Recommended Free Tools
For the strongest built-in protection, leave Microsoft Defender real-time protection, cloud-delivered protection, tamper protection, SmartScreen or reputation-based protection, and Microsoft Defender Firewall on. Keep exclusions narrow. Consider Controlled folder access if you can accommodate trusted apps that may need permission to save to protected folders.
These settings are in the Windows Security app, but labels and availability can differ on managed PCs or when another antivirus provider is active. Windows 10 also needs a separate lifecycle decision: its standard support ended on October 14, 2025, and antivirus settings do not replace operating-system security updates.
As an Amazon Associate I earn from qualifying purchases.
Which Windows Security settings should you enable?
These controls cover different risks; they are not interchangeable. Real-time protection checks files and programs as they are accessed or run. Cloud-delivered protection can provide updated protection while the PC is connected, while tamper protection helps prevent malicious apps from changing important Defender settings. SmartScreen and reputation-based protection assess apps, files, sites, and downloads. The firewall controls network traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Setting | Recommended choice | What it does and the trade-off |
|---|---|---|
| Real-time protection | On | Scans files and programs as they are accessed or run. Files opened or downloaded while it is off are not scanned during that period. |
| Cloud-delivered protection | On | Lets Defender receive updated protection while connected to the internet. |
| Tamper protection | On | Helps prevent malicious apps from changing important Defender settings. |
| Automatic sample submission | On if you are comfortable sharing suspicious files for evaluation | Microsoft may alert you if a requested file appears to contain personal information, allowing you to decide whether to send it. |
| SmartScreen or reputation-based protection | On | Adds checks for apps, files, sites, and downloads beyond file scanning. |
| Controlled folder access | Consider enabling it | Helps block untrusted apps from changing protected folders, but may require you to allow a trusted app that cannot save. |
| Microsoft Defender Firewall | On for each network profile | Controls network traffic; use the public profile on untrusted networks and private on networks you trust. |
Turn on core virus and threat protection
Check Defender’s protection settings
- Open Windows Security.
- Select Virus & threat protection, then Manage settings.
- Turn on Real-time protection, Cloud-delivered protection, and Tamper protection.
- Choose whether to keep Automatic sample submission on, based on your comfort with sending suspicious files to Microsoft for evaluation.
Microsoft says real-time protection turns itself back on automatically after a short while if it is turned off. Do not treat that behavior as a safe way to work without protection: files opened or downloaded while the setting is off will not be scanned during that time. Microsoft’s Virus & threat protection guide explains these settings.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Confirm which antivirus provider is active
If a compatible third-party antivirus is installed, Microsoft Defender Antivirus may switch itself off automatically. In Windows Security, check Who’s protecting me? or Manage providers to confirm which antivirus is active; do not assume Defender is scanning just because its settings appear in the app. Windows Security labels and controls can vary on managed devices or across editions.
Keep exclusions specific and rare
An exclusion stops Defender Antivirus real-time scanning from checking the excluded file, folder, file type, or process. Microsoft notes that scheduled Defender scans or third-party antimalware may still scan excluded items, but an exclusion nevertheless creates a gap in real-time coverage. Avoid broad exclusions; add one only when you understand why it is needed, and limit it to the smallest specific item possible. See Microsoft’s guidance on exclusions.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Run scans and update security intelligence
Windows Security scans automatically. For an occasional check, use a Quick scan; use the scan choices under Scan options when you need a full or custom scan. A manual scan is not a substitute for keeping protection active and current.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Open Windows Security and select Virus & threat protection.
- For a scan, choose Quick scan or open Scan options and select the type of scan you need.
- To update security intelligence, go to Protection updates and select Check for updates. You can also get protection updates through Windows Update.
Microsoft’s Stay protected with the Windows Security app guide covers automatic protection and scans.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set up ransomware protection without blocking your own work
Controlled folder access can block unknown or untrusted apps from changing protected folders, including common folders such as Documents, Pictures, Videos, Music, and Desktop. You can add other folders. The protection can interrupt legitimate work: an app may be unable to save until you explicitly allow it.
- Open Windows Security and select Virus & threat protection.
- Choose Manage ransomware protection.
- Turn on Controlled folder access, then try the apps and workflows you rely on.
- If a trusted app is blocked, use the option to allow an app through Controlled folder access. Allow only apps you trust.
Microsoft also describes OneDrive-based ransomware data recovery. A backup is a recovery layer if files are damaged or lost; it does not prove that a device cannot be infected. See Microsoft’s ransomware protection guidance.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Keep app, browser, and network protection on
Review app and browser controls
Open Windows Security > App & browser control and leave Microsoft Defender SmartScreen and reputation-based protections enabled for apps, files, sites, and downloads. Windows 11 also includes Smart App Control as an additional option; Microsoft says it is not available in Windows 10. Exact options can vary by edition or PC management policy. Microsoft’s App & browser control guide describes these protections.
Keep the firewall on and use the right profile
Open Windows Security > Firewall & network protection and check the active network profile. Keep Microsoft Defender Firewall on. A private profile is intended for a network you trust; a public profile is appropriate for an untrusted network. Do not disable the firewall as a routine troubleshooting step. See Microsoft’s Firewall & network protection guidance.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Windows 10 needs more than antivirus settings
Microsoft says standard Windows 10 support ended on October 14, 2025. Ordinary software and security updates and technical assistance ended with it, so keeping Defender configured does not restore missing Windows security fixes. Microsoft points users toward upgrading an eligible PC to Windows 11 or enrolling in consumer Extended Security Updates (ESU) if they need more time. Its support article says ESU can protect eligible devices through October 12, 2027; check Microsoft’s current eligibility and enrollment information because program conditions can vary. Read Microsoft’s Windows 10 support notice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
