireless adapter using the dedicated button on a laptop (if available). You can disable the adapter from the “Network & Internet” settings. Or you can disconnect from the Settings app or “Quick Settings” flyout. To disconnect from a Wi-Fi network on Windows 11, use these steps: Alternatively, you can open the Quick Settings flyout using the Windows key + A keyboard shortcut and click the Wi-Fi button to disconnect. You can click the button again to enable the feature again.
Protect your computer with data encryption on Windows 11
BitLocker is a security feature that allows you to use encryption on a drive to protect your data from unauthorized access to your documents, pictures, and any data you may have on the computer. On Windows 11, the feature is only available in the Pro, Enterprise, and Education edition. However, on Windows 11 Home, you can use device encryption on some devices like Surface Pro 8, Laptop 4, and others.
Enable device encryption on Windows 11 Pro
To configure BitLocker on a Windows 11 drive, use these steps: After you complete the steps, the computer will restart to apply the settings and enable BitLocker.
You can also enable encryption for secondary and external drives. And using BitLocker To Go, you can protect your data on USB flash drives.
Enable device encryption on Windows 11 Home
To configure BitLocker encryption on Windows 11 Home, use these steps: Once you complete the steps, the feature will encrypt the entire system drive.
If you no longer need encryption, it’s possible to decrypt the drive with the same instructions.
Protect your computer against viruses and ransomware on Windows 11
Viruses are still among the biggest security threats on Windows 11, Windows 10, and other versions. As a result, it’s always recommended to have an antivirus solution installed and updated on your computer. Although almost every third-party antivirus is now capable of protecting your device from threats (such as viruses, spyware, ransomware, rootkits, and other types of malware and hackers), Windows 11 comes with the Microsoft Defender Antivirus, which is considered one of the best antivirus applications for home and commercial users.
Install an antivirus
On Windows 11, you technically don’t need to spend money on an antivirus, but you can always opt for a third-party solution that may include other features to up the security of your device. For example, Symantec’s Norton Antivirus, AVG, Avira, BitDefender, and McAfee.
Enable periodic scanning
If you choose to use a third-party solution, you can also enable the “Periodic Scanning” feature from Microsoft Defender Antivirus. When you enable the feature, the default antivirus will remain disabled. However, the system will periodically scan the system to add a second line of defense to detect threats that your current solution may not be able to detect. To enable “periodic scanning” on Microsoft Defender Antivirus for Windows 11, use these steps: After you complete the steps, the Windows 11 antivirus will use the “Automatic Maintenance” feature to run the scans at optimal times to minimize the impact on performance and battery life.
Perform a full antivirus scan
If you choose to stay with the Microsoft Defender Antivirus, the anti-malware software will proactively monitor and protect your computer and files from virtually any type of malware. However, sometimes, it might still be necessary to perform a complete scan of the device to ensure that the installation hasn’t been compromised. To perform a full virus scan on Windows 11, use these steps: Once you complete the steps, the antivirus will scan the computer for viruses and other types of malware. If anything is detected, Microsoft Defender Antivirus will automatically remove (or quarantine) the threats.
If the computer is already infected, you can use the Microsoft Defender Offline scan to detect and remove viruses that the antivirus may not be able to remove while Windows 11 is fully loaded.
Enable reputation-based protection
Windows Security also includes a feature to protect your computer against unwanted malicious apps. The feature is known as “reputation-based protection” that can detect and block low-reputation apps that may cause unexpected behaviors on Windows 11, such as poorly designed apps or apps that cause harm. To enable reputation-based protection for unwanted apps on Windows 11, use these steps: After you complete the steps, Windows 11 will be able to detect and block apps with a low reputation that may cause problems.
Enable ransomware protection
Windows 11 also has the “Controlled folder access” feature to protect your files against ransomware. Ransomware is a fairly new form of malware that encrypts the files on a computer, making the data inaccessible and unreadable. Once the attack is successful, the malicious individual will demand ransom to unlock the device and files. Controlled folder access monitors the changes apps make to your files on Windows 11. If an app tries to modify the files inside a protected folder and the app is blacklisted, you will get an alert about the suspicious activity. To enable the ransomware protection on Windows 11, use these steps: Once you complete the steps, Microsoft Defender Antivirus will monitor the protected folders as applications try to modify your files. If suspicious activity occurs, you’ll get a notification about the threat.
You can also configure various aspects of the features. You can also allow apps you trust that the system mistakenly blocked, add more folder locations and drives to the protection list, and it’s possible to disable the feature if it’s not working as expected.
Enable core isolation protection
As part of the device security, Windows 11 also ships with “core isolation,” a virtualization-based security feature that isolates core processes in memory from malicious code to protect memory integrity. On Windows 11, core isolation should be enabled by default, but it’s not always the case. However, if you cannot enable the feature, the problem could be a compatibility issue with a driver. To enable core isolation on Windows 11, use these steps: After you complete the steps, the device will have an extra layer of protection to prevent attacks from adding malicious code into high-security processes.
Protect your computer by installing updates for apps and Windows 11
One of the best ways to protect your computer is to ensure that Windows 11 and apps always have the latest security and maintenance updates. The reason is that cumulative updates are essential to fix bugs, patch security vulnerabilities, and improve system performance. Windows Update usually applies updates automatically on Windows 11, but you may still need to check and install them manually.
Install updates on Windows 11
To install security and maintenance updates on Windows 11, use these steps: Once you complete the steps, it will download and install automatically on your computer if an update is available.
Install updates for Microsoft Store and other apps
Updates are also essential for applications as they can improve security, fix bugs, improve performance, and introduce new features. If you use apps from the Microsoft Store, they will update automatically. Depending on the app, if you have desktop apps, they will also automatically receive updates. However, you may need to download and install those automatically in some cases. To check and download updates for Microsoft Store apps, use these steps: After you complete the steps, the Microsoft Store app will check and download any available updates for the apps.
If you have a classic desktop application, you may receive a notification to update the software manually. However, you can usually check for updates from the “Help” or “About” menu. If you can’t find the option, you can always check the manufacturer documentation website for more information.
Protect your computer by creating periodic backups on Windows 11
On Windows 11, a full backup creates a copy of the entire system that allows you to recover in case of critical system problems, malware attacks like ransomware, hardware failure, or when you are upgrading the primary drive. In addition, a backup can help you roll back to a previous installation after upgrading to a new feature update or an entirely new version. You can always choose a third-party solution (such as Macrium Reflect or Veam), but you can still use the (deprecated) legacy “System Image Backup” tool to save a full backup to a USB hard drive. To create a full backup of a computer running Windows 11, use these steps: Once you complete the steps, a full backup of the Windows 11 device will be created with the installation files, settings, applications, and personal files.
You will also receive the option to create a repair disk, but you can ignore it since you can use the Windows 11 bootable media to access the recovery settings to restore the backup. In addition to periodically backup your computer, it’s also recommended to use third-party services like OneDrive to store your files in the cloud. This approach will protect the files from hardware failure, ransomware, or theft. Alternatively, copying your files to an external drive with a simple copy and paste (as long as you don’t have a lot of data) is another way to protect your documents, pictures, videos, and other files.
Protect your computer with common sense tips on Windows 11
The majority of the time, devices get attacked by hackers and malware due to unpatched vulnerabilities in the system or accidental actions by the user, such as clicking a specially crafted link or attachment on an email or installation of a malicious application. As a rule of thumb, only check emails from people you know and senders that are easy to identify. Usually, you can determine that an email is malicious because it is poorly crafted with weird fonts and grammar errors. Also, the source email address will not match the situation. If you find anything suspicious, click the delete button. You can also open the door to malware or malicious individuals by clicking a specifically crafted pop-up online. Although many websites use pop-ups for advertising services and products, some websites may use this technology to confuse users into clicking an application that could infect the computer in many different ways. Usually, you only need to worry about specifically crafted pop-ups and links when browsing unsecured and untrusted websites. Whenever possible, avoid browsing not secure and untrusted websites. You would typically know if a website is not secure because the site address will start with “HTTP” in the address bar instead of “HTTPS.” Also, Chrome, Edge, Firefox, and most modern websites will alter you that the site is not secure with the “Your connection is not private” message. If the website is known to be untrusted, modern browsers won’t even let you open the site. However, the web has countless untrusted websites, and you can easily spot them because of the countless pop-ups and inappropriate advertisements. Also, avoid installing software from untrusted sources. You should only be using the Microsoft Store to download apps on Windows 11. If you install unlicensed software, you will be at a higher risk of getting the device compromised with malware and other malicious code. Finally, you should never connect USB or external drives that you don’t own to your computer. If this is the case, you should consider using a spare computer to format the drive to make sure it’s clean of viruses.
Wrapping things up
This guide shows you many steps you can use to protect your computer against viruses and hackers. However, it’s not necessary to implement all these recommendations in most cases. You can always pick and choose the ones you consider will be most effective in your situation. For example, if you have a device in a secure environment, you probably don’t need to configure the “dynamic lock” feature. If you don’t have a camera with support for Windows Hello Face, using a fingerprint reader or PIN should be more than enough protection. If you decide to use the built-in ransomware protection and get a lot of false positives, you may need to consider switching to another solution or disabling the feature. All content on this site is provided with no warranties, express or implied. Use any information at your own risk. Always backup of your device and files before making any changes. Privacy policy info.
