WhatsApp is stepping up its security efforts with two new changes aimed at protecting users from sophisticated spyware attacks. The updates include a new “Strict Account Settings” mode and a deeper, behind-the-scenes shift in how user data is protected.
Together, they signal a stronger focus on safeguarding messages, media, and accounts, especially for users who face higher security risks.
A lockdown-style security option
The headline feature here is Strict Account Settings, a new mode designed to push WhatsApp’s privacy controls to their most restrictive levels.
Once enabled, this mode automatically locks certain account settings and limits how WhatsApp behaves in everyday use. For example, attachments and media from people outside your contacts can be blocked entirely, reducing potential attack surfaces.
WhatsApp says the feature is intended for users who may need extreme safeguards against rare but highly targeted cyber attacks. Journalists, activists, and other public-facing individuals are cited as examples, though anyone will be able to turn it on once the rollout is complete.
You can find the setting under Settings > Privacy > Advanced.
Security without user intervention
Even if Strict Account Settings sounds too restrictive for daily use, WhatsApp has also improved security in a way that requires no action from users at all.
The company says it has rolled out Rust as part of its internal infrastructure to better protect photos, videos, and messages from spyware. Rust is known for its strong memory safety guarantees, which help reduce entire classes of vulnerabilities commonly exploited by malicious software.
Related: WhatsApp to Let Users Share Recent Chat History With New Group Members
This change happens entirely behind the scenes and applies to all users, regardless of whether they enable the new strict mode.
Who should actually use this
For most people, WhatsApp’s default security settings will remain sufficient. Strict Account Settings is clearly aimed at edge cases where the threat model is much higher than normal.
That distinction matters. By offering an optional lockdown mode instead of forcing stricter behavior on everyone, WhatsApp avoids breaking everyday workflows while still giving vulnerable users stronger defenses when they need them.
The 404 take
Strict Account Settings is not a feature most users will ever turn on, and that is fine. Its real value is in acknowledging that not all users face the same risks.
More interesting is WhatsApp’s move to Rust behind the scenes. That kind of foundational security work rarely gets attention, but it often does more to protect users than flashy new toggles.
Between the two, WhatsApp is clearly signaling that spyware resistance is becoming a bigger priority, even if most of the work stays invisible.
