Your lock screen is the part of your phone other people see. It is also where information leaks out without anyone unlocking anything: a message preview on a table, a delivery code, a calendar entry with a client's name in it.
Securing it is not one setting. It is about five, and together they take a few minutes.
Here they are in the order that matters, with what each actually does.
Your passcode is the real key, not your face
Face ID is a convenient way of presenting your passcode, not a replacement for it. Every serious protection on the phone falls back to that code, so someone who has watched you type it has effectively taken your face as well.
That makes length the highest-value change available. iOS uses six digits by default. In Settings, Face ID and Passcode, Change Passcode, tap Passcode Options before typing the new one and choose Custom Numeric Code or Custom Alphanumeric Code. Every extra character multiplies the possible codes, and a longer one is harder to read off your hands.
Two habits go with it. Do not use a code that also opens something else, such as a bank card PIN, and do not use the birthday of anyone who stands next to you.
Erase Data is a trade, not a free win
On the same screen, Erase Data wipes the phone after ten failed passcode attempts. iOS already slows guessing down with lockouts that grow longer each time, so this is a backstop rather than the thing holding the line.
A small child with sticky fingers, or your own tired thumbs on a long code, can trigger it. Turn it on only if you have a backup you would be happy to restore from.
Decide what a locked screen is allowed to say
Notification previews are the quietest leak on the phone. Under Settings, Notifications, Show Previews you get Always, When Unlocked, or Never. When Unlocked is the sensible middle: you see that a message arrived, but the words appear only once the phone has recognised your face. You can override it per app, so banking stays hidden while food delivery stays visible.
Two-factor codes are the specific reason to bother: a code that displays on a locked screen is one anyone holding the phone can read and use.
Close the side doors
Further down that same screen, under Allow Access When Locked. That list, which varies a little by iOS version, covers everything that works without an unlock: Control Center, Today View, lock screen widgets, Live Activities, Siri, Reply with Message, Wallet, Home Control, USB Accessories and more.
You do not need to switch them all off. Three are worth a thought. Reply with Message lets a stranger answer your texts from the lock screen. Siri can read and act on some things while the phone is locked. Control Center allows a quick tap into Airplane Mode; an iPhone can still be found through Apple's offline Find My network, and Activation Lock does not care whether the phone is online, but some people close it anyway. Leaving USB Accessories off blocks wired accessories once the phone has been locked for an hour.
Shield the keypad every single time
A passcode can be long, unique and unguessable and still be lost the simplest way: someone watches it being typed, on a train, in a queue, across a table. Use Face ID for everyday unlocks so you type the code rarely, and when you do, turn the screen away or cup your hand over the keypad the way you would at a cash machine. This is the habit that makes every other setting here hold up.
Stolen Device Protection is worth going to find
Added in iOS 17.3, Stolen Device Protection is built for the case the other settings do not cover: someone who has both your phone and your passcode.
With it on, when the phone is somewhere it does not recognise, sensitive actions stop accepting the passcode as a fallback and require Face ID or Touch ID instead: using saved passwords, using payment details saved in Safari, erasing the device.
A second group adds a one-hour Security Delay followed by a second biometric check: changing your Apple Account password, signing out, changing the passcode, turning off Find My, and turning off Stolen Device Protection itself. The delay exists so a phone taken from your hand cannot be locked away from you in the first few minutes.
It lives in Settings, Face ID and Passcode, Stolen Device Protection, and needs Find My, two-factor authentication and Significant Locations switched on. From iOS 17.4 you can set it to apply Always rather than only away from familiar places, which is safer: familiar locations include the places where people who know you spend time.
The wallpaper layer, described honestly
A warning wallpaper secures nothing and changes no iOS behaviour, and it is worth saying that plainly. What it does is set expectations for the people physically around you, and give an honest finder a reason to look for your contact details.
That is a real use, just a different one, sitting on top of the settings above rather than replacing them. If you want a set to pick from, DON'T Touch Phone Wallpapers has HD designs framed for the iPhone lock screen, from blunt warnings to quiet ones.
Quick answers
Is Face ID less secure than a passcode?
They defend against different things: Face ID resists shoulder surfing, which typing never will, and a long passcode resists guessing, which a face cannot. Using both, with Require Attention left on, is stronger than either alone.
Does turning off Control Center on the lock screen stop a thief tracking me?
Partly, and less than it sounds. It prevents a fast tap into Airplane Mode, but iPhones can still be located through Apple's offline Find My network, and Activation Lock does not depend on a connection.
Do I need Stolen Device Protection if nobody knows my passcode?
It is designed for the case where somebody learns it without you noticing. Because the extra checks only fire on sensitive actions, the day-to-day cost of leaving it on is close to nothing.
Does a longer passcode slow me down?
Only when Face ID does not recognise you. If typing the code feels frequent enough to annoy you, add an alternate appearance in Face ID settings rather than shortening the code.
Where to get it
For the part that talks to people rather than to iOS, DON'T Touch Phone Wallpapers is an HD library of warning and aesthetic lock screens you can browse and set in a minute.
Set the wallpaper for the room you are in. Set the passcode, previews and Stolen Device Protection for the day the phone leaves it.