MetaMask Security Settings: What to Change

According to MetaMask's Help Center as it stands now, transaction simulations, security alerts and phishing detection no longer have separate toggles. They sit behind a single switch that is on by default. This guide starts with what that switch covers and whether to touch it, then goes through the four things you have to do yourself: Auto lock, spending caps, disconnecting dapps and revoking approvals.

Which switch controls MetaMask's security protections now

The switch is called Basic Functionality. The Help Center page How to adjust MetaMask privacy settings gives its location:

• Browser extension: menu in the upper right → Settings → Privacy → Basic Functionality
• Mobile app: menu in the upper right → Settings → Security & Privacy → Basic Functionality

The same page states three things about it:

• It is on by default.
• It is a master switch for a group of features, and they cannot be turned off one by one. Turn it off and transaction simulations, security alerts, phishing detection, token and NFT detection, and balance and price lookups all stop together, along with backup and sync and notifications.
• A wallet created with a Secret Recovery Phrase can turn it off, either under Manage default settings during setup or later in Settings. A wallet signed up with a Google, Apple or Telegram account cannot.

So the first job is to open that screen and look. If you switched it off under Manage default settings when you created the wallet, none of the protections in the next section are running. My advice is to leave it on. MetaMask also spells out what leaving it on involves: these features rely on third-party network services, and your IP address reaches MetaMask's servers as part of normal internet traffic.

What the wallet catches for you while that switch is on

All four items below come under Basic Functionality, so there is nothing extra to switch on. What deserves your time is knowing how far each one goes and where it stops.

Transaction simulations: see the balance change before you confirm

When you start a contract interaction, MetaMask runs the transaction as a trial first and shows the estimated balance changes on the confirmation screen: which tokens and NFTs would leave or arrive. The official explanation is on What are transaction simulations?, and the feature is enabled by default.

The same page sets out its limits. Standard simulations run offchain, and the result is not guaranteed to match what happens onchain. A malicious contract can behave normally during the simulation and then move your assets once you confirm, which MetaMask calls a red-pill attack. To counter that, MetaMask offers Added protection on some networks: if the onchain execution does not match the simulation, the transaction reverts and you pay only the network fee. MetaMask says it adds some gas and is available by default when you interact with a non-trusted contract.

There is one way to use it: if the simulation shows you losing something you should not be losing, stop. The reverse does not hold. A normal-looking simulation does not mean the transaction is safe.

Security alerts: the Warning and Malicious levels

MetaMask flags tokens, addresses and dapps at two levels: Warning (potential risk detected) and Malicious (high confidence of harmful activity). According to How to manage security alerts to protect your wallet, the assessments draw on onchain analysis and security partners including Blockaid, and alerts are enabled by default in both the extension and the app.

Phishing detection: Deceptive site ahead

When you try to connect your wallet to a site that looks like phishing, MetaMask shows a Deceptive site ahead warning page. The advice on the page explaining this warning is blunt: do not connect to a site that triggers it. During the check, processed URLs may be sent to MetaMask's servers and some third-party services.

Token autodetection: no separate off switch, so leave unknown tokens alone

Token autodetection is on by default on EVM networks and Solana. It also comes under the master switch and cannot be turned off separately; see How to display tokens in MetaMask. That means an unfamiliar token someone airdrops to your address may show up in your asset list without you adding it.

The same page's advice: be skeptical of airdropped tokens you do not recognize and research them before interacting, and if the error message on a failed transaction in a block explorer tells you to visit a website, it is most likely a phishing site, so do not click. If a token you did not buy or swap for appears in your list, leave it where it is.

What none of the four can stop is you confirming a signature prompt without reading it. For any request that mentions approve, setApprovalForAll or permit, check the address being authorized and the amount before you decide.

Where to set Auto lock in MetaMask

If the wallet is unlocked and you step away from the computer, whoever sits down in the meantime can see your balances and transaction history and can start a transaction. Auto lock covers that gap: once the wallet has been idle for the set time, MetaMask locks itself and asks for the password again.

• Browser extension: Settings → Security & password → Auto lock
• Mobile app: Settings → Security and password → Auto lock

The paths come from the Help Center page How to log out of MetaMask, and MetaMask's privacy best practices also list setting Auto lock as one item. Neither page states the default duration, so open the setting, see what it is now, and shorten it to suit where you work. On a shared computer or an office desk I suggest a few minutes at most. The only cost is typing the password more often.

To lock right away, choose Log out at the bottom of the menu in the upper right.

How to lower an unlimited amount in the approval prompt

When a dapp asks for a token approval, the amount it proposes is often unlimited. MetaMask lets you change it before you confirm. It calls the number a spending cap, and the steps are on How to customize token approvals with a spending cap:

• Browser extension: on the approval confirmation screen, click the pencil icon next to the amount, enter your own number, then click Confirm.
• Mobile app: on the Spending cap request for your [token] screen, type a number in the spending cap field. Max fills in your balance of that token, and Use site suggestion fills in the amount the dapp proposed. Tap Next to review, then Approve.

On the same page MetaMask advises against granting an unlimited (astronomically large) amount and gives the reason: if the dapp's contract has a flaw, an attacker can move the tokens covered by the approval without asking you again, and a fake site imitating a well-known brand can do the same once it has your approval. Enter what this transaction needs. The next time you use the dapp you approve again and pay gas once more.

How to disconnect a dapp you no longer use

When you are done with a dapp, you can disconnect it from your wallet. The steps from the Help Center page How to disconnect a wallet from a dapp:

• Browser extension: menu in the upper right of the account view → Dapp connections → select the dapp → Disconnect.
• Mobile app: open the site in the Explore tab → tap the account icon in the upper right → Disconnect all.
• Mobile app, everything at once: Settings → Security & Privacy → Clear privacy data, which removes all dapp connections and permissions for the currently selected account.

Where to revoke token approvals you have already given

MetaMask's guide to revoking approvals lists several routes:

• The spending caps page in MetaMask Portfolio (portfolio.metamask.io): view existing approvals and revoke them directly. MetaMask states that it supports Ethereum Mainnet, Polygon and BNB Chain.
• The approval checker built into a block explorer, such as Etherscan's Token Approval Checker.
• Third-party tools, such as Revoke.cash.

Each revocation is an onchain transaction and costs gas. MetaMask recommends reviewing approvals regularly and gives once a month as an example. How to check, how to revoke and how to track down Permit2 approvals are covered in how to check and revoke token approvals.

Should you touch Smart Transactions or a custom RPC?

Smart Transactions is on by default. According to How to use Smart Transactions, it hands eligible transactions to a set of block builders for inclusion. The benefits MetaMask lists are revert protection, a higher transaction success rate and MEV protection, at no additional fee. It works on Ethereum Mainnet, Linea, Base, Arbitrum, BNB Smart Chain, Polygon and other networks. The toggle is under Settings → Transactions in the extension and Settings → Advanced in the app. My advice is to keep it on.

RPC settings tie directly into this. MetaMask states that configuring a custom RPC for Ethereum, Linea, Base, Arbitrum or BNB Smart Chain overrides Smart Transactions and the MEV protection goes with it, returning only when you switch back to the default RPC; see the page on adding a network. So unless you have a clear reason, I would not change the RPC URL for these major networks, and an RPC URL from a source you cannot identify should not go in at all.

Six settings at a glance

What MetaMask recommends beyond the settings menu

MetaMask's privacy best practices and basic safety and security tips include a few points that are not in the settings menu:

• Give the wallet its own password. Make it strong and do not share it with any other account. If the wallet was signed up with a Google, Apple or Telegram account, do not reuse that account's password either.
• Turn on full-disk encryption on the computer. MetaMask names FileVault on Mac, BitLocker on Windows and LUKS on Linux.
• Connect only to sites you trust. If you are unsure about a dapp, research it before connecting.
• Enter your Secret Recovery Phrase on only three occasions: creating a wallet for the first time, restoring a wallet and resetting a wallet. MetaMask will not ask you for it, and anyone claiming to be support who asks should not get it.
• Consider a hardware wallet once the amounts are large. MetaMask says it is worth considering when the tokens you hold are of significant value; signing is then confirmed on the device.

How to recognize the scams that arrive through signature prompts is covered in the guide to crypto phishing scams. Which funds belong in a hot wallet and which in a cold one is covered in cold wallet vs hot wallet.