- WhatsApp launches Strict Mode or Strict Account Settings as a "lock mode" to maximize protection.
- Block files and media from unknown senders, silence unsaved calls, and limit who can add you to groups.
- It strengthens profile privacy, requires two-step verification, and disables link previews.
- It is primarily intended for high-risk users in Spain and Europe, although anyone can activate it from Settings > Privacy > Advanced.
WhatsApp has begun rolling out a new security setting in Spain and the rest of Europe known as Strict Mode or Strict Account Settings . This security switch consolidates the app's most restrictive measures in one place for users who suspect they may be the target of targeted cyberattacks.
This system acts as a kind of "lock mode" that maximizes account security: when activated, the application applies multiple barriers at once to stop spyware, advanced phishing attempts, and unwanted communications. Although it was designed with journalists, activists, and public officials in mind, it is available to any user who wants to increase their level of protection.
What is WhatsApp's new strict mode?
Strict mode acts as a global security switch . Instead of manually enabling each privacy option, the user only needs to turn on this setting for WhatsApp to apply the strictest settings available for the account, always based on the end-to-end encryption that the app already uses by default in chats.
With this approach, WhatsApp aims to close off the main entry points used in advanced attacks , including those that rely on phishing files, malicious links, or highly sophisticated digital espionage campaigns, including scams like the "child in distress" fraud . The idea is to minimize the attack surface without forcing the user to navigate through all the menus.
Meta's company is thus aligning itself with what other major tech players have already done: Apple introduced a similar strict mode in 2022 , and Google has long offered advanced protection modes for high-risk profiles. In WhatsApp's case, the focus is on instant messaging and everything surrounding it: calls, groups, files, and profile visibility.
However, the platform itself warns that using this mode involves accepting certain inconveniences in daily use. Part of the social aspect of the app is sacrificed in exchange for increased security, something that may be excessive for those who only use WhatsApp casually.
Main changes when you activate Strict Account Settings
Once strict mode is activated, the application automatically applies a series of limitations designed to block the most frequent attacks. The key is that the most restrictive behavior becomes the norm , without the user having to review each option individually.
One of the most noticeable changes affects messages from unknown senders: attachments, photos, videos, and other multimedia content sent from numbers not in your contacts are blocked . This effectively stops malicious files that try to sneak in from unknown senders.
In terms of calls, the system is equally effective. Calls from unsaved numbers are automatically silenced , reducing both spam and phantom calls that some attackers use to check if a number is active or to initiate a scam.
This setting also affects groups. With strict mode enabled, it limits who can add you to group chats : only contacts you have saved or very specific options you define can add you. This prevents you from being added to large, unknown groups for the purpose of fraud, harassment, or spreading dangerous links.
Links are also affected. The new mode disables URL previews , so the app no longer automatically generates preview cards. This reduces risks such as indirect IP address leaks or unexpected behavior when loading remote content, which is especially sensitive in advanced surveillance scenarios.
Enhanced privacy, two-step verification, and technical protection
Beyond blocking incoming content, Strict Mode introduces internal adjustments to strengthen profile privacy and account integrity . One of its key features is two-step verification, which goes from being a recommendation to an active requirement while Strict Account Settings is enabled.
Enabling this mode activates and maintains two-step verification permanently , making it much harder for an attacker to take over the account even if they obtain the initial SMS code. The platform also suggests combining this with end-to-end encrypted backups for those using cloud backups.
The exposure of personal data is also reduced. With this enhanced profile, the profile picture, last seen time, and information section are only visible to saved contacts or a very restricted group of users who can choose to access them. This makes it more difficult for strangers to gather information about your activity or identity from the public information on your account.
On a more technical level, WhatsApp has internally incorporated the Rust programming language into processes related to file analysis . Rust has become popular for its memory-safe design, which helps reduce vulnerabilities that could be exploited when processing malicious documents, images, or videos.
Thanks to this integration, photos, videos, and documents that are shared or received undergo additional checks before reaching the device, with the aim of detecting suspicious behavior or signs of sophisticated spyware. All of this happens transparently to the user, adding an extra layer of protection without changing the usual way of chatting.
More secure calls and encryption alerts within chats
The strict mode package of measures also touches on how voice communications and security warnings are handled, with the purpose of further complicating tracking and detecting possible tampering in encrypted conversations.
When this setting is enabled, certain calls can be routed through WhatsApp's own servers , instead of always establishing a direct connection between devices. This introduces an intermediary layer that makes it more difficult for an attacker to accurately deduce the user's location from network data.
At the same time, the app is giving more prominence to warnings about security changes. If modifications are detected in a contact's encryption codes within a chat, the app displays prominent alerts so the user can confirm that nothing unusual is happening, such as an attempt to intercept the communication.
This entire set of settings means that, with a single step, the account will operate in a much more controlled and monitored environment . However, nothing is irreversible: from the same privacy menu, you can deactivate Strict Account Settings at any time and return to a more flexible usage.
Even so, WhatsApp admits that certain habits change significantly when this mode is turned on. Common things like accepting calls from unsaved numbers or receiving files from new contacts become much more restrictive , something worth considering before leaving it permanently active.
Who should use strict mode and how is it activated in Spain and Europe
Meta emphasizes that this is not a feature designed to be enabled by default on all accounts , but rather a tool intended for profiles facing a clear risk of targeted cyberattacks. These groups include investigative journalists, activists, human rights defenders, political figures, and individuals handling particularly sensitive information.
Even so, any user in Spain or the rest of Europe who believes their account might be under surveillance or who prefers a more secure environment can activate strict mode as soon as the option appears on their device. The decision is entirely voluntary and will depend on the context and each person's tolerance for additional restrictions.
The activation process is relatively simple. When the feature is available, go to Settings > Privacy > Advanced (in some cases it may appear as Advanced Options or Strict Account Settings) and enable the new Strict Account Settings. This change can only be managed from the primary device, not from WhatsApp Web or linked sessions.
The company has confirmed that the rollout of strict mode is gradual on both Android and iOS . This means that some Spanish or European users may not yet see the option on their phones, while others already have it available. It is expected to gradually reach more accounts in the coming weeks.
Once activated, the user can review and deactivate strict mode as needed , without losing basic protections such as end-to-end message encryption. This allows for its occasional use during high-risk situations, followed by a return to a more convenient configuration.
With this new Strict Account Settings, WhatsApp takes another step in its strategy of prioritizing privacy and security, offering European and Spanish users a single button that centralizes the platform's most stringent defenses . Blocking suspicious files, strict control of calls and groups, reduced profile exposure, mandatory two-step verification, and additional technical checks are combined in a mode designed for those who cannot afford any mistakes. At the cost of some convenience, the application thus offers a much more secure environment for those times when protection outweighs digital social interaction.
