How to Tell if Your iPad Has a Virus (and What to Do)

A pop-up on your iPad just claimed it is infected and told you to tap a button to clean it, and now you are not sure what is real. Close that tab and don’t tap anything in it: the warning is almost always a scam ad. iPads rarely get true viruses because every app runs in its own sandbox, and there is no virus scanner for iPadOS. Instead, check for unknown apps, configuration profiles, spam calendars and Safari website data, then update iPadOS.

Can an iPad Actually Get a Virus?

A classic computer virus is code that copies itself into other programs and spreads. That model doesn’t fit how an iPad works. According to Apple’s platform security guide on runtime process security, all third-party apps on iPadOS are sandboxed, which is designed to stop an app from gathering or modifying information stored by other apps or from making changes to the device. The system partition is mounted read-only, and apps can reach data outside their own folder only through services that iPadOS explicitly provides.

Put simply, a bad app can misbehave inside its own box, but it can’t quietly rewrite Safari, infect Mail or hide inside the operating system. Apple also pairs the sandbox with code signing and a central place to get apps (the App Store), so software has to come from an identified developer. In the European Union, Apple also allows approved alternative app marketplaces and some developer websites, which Apple says brings extra risk, so stick to sources you trust.

That doesn’t mean nothing can go wrong. The problems people actually run into on an iPad fall into a few groups:

• Scam pop-ups and ads in Safari that say your device has a security problem. Apple lists these as a common social engineering trick.
• Spam Calendar subscriptions or invitations that fill your calendar with fake “virus” alerts and links.
• Configuration profiles you were talked into installing, which can change settings and, in Apple’s words, control your device.
• A shady or unwanted app that shows aggressive ads or asks for a subscription.
• A compromised Apple Account, where someone else has your password rather than a foothold on the iPad itself.

The big exception is a jailbroken iPad. Apple’s page on unauthorized modification of iOS explains that jailbreaking bypasses built-in security features, which can create security vulnerabilities, instability, shorter battery life and the inability to apply future updates. If your iPad has been jailbroken, the protections described here no longer hold, and erasing it (covered near the end) is the realistic fix.

Highly targeted spyware does exist, but it is aimed at a small number of people such as journalists, activists and officials. Apple’s answer for that group is Lockdown Mode, which is explained in its own section below.

Can You Scan an iPad for Viruses?

No, not in the way you scan a Windows PC or a Mac. Apple doesn’t include a virus scanner in iPadOS, and there is no Settings screen that runs a malware scan. The same sandbox that keeps a bad app from touching your other apps also keeps a good app from looking inside them. A “security” or “antivirus” app from the App Store can’t open another app’s files or inspect the system, so it has nothing to scan in the traditional sense.

Apps sold as iPad antivirus usually do other jobs instead, such as checking the iPadOS version, blocking known bad websites, monitoring for leaked passwords or selling a VPN. Some of that can be useful, but none of it is a scan of your iPad, and you don’t need to install anything to do the checks that matter. Be especially wary of any app or website that says it found a virus on your iPad: it has no way to know that.

What works instead is a manual check of the places where problems really show up. Do these in order; most people can finish all of them in about 15 minutes:

1. Close any scam pop-up and clear Safari’s history and website data.
2. Look in Settings > General > VPN & Device Management for profiles you don’t recognize.
3. Open Calendar and remove any spam calendar you are subscribed to.
4. Scroll through the App Library and delete apps you didn’t install.
5. Change your Apple Account password if you typed it into a suspicious page or got sign-in alerts you didn’t expect.
6. Install the latest iPadOS update.

If all six come back clean and the iPad still behaves badly, the cause is very likely ordinary: full storage, an older iPad running a newer iPadOS, or one buggy app. Each check is explained in detail below.

Signs Something Is Wrong and What They Usually Mean

Most symptoms that feel like a virus have a normal explanation. Use this table to decide where to look first.

What you notice	Most likely cause	Where to check
“Your iPad is infected” warning in Safari	A scam ad or pop-up on the website	Close the tab; clear website data
Calendar alerts about viruses, prizes or “protection”	A spam calendar subscription or invitation	Calendar app, calendar list
Settings you didn’t change, a VPN you didn’t add, or a note that the iPad is managed by an organization	A configuration profile or device management	Settings > General > VPN & Device Management
An app you don’t remember installing	Installed by someone else using the iPad or the same Apple Account, or a forgotten download	App Library
Sign-in alerts, password change emails or purchases you didn’t make	Someone has your Apple Account password	Settings > [your name] > Sign-In & Security
Fast battery drain, warmth, slow apps	Heavy app use, background updates after an iPadOS update, an aging battery or near-full storage	Settings > Battery and storage; restart and update
Apps crashing	An outdated app or iPadOS version	App Store updates and Software Update

Here is a fictional example of how this plays out. Nadia’s iPad started showing alerts every morning that said “Your device may be at risk, tap to protect.” She assumed it was a virus. The alerts were actually events from a calendar she had subscribed to after tapping “OK” on a website months earlier. Unsubscribing from that one calendar stopped the alerts, and nothing else on the iPad needed fixing.

If you have a cellular iPad, an unexplained jump in mobile data can also be worth a look in the cellular data settings, where usage is listed by app. A single app using far more than you expect is a reason to delete or update it, not proof of malware.

Deal With Scam Pop-Ups in Safari

Apple’s guide to recognizing and avoiding social engineering schemes lists “misleading pop-ups and ads that say your device has a security problem” as a common scam. Its advice is direct: don’t call the number on the screen and don’t follow the links to “fix the problem.” Close the page or tab instead. Apple also says it never asks for your Apple Account password or verification codes to provide support and never asks you to turn off a security feature, so a pop-up or caller asking for either is a scam.

Warning: if you already called a number from a pop-up and let someone guide you through settings, do the profile and Apple Account checks below as well, because those are what scammers usually ask you to change.

To close the pop-up and clear what the site left behind:

1. Close the tab that shows the warning. Don’t tap buttons inside the warning itself, including ones labeled Close or Cancel; use Safari’s own tab controls.
2. Open Settings > Apps > Safari.
3. Tap Clear History and Website Data, then confirm with Clear History.

4. Open Safari again. The page that produced the warning should not reopen on its own.

You can also clear history from inside Safari through the sidebar’s History view, where you choose a time range such as the last hour instead of everything. Apple’s iPad guide to clearing cache and cookies notes that clearing history also removes cookies and the permissions you granted to websites, which is exactly what you want after a scam site. Because cookies go too, expect to sign back in to sites you use. For a walkthrough with more detail, see how to delete history on an iPad or this explainer on clearing cookies and cache on iPad.

Check for Configuration Profiles

A configuration profile is a small settings package that can add a VPN, certificates, email accounts or restrictions to an iPad. Schools and businesses use them legitimately. Scammers and some sketchy apps ask people to install them because, as Apple warns, a profile can control your device, and management tools may allow access to data or location information. This is the closest thing to “malware” most iPad owners will meet, so it is the most important check.

Warning: if the iPad belongs to your school or employer, ask the administrator before you delete anything here. Apple’s steps for reviewing and deleting configuration profiles note that removing a profile also removes the settings, apps and data that came with it, which can cut you off from work email or school apps.

1. Open Settings > General > VPN & Device Management.

2. Look at what is listed. If no profiles appear, none are installed, and you can move on.
3. Tap any profile you don’t recognize to see who made it and what it contains.
4. Tap Delete Profile, enter your passcode if asked, and confirm.
5. Restart the iPad.

A profile you can’t delete usually means the iPad is managed by an organization. If you bought it secondhand and it shows management you didn’t expect, contact the seller or the original owner before you rely on it.

Remove Spam Calendar Subscriptions

Calendar spam is a common cause of repeated “virus” alerts that appear even when Safari is closed. Apple lists unwanted Calendar invitations and subscriptions as a scam method. Apple’s article on deleting spam calendar events and subscriptions covers the cleanup, and Apple’s iPad guide to using multiple calendars shows how to unsubscribe on an iPad.

1. Open the Calendar app and tap the Calendars button to see the list of calendars.
2. Find a calendar you don’t recognize, often with a name about security, prizes or protection.
3. Tap the info button next to it, then tap Delete Calendar or Unsubscribe, then confirm with Unsubscribe or Unsubscribe and Report Junk.

4. For a single junk invitation, tap the event and choose Delete Event. If it came from an unknown sender, Report Junk deletes it and reports it.

If a calendar can’t be removed, Apple says you can hide it by clearing the checkmark next to it in the calendar list.

Delete Apps You Don’t Recognize

Swipe left past your last Home Screen page to open the App Library, which lists every installed app, including ones that aren’t on a Home Screen. Look for apps you didn’t install, apps with generic names like “Cleaner” or “Security Scan,” and apps that started showing full-screen ads. Before deleting, consider whether a family member who shares the iPad or your Apple Account might have added it.

To delete an app, following Apple’s steps to remove or delete apps on iPad:

1. Touch and hold the app icon.
2. Tap Remove App.
3. Tap Delete App, then Delete to confirm.

Choosing “Remove from Home Screen” only hides the icon and leaves the app in the App Library, so make sure you pick the delete option. If an app came with a configuration profile, delete the profile too, as shown above. Also check Settings > [your name] > Subscriptions and cancel anything the app started, using Apple’s steps to cancel a subscription.

Secure Your Apple Account

If you entered your Apple Account password on a page that came from a pop-up, gave a code to a caller, or see sign-ins and purchases you didn’t make, the problem is your account, not the iPad. Apple’s advice is to change the password immediately and make sure two-factor authentication is on.

1. Open Settings and tap your name at the top.
2. Tap Sign-In & Security, then Change Password.
3. Enter your iPad passcode, then type and confirm a new password.
4. When asked, choose Remove Other Devices if you think someone else is signed in, or Keep All Devices Signed In if you only changed it as a precaution.

Apple’s page on changing your Apple Account password also explains that you may have to wait an hour if a security delay applies, and that you can change it from account.apple.com on another device. Then confirm two-factor authentication for your Apple Account is turned on, so a stolen password alone isn’t enough to sign in.

Update iPadOS

Updates are how Apple closes security holes, so a current iPadOS version is your best protection against the rare real exploit. Apple’s iPadOS update instructions use this path:

1. Connect to Wi-Fi and plug the iPad in or make sure it has a good charge.
2. Open Settings > General > Software Update.
3. If an update is listed, tap Download and Install (or the install button shown) and follow the prompts.
4. Tap Automatic Updates and turn on the options to download and install updates automatically, so future fixes arrive without you having to remember.

Update your apps from the App Store at the same time. If you need help finding the update screen, see how to find and install a software update on iPad. An iPad too old to receive current iPadOS versions no longer gets security fixes, which is a good reason to be extra careful with links and profiles on it.

Lockdown Mode for Targeted Attacks

Lockdown Mode is an optional, extreme protection for people who might be personally targeted by highly sophisticated spyware. Apple stresses that most people are never targeted by attacks like this, so it is not a general virus fix. When it is on, the iPad deliberately works differently: some apps, websites and features are limited to reduce what an attacker could exploit.

To turn it on, follow Apple’s Lockdown Mode instructions for iPad: open Settings > Privacy & Security > Lockdown Mode, turn on Lockdown Mode, and follow the onscreen prompts. The same screen is where you turn it off later.

Erase and Restore as a Last Resort

Erasing the iPad is the strongest step and the right one for a jailbroken iPad, a profile you can’t get rid of, or problems that survive every check above. It deletes everything, so back up first, and make sure you know your Apple Account password, because you’ll need it to set the iPad up again.

Warning: erasing can’t be undone. Back up to iCloud or a computer before step 1, and copy anything important you aren’t sure is in the backup.

1. Open Settings > General > Transfer or Reset iPad.
2. Tap Erase All Content and Settings.

3. Tap Continue and enter your passcode or Apple Account password when asked.
4. If your iPad uses an eSIM, choose whether to keep or erase it, then confirm.
5. Wait for the iPad to restart to the setup screen.

Apple’s guide to erasing iPad also covers doing this from a Mac (Finder) or a Windows PC (Apple Devices app) with Restore iPad. Apple notes you need to sign out of Find My before you can click Restore. For a fuller walkthrough, see how to wipe an iPad clean.

During setup you can restore from your backup or set up as new. Restoring is quicker and is fine for most people. If the same problem returns after a restore, erase again and set up as new, then reinstall apps from the App Store one at a time and sign back in to iCloud to bring back photos, contacts and other synced data.

How to Keep Your iPad Clean From Here

• Get apps from the App Store. Apple recommends installing software only from the App Store or directly from a known developer.
• Never install a profile because a website, pop-up or stranger told you to.
• Treat any “virus detected” message in a browser or calendar as an ad, not a diagnosis.
• Keep Automatic Updates on, and don’t jailbreak the iPad.
• Never share your Apple Account password or verification codes, even with someone claiming to be Apple.

If you also use an Android phone, which allows apps from outside its main store more easily, this overview of common types of phone viruses and their warning signs covers threats that look different from what an iPad faces.

iPad Virus Questions

Start with the six-item check above. In most cases the “virus” turns out to be a pop-up, a calendar or a profile, and you can fix it in a few minutes without erasing anything.