WhatsApp has added an optional mode called Strict account settings, aimed not at ordinary users but at a small group — journalists, activists, public-facing figures — who face targeted, well-resourced attacks.
The company is unusually direct that most people should leave it alone. That framing is correct, and understanding why explains what the mode is for.
What it switches on
Turning it on forces a set of privacy and security options to their most restrictive values and locks them there:
- Two-step verification is enabled, adding a layer when your number is registered.
- Security notifications — the warnings shown when a contact's security code changes — are turned on and cannot be switched off.
- Attachments and media from people not in your contacts are blocked, cutting off malicious files disguised as photos, videos or documents.
- Link previews are disabled, so the app does not fetch anything when a link arrives.
- Voice and video calls from unknown numbers are silenced and do not ring.
The threat model it is built against
Read that list as a description of an attack rather than a set of features and it becomes coherent. It is built against mercenary spyware — the commercial surveillance tools sold to governments and used against named individuals.
Those attacks arrive as a file or a link from a number you do not know, or as a call that compromises the device whether or not it is answered. Blocking media from non-contacts, refusing to fetch link content, and silencing unknown callers removes the three delivery routes that have actually been used in documented cases. The locked security notifications address the other half: knowing when something has changed.
This is the same reasoning behind Apple's Lockdown Mode, and the convergence is not a coincidence. Both companies concluded that the only reliable defence against a well-funded attacker is to switch off the features through which such attacks arrive.
The cost, which is the honest part
Every item on the list breaks something a person legitimately needs.
A journalist's entire job is receiving documents from people who are not in their contacts. A human rights worker takes calls from unknown numbers by definition. Blocking exactly that traffic protects the device by disabling the work.
So the mode is not a free upgrade, and anyone treating it as "security settings I should probably enable" will turn it on, miss something important, and switch it off again. It is a deliberate trade for people whose threat level justifies losing functionality.
What everyone else should take from it
Not the mode — the shopping list. Each protection exists separately in WhatsApp's ordinary settings, and two of them are worth enabling for anybody:
- Two-step verification (Settings → Account), which stops someone who hijacks your number from registering it.
- Silence unknown callers (Settings → Privacy → Calls), which costs almost nothing and removes the most common nuisance and scam vector.
The rest — blocking media from non-contacts, disabling link previews — are worth knowing about and not worth enabling unless you have a specific reason to think you are a target.
Sources: WhatsApp's announcement; TechRepublic; SecurityBrief Asia; AlternativeTo; FutureFive; and Prothom Alo's original report.
