Phone security advice usually covers unlikely threats. These are the settings that address what actually happens to people.
A proper lock
Six digits minimum, not four, and not a pattern – patterns are readable from finger grease on the screen and from a distance.
Biometrics are convenient and the code is the fallback. The code is what matters.
Disable lock screen access to sensitive things
By default, many phones allow the notification shade, the control centre and voice assistant from the lock screen. Someone with your locked phone can toggle aeroplane mode, which stops you tracking it.
Turn off lock screen access to settings toggles and to the assistant.
Enable device tracking
Both platforms offer it and it works. The remote erase option is what matters most if the phone is stolen with sensitive material on it.
Protect the recovery path
Your phone number is the recovery route for many accounts. SIM swapping – convincing your carrier to move your number – is a documented attack.
Most carriers offer a port-out PIN or account lock. Setting it takes one call and prevents the attack entirely.
Review app permissions
Particularly location, microphone and camera. Most phones now show which apps accessed what recently, and the list is usually surprising.
Set location to while using rather than always, for everything that does not genuinely need it.
Keep it updated
The single most effective measure. Security patches fix things actively being exploited, and a phone no longer receiving them is the strongest argument for replacing it.