Good ransomware protection on Windows comes down to seven habits: keep an offline backup, update everything, turn on Controlled folder access, show file extensions, close Remote Desktop, check downloads, and know your recovery plan.
Quick summary: this guide is for home users who already have an antivirus and want a second line of defense. The verdict is simple: a backup you can restore beats any single program. Six of the seven steps use settings that already exist in Windows 11, and each one has a screenshot below.
Ransomware Protection at a Glance
Ransomware locks or encrypts your files and then demands payment to unlock them. Antivirus software helps, but it cannot catch everything, so these steps limit the damage when something slips through.
| Step | Where to find it | What it does |
|---|---|---|
| 1. Back up your files | Settings > System > Storage | Lets you restore files without paying |
| 2. Update Windows and apps | Settings > Windows Update | Closes known security holes |
| 3. Controlled folder access | Windows Security | Blocks unknown apps from changing protected folders |
| 4. Show file extensions | File Explorer > View > Show | Exposes fake files such as invoice.pdf.exe |
| 5. Turn off Remote Desktop | Settings > System | Removes a door attackers use |
| 6. Check before you download | Any link scanner | Stops infected files at the start |
| 7. Prepare a recovery plan | Offline, before you need it | Saves time if you are hit |
Step 1: Back Up Your Files Before Anything Else
A backup is the only fix that works even after your files are encrypted. Follow the 3-2-1 rule: keep three copies of your data, on two different types of storage, with one copy kept away from your PC.
In Windows 11, open Settings > System > Storage > Advanced storage settings > Back up options to set up a backup. Then disconnect the external drive afterward, because ransomware can also encrypt a drive that stays plugged in.
Which backup fits you? Choose an external drive if you want full control and a copy you can unplug. Choose a cloud service that keeps older versions of files if you want automatic backups. Use both if your files are irreplaceable.
Step 2: Keep Windows and Your Apps Updated
Updates close the security holes that ransomware uses to get in, so install them instead of postponing them. Open Settings > Windows Update, check for updates, and restart when asked.
Browsers, PDF readers, and your antivirus need the same care. Also remove programs you no longer use, since every old app is one more thing to patch.
Step 3: Turn On Controlled Folder Access
Controlled folder access is Windows Security’s built-in ransomware protection feature. It protects files, folders, and memory areas from unauthorized changes by unfriendly applications.
Open Windows Security > Virus & threat protection > Ransomware protection, then switch Controlled folder access to On.
A problem you may hit: a trusted program can be blocked from saving files. Open Block history on the same page to see what was stopped, then use Allow an app through Controlled folder access for programs you trust.
Step 4: Show File Extensions to Spot Fake Files
Windows can hide the last part of a file name, so a program may look like a document. When extensions are visible, a name such as invoice.pdf.exe is easy to spot before you double-click it.
In File Explorer, click View > Show > File name extensions.
Step 5: Turn Off Remote Desktop If You Do Not Use It
Remote Desktop lets another device connect to your PC. If you never use it, leave it off, because an open remote connection is one more entry point to protect.
Go to Settings > System > Remote Desktop and make sure the switch reads Off.
To lock down ports even further, pair this with a dedicated rules manager like our tested Windows Firewall Control setup.
Step 6: Check Downloads and Links Before You Open Them
Most infections start with a file you chose to open. Scan any unknown link before clicking it, and avoid cracked software, because those sites are a common way to spread malware.
For example, I scanned a cracked-software download site on VirusTotal on October 30, 2026. Seclookup marked it Malicious, alphaMountain.ai marked it Suspicious, and Fortinet marked it Spam. My guide on how to check any link before you click shows the full method.
The same care applies to download portals. Before you install anything from one, read my review of whether Softonic is safe.
Step 7: Know What to Do If Ransomware Hits
Act quickly and stay calm. Disconnect the PC from Wi-Fi and the network, power it off if files are still being encrypted, and do not pay the ransom, because payment does not guarantee you get your files back.
- Unplug the network cable or turn off Wi-Fi, and disconnect external drives.
- Photograph the ransom note and note the file extension of the locked files.
- Remove the malware with a trusted security scan before restoring anything.
- Restore your files from the backup you made in Step 1.
- If you have no backup, check whether a free decryptor exists for your ransomware family.
The No More Ransom Decryption Tools page lists free decryptors for certain ransomware families. For example, its page for Agent.iih Ransom offers Rakhni Decryptor, made by Kaspersky Lab. Its warning is clear: remove the malware from your system first, or it will keep locking your files.
Where Antivirus Fits In
Security software is still your first filter, because it can block known threats before they run. These steps work alongside it, not instead of it.
If you do not have one yet, you can try ESET with its official trial, as explained in my guide to the ESET Smart Security Premium license and official activation.
Who Should Skip Controlled Folder Access
Skip it, or add exceptions, if you run many tools that write files into your Documents or Pictures folders every day. The feature may block them until you allow each app. For most home users, the extra protection is worth that small setup.
Ransomware Protection FAQ
Prevention Questions
What is the best protection against ransomware?
Does Windows 11 have built-in ransomware protection?
Can an antivirus stop all ransomware?
Recovery Questions
What should I do first if my files are encrypted?
Can I recover files without paying the ransom?
Final Verdict
These seven steps suit any home Windows user, especially anyone with family photos or work files on one PC. Business servers need professional tools, so they should not rely on this list alone. The reason is simple: when your files are backed up offline, ransomware loses its power to hold them hostage.
