WhatsApp has rolled out a major security update with the introduction of a new “lockdown” mode aimed at protecting users from sophisticated cyberattacks.
The feature, officially called Strict Account Settings, is designed for users who may be at risk of targeted digital surveillance, such as journalists and public-facing individuals.
When activated, the mode limits several WhatsApp functions to reduce exposure to potential threats. Attachments and media from unknown contacts are blocked, while incoming calls from non-contacts are automatically silenced.
Strict Account Settings also restrict how an account appears to others. Only approved contacts can add users to group chats, and non-contacts are prevented from viewing profile photos, “About” information, and online status.
Meta, WhatsApp’s parent company, said the feature will be rolled out gradually over the coming weeks, adding that most users will not need to enable it.
“We’re always adding more layers of security on WhatsApp,” said Will Cathcart, Head of WhatsApp at Meta. “For the small number of users who may face advanced and targeted cyber threats, we are introducing Strict Account Settings.”
While WhatsApp already uses end-to-end encryption by default, Meta said certain rare and sophisticated malware can be hidden within files such as images, videos, or PDFs. These files may appear harmless but can infect devices to steal data or install surveillance software.
The new feature aims to prevent such attacks by blocking potentially dangerous interactions before they reach users.
One of the most well-known examples of this type of cyberattack is the Pegasus spyware, developed by Israeli firm NSO Group, which uses so-called “no-click” methods to infect devices without user interaction. Following revelations about Pegasus, Meta successfully sued NSO Group and was awarded more than US$167 million in damages.
WhatsApp said it has recently disrupted similar spyware campaigns targeting journalists and civil society members.
Despite the added protection, Meta cautioned that Strict Account Settings significantly restrict account functionality and should only be enabled by users who believe they are at risk of advanced cyber threats.
To activate the feature, users can navigate to Settings > Privacy > Advanced and toggle on Strict Account Settings.
Meta reiterated that the vast majority of WhatsApp users are unlikely to be targeted by such attacks and do not need to enable lockdown mode.
