Best Ways to Secure Windows 11 From Viruses

The best ways to secure Windows 11 from viruses are to keep Windows Update current, leave Microsoft Defender’s real-time, cloud and tamper protection on, turn on reputation-based protection and Smart App Control, and use a standard (non-admin) account with Windows Hello or passkeys. Add Controlled folder access and an offline backup, and you have stopped the vast majority of malware and ransomware without buying anything.

This guide walks through each setting with its current Windows 11 menu path (version 24H2/25H2, October 2026), explains what it protects against, and answers the common question of whether Windows Defender is enough on its own.

Best Ways to Secure Windows 11 From Viruses: The Settings Checklist

Here is every setting covered in this guide in one place. Work down the list once; it takes about 20 minutes and only memory integrity needs a restart.

How to Protect Windows 11 From Viruses, Step by Step

Open Windows Security by searching “Windows Security” in the Start menu, or go to Settings > Privacy & security > Windows Security > Open Windows Security. Then follow these steps in order.

1. Install all pending updates. Go to Settings > Windows Update and select Check for updates, then install everything including optional driver updates you recognize. Most real-world attacks use vulnerabilities that already have a patch; an updated PC removes those doors. Also turn on “Get the latest updates as soon as they’re available” if you want security fixes earlier.
2. Confirm Defender’s core protections. In Windows Security, open Virus & threat protection > Virus & threat protection settings > Manage settings. Make sure Real-time protection, Cloud-delivered protection, Automatic sample submission and Tamper Protection are all On. Cloud protection lets Defender check suspicious files against Microsoft’s latest data in seconds, and Tamper Protection stops malware from silently switching Defender off.
3. Turn on reputation-based protection. Go to App & browser control > Reputation-based protection settings. Switch on Check apps and files, SmartScreen for Microsoft Edge, Phishing protection, Potentially unwanted app blocking (tick both Block apps and Block downloads) and SmartScreen for Microsoft Store apps. These warn you before you run a file with no good reputation, which is how many fake “free” installers get in.
4. Enable Smart App Control if it fits your apps. In App & browser control, open Smart App Control settings and choose On. It blocks apps that are unsigned and not known to be safe. Since the April 2026 cumulative update for Windows 11 24H2 and 25H2, you can switch it on here without resetting the PC; on older builds the option may still be greyed out. If you use niche or self-built tools that get blocked, you can turn it off again.
5. Turn on Controlled folder access. Go to Virus & threat protection > Ransomware protection > Manage ransomware protection and switch Controlled folder access On. It takes effect immediately. If a trusted program (a game save tool or photo editor) is blocked, use “Allow an app through Controlled folder access” to whitelist it rather than turning the feature off.
6. Check memory integrity. Open Device security > Core isolation details and make sure Memory integrity is On, then restart. It uses virtualization to stop malicious or vulnerable drivers from loading into the most privileged part of Windows. If the toggle is missing, virtualization may be disabled in your PC’s UEFI/BIOS. On the same page, leave Microsoft Vulnerable Driver Blocklist and Local Security Authority protection on if they are shown.
7. Verify the firewall. Open Firewall & network protection and confirm Domain, Private and Public networks all say “Firewall is on.” Set unknown Wi-Fi (cafes, hotels) as Public in Settings > Network & internet so the PC is hidden from other devices there.
8. Switch your daily account to standard. Create a separate administrator account under Settings > Accounts > Other users, then change your everyday account type to Standard user. Malware that runs from a standard account cannot install system-wide without asking for an admin password, which turns a silent infection into a visible prompt.
9. Raise User Account Control. Search “UAC” and open Change User Account Control settings, then move the slider to the top, “Always notify.” You will see a few more prompts, but each one is a chance to stop something you did not start.
10. Secure your sign-in. In Settings > Accounts > Sign-in options, set up Windows Hello (face, fingerprint or PIN) and use passkeys where websites offer them. Phishing kits steal typed passwords; a passkey or hardware security key cannot be typed into a fake site.
11. Back up with one copy offline. Use the Windows Backup app or OneDrive for continuous copies, and keep a second copy on an external drive you unplug after each backup. Ransomware can encrypt anything it can reach, including connected drives.
12. Run a full and an offline scan once. Go to Virus & threat protection > Scan options, run a Full scan, then run Microsoft Defender Antivirus (offline scan). The offline scan restarts the PC and checks files before Windows loads, catching rootkits that hide from a normal scan.

Windows 11 Security Settings Most People Miss

Potentially unwanted app blocking

PUA blocking is the most useful setting that many PCs ship without. It targets software that is not strictly a virus but behaves badly: bundled toolbars, coin miners, aggressive “PC optimizers” and installers that sneak in extra programs. Turning on both “Block apps” and “Block downloads” stops these at the download in Edge and at install time for other browsers.

Controlled folder access exceptions

The common reason people turn this feature off is a blocked game or creative app. Instead, open the Block history in Windows Security, find the blocked entry, and allow just that program. Note that Controlled folder access only protects local folders by default, not network shares, and it will not work if a third-party antivirus has disabled Defender’s real-time protection.

Browser-level protection

Your browser is where most threats arrive. In Microsoft Edge, open Settings > Privacy, search, and services and set “Enhance your security on the web” to Balanced or Strict. In Chrome, open Settings > Privacy and security > Security and choose Enhanced protection. Then remove any extension you do not actively use; malicious or sold-off extensions are a growing infection route.

Device encryption

Device encryption (Settings > Privacy & security > Device encryption, or BitLocker on Pro editions) does not stop viruses, but it protects your files if the laptop is lost or stolen. Save the recovery key to your Microsoft account or print it before you need it.

Is Windows Defender Enough?

For most home users in 2026, yes. Microsoft Defender Antivirus is included with Windows 11, updates itself through Windows Update several times a day, and independent labs such as AV-TEST and AV-Comparatives regularly place it among the top performers for protection in their published reports. Combined with the reputation, ransomware and account settings above, it covers the threats a typical household faces.

A third-party security suite can still make sense in a few situations:

Do not run two real-time antivirus engines at once. When you install a third-party antivirus, Defender’s real-time protection switches to passive mode automatically. If you later uninstall the other product, check that Defender turned itself back on.

Signs Your Windows 11 PC May Be Infected

• Defender, Windows Update or Task Manager will not open or keep turning off.
• New browser extensions, a changed homepage or a search engine you did not choose.
• Pop-ups outside the browser, especially fake “your PC is infected” warnings with phone numbers.
• High CPU or fan noise when the PC is idle, which can indicate a coin miner.
• Friends receiving messages or emails you did not send.
• Files renamed with a strange extension or a ransom note on the desktop.

What to Do if You Think You Have a Virus

1. Disconnect from the internet. Unplug Ethernet or turn off Wi-Fi to stop data leaving the PC and to stop ransomware spreading to shared folders.
2. Run Microsoft Defender offline scan. Use Scan options > Microsoft Defender Antivirus (offline scan) to check files before Windows starts.
3. Check Protection history. In Virus & threat protection, open Protection history and remove or quarantine anything flagged.
4. Remove unknown apps and extensions. Go to Settings > Apps > Installed apps and uninstall anything you do not recognize, then clean your browser extensions.
5. Change passwords from a clean device. Start with email and banking, using a phone or another PC, and turn on two-step verification.
6. Reset if problems continue. Settings > System > Recovery > Reset this PC with “Remove everything” gives a clean start. Restore files only from a backup made before the infection.

Gear That Helps

None of these is required, but each closes a gap that settings alone cannot.

• Yubico YubiKey 5C NFC · USB-C and NFC · FIDO2 passkeys and security keys · works with Microsoft, Google and many other accounts. A hardware key cannot be phished, which protects your accounts even if malware or a fake site captures your password.
• Yubico Security Key C NFC · USB-C and NFC · FIDO-only, lower price tier. A good choice if you only need passkeys and two-step sign-in, not the YubiKey 5’s extra protocols.
• Kensington VeriMark Desktop 2.0 · USB-C and USB-A · Windows Hello fingerprint reader for desktops. Adds fast biometric sign-in to PCs without a built-in reader, making it easier to keep a strong account password you rarely type.

Frequently Asked Questions

How do I protect Windows 11 from viruses for free?

Use the built-in tools: keep Windows Update current, keep Microsoft Defender’s real-time, cloud and Tamper Protection on, enable reputation-based protection with PUA blocking, and turn on Controlled folder access. Use a standard account for daily work and keep an offline backup. These steps cost nothing and cover most threats.

Is Windows Defender enough for Windows 11?

For most home users, yes, as long as it is kept updated and paired with safe browsing habits. Independent lab reports regularly rate it highly for protection. Businesses and people who frequently download unofficial software may still want an additional managed suite.

Should I turn on Smart App Control?

If you mostly use well-known, signed apps, yes; it blocks untrusted programs before they run. Since the April 2026 update you can switch it on and off from Windows Security without reinstalling. If it blocks tools you rely on, turn it off and rely on reputation-based protection instead.

Does memory integrity slow down games?

On modern CPUs the impact is usually small, and Microsoft recommends leaving it on. Some older drivers are incompatible and will prevent it from turning on; updating or removing those drivers is the safer fix. Competitive players who see a measurable difference can weigh the trade-off, but most users should keep it enabled.

Do I need a VPN to stop viruses?

No. A VPN encrypts your connection and hides your IP address, which helps on public Wi-Fi, but it does not scan files or block malware. Antivirus, updates and safe downloads are what prevent infections.

How often should I run a full virus scan?

Defender runs quick scans automatically and checks files in real time, so a manual full scan once a month is plenty for most people. Run an offline scan any time you suspect an infection. Scanning more often does not add much protection if real-time protection is on.

Is Windows 11 safer than Windows 10?

Yes. Windows 11 requires TPM 2.0 and Secure Boot-capable hardware and enables protections like memory integrity on more devices by default. Windows 10 reached end of support on October 14, 2025, so unpatched Windows 10 PCs no longer receive regular security fixes unless enrolled in Extended Security Updates.