LeakNixDoes an iPhone Need a Security App?
Mostly no. Where the answer is yes, it is not for the reason the App Store listings suggest.
Disclosure: some of the vendor links on this page are affiliate links. If you sign up through one of them we may be paid a commission by that vendor, at no extra cost to you. Prices shown are the vendor’s own and can change.
iOS does not let any app inspect other apps or read the file system, so no iPhone “antivirus” scans for viruses. It cannot. What a security app can do on an iPhone is filter web traffic, warn about phishing links in texts and notifications, check the Wi-Fi you are on, and tell you when your accounts turn up in a breach. Those are real, but most of them overlap with things the phone already does.
So this page is in three parts: what iOS already protects you from and the settings to turn on, what Bitdefender’s iOS app adds on top, and the threats that no app on the phone can cover.
Why there is no real iPhone antivirus
Every app on iOS runs in its own sandbox. It can see its own files and whatever you explicitly share with it, and nothing else. An antivirus app is an app, so it is subject to the same rule: it cannot read your other apps, cannot watch what they do, and cannot scan the system. Apple reviews everything that goes on the App Store, which is a second filter. The result is that mass-market malware of the Windows kind barely exists on iPhones.
What does exist is the expensive kind. Pegasus, from NSO Group, and its competitors break into iPhones through bugs in iMessage or Safari, usually with no click at all, and they are aimed at journalists, dissidents, politicians and the people around them. No App Store app detects that. The defense is updates, which close the bugs, and Lockdown Mode, which removes the attack surface. Both are built in and both are below.
The threats an ordinary person actually meets on an iPhone are phishing links, scam texts, malicious profiles and configuration tricks, account takeover, and their own already-leaked passwords being tried against their accounts. Those are what the rest of this page is about.
The protections already in iOS, and which to turn on
Automatic updates
Settings, General, Software Update, Automatic Updates. Nearly every real iPhone compromise in the last decade used a bug Apple had already fixed or fixed within days. The update is the antivirus.
A long passcode, and Stolen Device Protection
Thieves in bars watched people type four or six digits, took the phone, and had the Apple ID within minutes, because the passcode unlocks everything. Use an alphanumeric passcode and turn on Stolen Device Protection (Settings, Face ID & Passcode). It requires Face ID, not the passcode, for sensitive changes when you are away from familiar places, and adds a one-hour delay before the Apple ID password can be changed.
Fraudulent Website Warning
Settings, Safari (under Apps on recent versions). This checks pages against Google's Safe Browsing list and is the phishing protection most people think they need an app for. It is on by default; make sure nobody turned it off.
Passkeys in iCloud Keychain
Where a site offers a passkey, take it. It cannot be phished, because the signature only works for the genuine domain, and it syncs across your Apple devices. Start with your Apple ID, Google and email accounts.
Security Recommendations for saved passwords
The Passwords app (Settings, Passwords on older versions) flags saved passwords that have appeared in known leaks, using a privacy-preserving lookup. It is the same idea as our check, done continuously for the passwords you have saved on the phone.
Safety Check
Settings, Privacy & Security, Safety Check. Built for people leaving an abusive relationship, useful for everyone: it lists every person and app that has access to your location, photos, and shared data, and lets you cut all of it at once.
Lockdown Mode
Also under Privacy & Security. It turns off the features that sophisticated exploits have used: most message attachment types, link previews, some web technologies, incoming FaceTime from strangers. It is meant for people who may be personally targeted by state-grade spyware. Most people do not need it; if you think you might, this is the control, not an app.
Filter Unknown Senders and Silence Unknown Callers
Settings, Messages, and Settings, Phone. Delivery scams, bank scams and 'Mom, my phone broke' texts arrive from numbers you have never seen. Filtering does not delete them; it stops them looking urgent.
Two more if you pay for iCloud+: Private Relay hides your IP address from sites you visit in Safari, and Hide My Email gives you a throwaway address per signup, which keeps your real address out of the next breach.
What Bitdefender Mobile Security for iOS adds
With the above turned on, what is left for a paid app? Four things, and whether they are worth it depends on who the phone belongs to.
Bitdefender Mobile Security for iOS
Subscription. Price depends on term and device count; check the vendor
Bitdefender's iOS app works around the sandbox by installing a local VPN profile, which lets it see the addresses your apps connect to and block the malicious ones. That gives it web filtering in every app, not only Safari, which is the main thing it has over the built-in warning. Its Scam Alert reads links in incoming texts and calendar invites and flags the bad ones before you tap. Wi-Fi Security checks the network you join for weak encryption and interception. Account Privacy looks up your email addresses in breach data and tells you when one appears in a new leak, which is the same job our free check does once. A small daily VPN allowance is included; unlimited is a paid add-on.
- Web filtering across all apps via a local VPN profile
- Scam Alert for links in texts and calendar invites
- Wi-Fi Security check on networks you join
- Account Privacy breach alerts for your email addresses
- Limited daily VPN traffic included; unlimited costs extra
Who it is for
A parent’s phone, or a relative who taps every link they are sent: yes, the scam alert and app-wide filtering are worth the price, because they work without the person having to notice anything. Your own phone, if you keep it updated and do not tap links in texts: the built-in protections cover you, and the money is better spent on a password manager. A phone that might be targeted by a government or a well-funded adversary: no app helps, use Lockdown Mode.
What no app on the phone can do
Stop a SIM swap
A SIM swap happens at your carrier, not on your phone. Someone convinces the carrier to move your number to their SIM and receives your SMS codes. The defense is a port-out PIN or account PIN with your carrier, and not using SMS as your only second factor for anything that matters.
Un-leak a password
If a password you use has already appeared in a breach, it is being tried against your accounts by automated tools, and no filter on the phone sees that. The fix is to know which passwords leaked and change them. Check your email address to find out.
Stop you typing into a fake page
Filters catch known bad pages. A page that went live this morning is not known yet. What defeats it regardless is a login that cannot be phished, which is what passkeys are for. More on that here.
Protect a phone with a known passcode
If someone has your passcode and your phone, they have your Apple ID, your saved passwords and your photos, and a security app is one more thing they can delete. Stolen Device Protection and a passcode nobody can shoulder-surf are the only answer.
A ten-minute iPhone checkup
- Install any pending iOS update and turn on automatic updates.
- Change a numeric passcode to an alphanumeric one. Turn on Stolen Device Protection.
- Open the Passwords app and act on every Security Recommendation it shows.
- Add a passkey to your Apple ID, your Google account and your main email if they do not have one.
- Run Safety Check and revoke anything you do not recognize.
- Settings, General, VPN & Device Management: if there is a profile you did not install, remove it. This is how some scams gain control of a phone.
- Check your email address for leaks and change any password that comes up.
- Call your carrier and set a port-out PIN.
Questions people ask
Can an iPhone get a virus?
In the Windows sense, where you download a file and it infects the system, effectively no on an un-jailbroken phone. In the sense of a targeted exploit delivered through a message, yes, but that is rare, expensive and aimed at specific people. The everyday risk is not a virus. It is a link you tapped and a password you reused.
Will Bitdefender drain the battery?
The local VPN profile it uses for filtering keeps a lightweight process running. In practice the effect is small, but it is not zero, and if you see it near the top of Battery usage the filtering is why.
Do I need a VPN on my iPhone?
On public Wi-Fi, it stops the network operator seeing which sites you use; everything else is already encrypted by HTTPS. iCloud+ Private Relay covers Safari for less than a VPN costs. For everything else, see the VPN comparison. The Android version of this page is here, and the answer there is different, because Android apps can scan other apps.
The one check no phone setting covers
Your iPhone can be locked down perfectly and your passwords can still be sitting in a breach dump from 2016. Find out.
Check My Email for Leaks