Malware · guide

How to remove virus from iPhone, and where to look first

By Alberto Gulotta · Updated · 18 min read

How to remove virus from iPhone has a three-setting answer, and not one of them is a scan. Clear Safari’s website data, check Settings › General › VPN & Device Management for a configuration profile you did not install, and delete apps you do not recognise. There is no scanner to run here.

Three places a problem can be on an iPhone, and the one place people look A browser page lives in Safari and is cleared from Safari settings. A configuration profile lives in Settings, General, VPN and Device Management. An app lives in its own sandbox and is removed from the Home Screen. There is no system-wide scanner on iOS, which is why an app promising to scan the phone cannot see any of the three. WHERE THE PROBLEM ACTUALLY IS In the browser a web page, a pop-up, a countdown, a fake scan Safari › Clear History In a profile the one thing that really is installed on the phone General › VPN & Device Mgmt In an app sealed in its own sandbox, unable to read the others hold the icon › Remove App Where people look: a “virus scanner” from the App Store It is an app too, so it is inside the same sandbox as every other app: it cannot read Safari’s data, it cannot list your profiles, and it cannot examine other apps. AI Tools Primer · figure
The sandbox that makes an iPhone hard to infect is the same sandbox that makes a scanning app useless. Figure drawn by AI Tools Primer.
The four things people mean by “a virus on my iPhone”, where each one actually lives, and which setting removes it. Paths taken from Apple’s own documentation, read on 9 September 2026.
What you are seeingWhere it livesWhere you remove it
An alarming page, a countdown, a fake scan A web page in Safari. It is not on the phone at all. Settings › Apps › Safari › Clear History and Website Data
Settings you did not choose, a VPN you did not add, a browser homepage you cannot change A configuration profile. This is the one that is genuinely installed. Settings › General › VPN & Device Management
An app you do not recognise An app, inside its own sandbox — from the App Store or a profile. Touch and hold the icon, then Remove App
A genuine targeted attack Rare, and Apple contacts you directly rather than waiting to be scanned. Apple threat notification, then Lockdown Mode

Start with Safari, because most of it is a web page

The alarming things people describe — a red banner, a countdown, a page that says it has found several viruses and offers to clean them — are almost always a website, not something on the phone. A website can be loud and it can be hard to close, but it has no access to your photos, your messages or your accounts, and it disappears when its data does.

Go to Settings, tap Apps, then select Safari. Scroll down and tap Clear History and Website Data, confirm the timeframe, then tap Clear History. Apple notes that this “doesn’t change your AutoFill information”, so saved logins and card details stay where they are.

One detail is worth knowing before you decide the phone is broken: if that button is greyed out, Apple’s own page says “there is either no data to clear, or you might need to check your web content restrictions in Screen Time”. A greyed-out button is the most common reason people conclude that something is blocking them. It is usually Screen Time, set up months earlier and forgotten.

If you would rather not lose your history, there is a narrower route that removes the tracking and login data only: Settings, Apps, Safari, Advanced, Website Data, Remove All Website Data.

The one thing that really can be installed: a configuration profile

This is the step worth the twenty seconds, and it is the one that is genuinely missing from the search results. A configuration profile is the only ordinary mechanism by which something outside the App Store changes how your iPhone behaves. Apple’s iPhone User Guide defines them as settings “for using iPhone with corporate or school networks or accounts”, and adds where they come from: “You might be asked to install a configuration profile that was sent to you in an email, or one that’s downloaded from a webpage.”

That second half is the whole point. A profile arrives by being tapped through, usually on a page that offered something else, and once installed it can set a VPN, a proxy, restrictions or accounts. Apple’s Personal Safety guide is blunter about what that means: these tools “may allow access to data or location information on the device”.

Go to Settings, then General, then VPN & Device Management. Apple’s wording for the good outcome is the reassuring one: “If you don’t see any profiles, then no device management profiles are installed on your device.” That is the end of the check. If something is listed and you did not put it there, “select the profile, tap Delete Profile, and follow the onscreen instructions. Restart your device.”

Two warnings, both Apple’s rather than ours. Removing a profile removes everything that came with it — “if the profile provided permissions for a virtual private network (VPN) to give access to a school network, the VPN can no longer connect to that network”. And: “if your device belongs to a school or business, check with your system administrator before deleting any apps or profiles.” On a managed phone the profile is supposed to be there, and deleting it can cut off your work email rather than a virus.

The configuration profile check, in the words of Apple’s own guide Settings, then General, then VPN and Device Management. If no profiles are listed, none are installed and the check is finished. If one is listed and you did not put it there, selecting it and tapping Delete Profile removes it, along with every setting and app that came with it, after which the device is restarted. THE CHECK THAT TAKES TWENTY SECONDS Settings General VPN & Device Management the only list that matters Nothing listed? then nothing is installed. Done. If something is listed select it, tap Delete Profile, follow the steps, restart What goes with it every setting, app and piece of data the profile brought — a work VPN stops connecting too Apple’s warning, not ours: if the phone belongs to a school or an employer, ask them first. AI Tools Primer · figure
The step the AI summary names third and cites a video for. Apple documents it in the iPhone User Guide and again in the Personal Safety guide. Figure drawn by AI Tools Primer.

Then the apps, which is a shorter job than it sounds

Scroll your Home Screen and App Library for anything you do not recognise, touch and hold the icon, and choose Remove App. Pay attention to anything installed around the time the trouble started, and to anything that arrived alongside a profile you have just deleted.

It is a shorter job than on a computer because of how iOS is built: every app runs sealed off from the others, which is why one app cannot quietly infect the rest, and also why deleting the app genuinely ends the matter rather than leaving pieces behind.

The same seal is the reason the next section exists.

Why there is no scan button, and why that is not the gap it looks like

Nothing on an iPhone can scan the phone. Not a free app, not a paid one, not the well-known security brands. An app that offers to scan for viruses is subject to the same sandbox as everything else: it cannot read Safari’s data, it cannot list your configuration profiles, and it cannot examine other apps. What those apps actually provide is usually a web filter, a VPN or a data-breach lookup — useful things, differently named.

This is where an independent voice matters more than a maker’s. The UK’s National Cyber Security Centre, in its device security guidance, puts it in one sentence: “this means you should not need to use AV products on platforms like Chrome OS, Android and iOS in their default configuration”. Its reasoning is about how the platform is built, not about how good iPhones are — devices that “can only run software that is delivered through a public app store which monitors for malicious code” are devices where, as the NCSC puts it, “AV offers very limited value”.

That sentence is quoted from a national cyber security agency rather than from a security company for a reason worth stating plainly: “you do not need our product here” is a sentence a vendor has no occasion to write, and an agency has no reason to withhold. On this particular question it is also the sentence that answers it.

And if it is real, you are told rather than left to find out

Genuine compromise of an up-to-date iPhone does happen, to a very small number of people, and it does not announce itself with a pop-up. Apple runs a notification system for exactly this case. In Apple’s words, these are “high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously” — and, in the same document, “the vast majority of users will never be targeted by such attacks”.

If Apple detects such activity it tells you in three places at once: an alert on the Lock Screen and in Settings, an email to the addresses on your Apple Account, and a banner at the top of your account page once you sign in at account.apple.com. Apple states it detects these attacks by relying “solely on internal threat-intelligence information and investigations” — that is, not by anything running on your phone. It has sent these notifications multiple times a year since 2021, to users in over 150 countries.

The step such a notification recommends is Lockdown Mode, and it is worth knowing what it costs before turning it on out of anxiety. Apple describes it as “an optional, extreme protection that’s designed for the very few individuals who… might be personally targeted by some of the most sophisticated digital threats”, and warns that “when Lockdown Mode is enabled, your device won’t function like it typically does”. In practice: most message attachments blocked, complex web technologies blocked, incoming FaceTime calls refused unless you have called that person in the past 30 days, no automatic joining of insecure Wi-Fi, 2G and 3G off. Fittingly, it also blocks the thing this page has spent its longest section on — with Lockdown Mode on, “configuration profiles can’t be installed” at all.

How you would actually be told about a real targeted attack on an iPhone Apple delivers a threat notification in three places at once: an alert on the Lock Screen and in Settings, an email to the addresses on the Apple Account, and a banner at the top of the Apple Account page after signing in. Apple states it detects these attacks using internal threat intelligence, not software installed on the phone. IF SOMETHING REAL IS HAPPENING, THIS IS HOW YOU HEAR ABOUT IT On the phone an alert on the Lock Screen and inside Settings By email to the addresses on your Apple Account On your account page a banner at the top after you sign in to account.apple.com All three at once, because a single channel can be missed or faked. Apple says these alerts come from its own investigations — not from anything installed on the phone — and that the vast majority of people will never receive one. AI Tools Primer · figure
Nothing you install can produce this alert, and nothing you install is needed to receive it. Figure drawn by AI Tools Primer.

What to do if all three come back empty. That is a real and common outcome, and it means the phone is behaving oddly for a reason that is not malware: a bad battery, a full disk, a misbehaving app, an update mid-install. Overheating, fast battery drain and sudden restarts get blamed on viruses more than anything else, and are almost never caused by one — an iPhone running hot, a battery draining fast and a phone that keeps restarting each have their own short list of causes. If it is the pop-up itself that worries you, pop-up ads come from three different faults, only one of which is on the device.

Where to start

Three checks, in order.

“There is a page shouting at me”
Clear it from Safari — clear safari
“Settings changed on their own”
The profile list — configuration profiles
“Which scanner should I install?”
Why none of them can help — no scanner

The same job on other machines

The steps are different on each platform, because what can be installed is different on each platform.

Removing malware from a computerThe full sequence on Windows, and the four blind spots a single scan leaves behind.Open this guide → Getting rid of a virus on an Android phoneSafe mode, Play Protect, and the permission that lets an app hide its own icon.Open this guide → Is MBAM safe?The scanner question where it can actually be asked, and what Windows switches off to make room.Open this guide →

When it is not an infection at all

Most phones sent for virus removal are not infected. These are the faults that get mistaken for one.

Can iPhones get virusesWhat the platform allows in the first place, and the four things that are usually happening instead.Open this guide → Apple could not verify it is free of malwareA message on a Mac that names malware and reports none: what it is really saying.Open this guide → Pop-up adsThree different faults wear the same symptom, and only one of them is on the device.Open this guide → An iPhone running hotWhat actually makes a phone warm, and the one case that is worth acting on.Open this guide → A battery draining fastWhere the charge is really going, read from the screen that already tracks it.Open this guide → A fake Microsoft security alertThe same trick on a bigger screen: a page that claims to have scanned a machine it cannot see.Open this guide →

Questions people also ask

How do I run a security check on my iPhone?

There is no single button, because there is nothing on iOS that can scan the whole phone. The check is three settings: clear Safari’s history and website data, look at Settings, General, VPN & Device Management for a configuration profile you did not install, and remove apps you do not recognise.

How do you check if your iPhone has a virus?

Checking and removing are the same job here. Apple’s wording for the profile check is the useful one: “If you don’t see any profiles, then no device management profiles are installed on your device.” An empty list is a clean result, and it takes about twenty seconds to read.

Is there a free virus cleaner for iPhones?

None can do what the name suggests, free or paid. Every app on iOS runs inside its own sandbox, so a scanning app cannot read Safari’s data, list your profiles or examine other apps. The NCSC’s guidance is that you “should not need to use AV products” on iOS in its default configuration.

Will erasing an iPhone get rid of viruses?

It would remove a configuration profile and any app, so yes — but it is a large action for a problem the three settings above usually solve in a minute. Restoring a backup made before the trouble started is the version worth considering; restoring a later one can put a profile straight back.

Why did my iPhone say I have a virus?

Because a web page said so. A page cannot see the phone it is displayed on, so any page claiming to have detected an infection is guessing in order to sell something or to get a tap. Closing the tab and clearing Safari’s website data ends it.

Can an iPhone get a virus from a website?

Not in the ordinary sense, from simply loading a page. What a page can genuinely do is talk you into installing a configuration profile, which is why that is the one list worth checking after something strange in the browser.

Not covered here. It does not recommend a security app, because on iOS in its default configuration there is nothing for one to do — that is the NCSC’s position, quoted above, and not a view of ours about any particular product.

It does not cover a phone that belongs to an employer or a school, where a configuration profile is supposed to be there and removing it breaks your access rather than fixing anything. Apple’s instruction in that case is to ask the administrator first.

And it does not cover what to change afterwards if something did get in. Which accounts to secure, in what order and from which device, is the question after a breach. What holds instead is simple: every menu path is quoted from Apple’s own documentation rather than reproduced from memory, the sentence about not needing antivirus on iOS is the National Cyber Security Centre’s and is quoted in full, the threat-notification details come from Apple’s page on them, and the page names which of its sources sell security software and which do not.

Sources

  1. Apple Personal Safety User Guide — Review and delete configuration profiles: what a configuration profile can do, including that such tools “may allow access to data or location information on the device”; the exact path and steps for reviewing and deleting one; and the two warnings, that removing a profile deletes everything associated with it and that a school or business device should be checked with its administrator first — support.apple.com, read 9 September 2026.
  2. Apple iPhone User Guide — Install or remove configuration profiles on iPhone: the definition of a configuration profile, that one may arrive by email or be downloaded from a webpage, where installed profiles are listed, and that deleting one also deletes the settings, apps and data associated with it — support.apple.com, read 9 September 2026.
  3. Apple Support — Delete your Safari history, cache, and cookies on iPhone: the current path through Settings, Apps and Safari, that clearing does not change AutoFill information, the narrower route that removes website data while keeping history, and what a greyed-out Clear History button means — support.apple.com, read 9 September 2026.
  4. Apple Support — About Apple threat notifications and protecting against mercenary spyware: that these are high-confidence alerts about individually targeted attacks, that the vast majority of users will never be targeted, the three channels the notification arrives on, that Apple detects such attacks through its own threat intelligence rather than software on the device, and the count of notifications since 2021 — support.apple.com, read 9 September 2026.
  5. Apple Support — About Lockdown Mode: that it is an optional extreme protection for a very small number of people, the warning that the device will not function as it usually does, the list of what is restricted including message attachments, web technologies, FaceTime, insecure Wi-Fi and 2G/3G, and that configuration profiles cannot be installed while it is on — support.apple.com, read 9 September 2026.
  6. National Cyber Security Centre — Antivirus and other security software, Device security guidance: the statement that you “should not need to use AV products on platforms like Chrome OS, Android and iOS in their default configuration”, the reasoning that devices restricted to a monitored public app store gain very limited value from antivirus, and the note that signature scanning has been limited by changes in platforms and malware — www.ncsc.gov.uk, read 9 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 9 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.