Installation from unknown sources on Xiaomi: how to completely disable and protect the device

Installation from Unknown Sources on Xiaomi smartphones is a two-way sword, on the one hand, it allows you to install apps outside of Google Play (for example, for example, for the first time, APK-On the other hand, it opens the door to viruses, spyware and fraudulent utilities that can steal data, show intrusive advertising or even block the device. This problem is especially relevant for users who share a phone with children, colleagues or just afraid to accidentally click on a malicious link.

In this article, we will discuss all the ways to disable installations from unknown sources on Xiaomi, including hidden MIUI settings, nuances for different firmware versions and solving typical bugs, and explain why simply turning off the tick in the settings is not always enough for full protection, and what to do if a virus has already entered the system.

If you have never manually installed an APK, and you don't plan to, you'd better lock it down forever. Even a single casual touch can lead to infection. And scammers are actively exploiting vulnerabilities in MIUI by masking malicious files as useful utilities (such as "charging speeders" or "cache cleaners").

Note: the instructions in this article are relevant for MIUI 12/13/14 and HyperOS (including Xiaomi 11/12/13/14, Redmi Note 10/11/12, POCO F/X and other models). If you have an older firmware version (such as MIUI 11 or lower), some menu items may differ - we will mention this too.

Why not just ignore the “unknown sources”?

Many users mistakenly believe that if they don't intentionally download APKs, there's no risk, but in practice, scammers use dozens of ways to trick the system:

• 📱 Fake websites with "updates" for MIUI — The user thinks that he downloads the official patch, but actually installs a Trojan.
• 🔗 Phishing links in messengers (WhatsApp, Telegram), where under the guise of "exclusive game" or "free Netflix" offer to install APK.
• 📎 Malicious attachments in letters (for example, “utility bill” or “notice from the bank").
• 🤖 Automatic installation through vulnerabilities in your browser or other applications (for example, if you have ever allowed installation for Chrome or File Manager).

In 2023, Kaspersky’s lab recorded a 40% increase in attacks on Xiaomi via fake APKs compared to 2022, with more than 60% of infections occurring on devices where users “did not knowingly install anything” and the virus penetrated through automatic downloads in the background.

⚠️ Note: If your Xiaomi already has unknown apps installed (such as System Update, Flash Player, or Cleaner Pro), don’t manually remove them—some viruses masquerade as system processes. First, disable the installation from unknown sources, and then check the device with antivirus (Dr.Web, Malwarebytes).

Method 1: Standard shutdown in security settings

The most obvious method is to block APK installation through the security menu, but there are pitfalls:

1. In MIUI, installation permission can be divided by application (for example, you allowed installation for Chrome, but you did not allow installation for File Manager).
2. Some viruses turn on this option after rebooting.
3. On older versions of MIUI (up to 12), the security menu looks different.

Instructions for MIUI 13/14 and HyperOS:

1. Open Settings → Applications → Application Management.
2. Slip on three dots in the upper right corner and select Special Access.
3. Scroll down and click Install Unknown Apps.
4. You will see a list of apps that are allowed to install APK. Disable sliders for everyone (especially browsers, file manager, and instant messengers).

For MIUI 12 and below:

1. Go to Settings → Privacy → Special permissions.
2. Select Install Unknown Applications and disable access for all programs.

Special access settings are open |Resolved list of applications |Browser and file manager sliders disabled |No gray apps in the list-->

If you still see a warning when you try to install an APK after you turn it off, you have permission somewhere. Check all the apps on the list, including the system ones (e.g. com.android.packageinstaller).

Method 2: Blocking through “Children’s Mode” (parental control)

If you give a phone to a child or just want to block the ability to install any apps (including Google Play), use built-in parental controls, which is more reliable than simply disabling "unknown sources," because:

• 🔒 Blocks all installations except those you have authorized.
• 🛡️ It prohibits changing security settings without PIN-code.
• 📵 Can limit the time of use of the device.

How to set up:

1. Open Settings → Digital Well-Being and Parental Controls.
2. Select the Mode for Children and follow the Customization Wizard.
3. Install. PIN-code (remember or write it down!).
4. In the Restrictions section, disable the Install Applications option.
5. You can also block Google Play and the browser.

⚠️ Attention: If you forget PIN-The code from parental control, you can only unlock the phone through a factory reset (with loss of all data!). 1Password).

This is also a good option for adults who want to protect themselves from random installations, such as if you download files frequently from the Internet and fear that the virus will penetrate through an automatically running APK.

Method 3: Disconnect via ADB (for power users)

If the virus has already entered the system and independently activates the installation from unknown sources, standard methods may not work, in which case ADB (Android Debug Bridge) - a debugging tool that allows you to manage settings at a low level - will help.

Warning: Incorrect ADB commands can damage the system, and use this method only if other methods have not worked.

Instructions:

1. Download and install Platform Tools (includes ADB).
2. On your phone, turn on USB Debugging (Settings → About Phone → Press 7 times on MIUI Version, then go back to Settings → Additional → For Developers).
3. Connect your phone to your PC via USB and confirm the debugging permission.
4. Open the command line (Win + R → enter cmd) and do:

adb shell settings put global install_non_market_apps 0

This command globally disables the installation from unknown sources at the system level. To return the opportunity, replace 0 with 1.

If the virus blocks ADB or debugging, try booting into Safe Mode (hold the power button → long press on "Stop" → "Safe Mode"). In this mode, third-party apps don't work, and you can execute commands.

Method 4: Reset security settings (if the virus is already activated)

If you notice after infection that:

• 📱 There are constantly advertising banners on the screen.
• 🔋 The battery is discharged in a few hours.
• 📡 Traffic is consumed even when the phone is idle.
• 🚫 Some settings (such as “unknown sources”) are not saved after the change.

So the virus has already made changes to the system, and simply turning off the APK installation won't help, so you need to partially reset the security settings.

How to do this:

1. Go to Settings → About the phone → Reset settings.
2. Select Reset App Settings (not to be confused with a full reset!).
3. Confirm the action. It will delete:

Do not restore settings from backup

If that doesn’t work, you only have to reset your files to factory settings (Settings → About Phone → Settings → Delete All Data) before saving your important files to your PC or cloud (Google Drive, Mi Cloud).

How to check if the installation from unknown sources is actually disabled?

Many users think that once they turn off the ticks in the settings, they are safe, but in practice, viruses and some applications can bypass these restrictions. Here's how to make sure that protection works 100%:

1. APK Test: Download a harmless file (like Scrcpy for PC) and try installing it. If you see an "Installation locked" error, it's okay.
2. Verification ADB: Adb shell settings get global settings install_non_market_apps If the result 0 — installation is blocked at the system level.
3. Permissions Scanner: Use the App Inspector app (available on Google Play) to check which programs have access to APK installation.

💡

If you frequently install APKs (for example, for testing), create a separate user profile on Xiaomi (Settings → System → Multiple users) and use it only for these purposes.

FAQ: Answers to Frequent Questions

💡

Disabling the installation from unknown sources is only half the protection. Update MIUI regularly, don't download APK from numbered sources, and use antivirus. Even one malicious file can compromise the entire device.