It’s easy to look over these settings, but taking the time to do so can go a long way in protecting your assets. Here’s a few that most people skip but genuinely matter:
Wallet recovery: Settings > Security and password > Manage wallet recovery. Every user should keep an offline, written down version of their secret recovery phrase (SRP). In the event you lose access to your wallet, this is the only guaranteed way to recover it. Never share your private key or SRP with anyone.
Auto lock timer: Settings > Security and password > Auto lock. Default is "Never." Set it to "After 5 minutes" so a locked wallet can't be drained by a potential malicious script running in the background of your device.
Audit your token approvals. Every dApp interaction may have granted unlimited spend permission, which don’t expire automatically. If a dApp offers a “This time only” approval option, use it. If it only shows a spending cap field, set the amount to exactly what you need— not unlimited, not the suggested default. For existing approvals, check and revoke anything stale at .
Verify your extension ID. Fake MetaMask extensions exist, so be sure to confirm yours at chrome://extensions. The official Chrome extension ID is nkbihfbeogaeaoehlefnkodbefgpgknn
Hardware wallet for significant holdings: MetaMask works with numerous hardware wallets. Your keys stay on the device, not within your browser. If you're holding more than you'd be comfortable losing, this is a must.
Full security guide:
