How to Prevent Zoom Bombing: Step-by-Step

Updated 13 November 2026 · Standard formula, shown below

Zoom bombing is when uninvited people crash your Zoom meeting to disrupt it, often with offensive content. This guide shows you practical settings to lock down your meetings before they start, so only your intended guests can join. You’ll need a Zoom account with host privileges (free or paid) and access to the Zoom web portal or desktop app.

What You’ll Need

A Zoom account (free or paid) with host permissions.
The Zoom desktop app (or web portal) where you schedule meetings.
If you’re using a personal meeting ID, be ready to add a passcode.

Step-by-Step

Enable a passcode (required by default in most accounts). When scheduling a new meeting, scroll to “Security” and check “Require a passcode when joining.” Zoom now sets this by default for most accounts. If you’re using a personal meeting ID, the passcode will be auto-generated – share it only with attendees.
Turn on the waiting room. In the same “Security” section, check “Enable waiting room.” This places every attendee in a virtual lobby until you admit them. For extra control, choose “Only users not in your account” or “Only guest users” to let your organization’s members bypass the waiting room.
Restrict screen sharing to host only. In the meeting settings (or during the meeting via the security icon), set “Who can share?” to “Only Host.” This prevents intruders from showing unwanted content.
Disable annotation and chat for participants. While in a meeting, click the “Security” button (shield icon) and uncheck “Allow participants to annotate” and “Allow participants to chat.” You can re-enable chat if you need it, but start locked down.
Use a unique meeting ID instead of your personal one. When scheduling, choose “Generate Automatically” for the meeting ID. Your personal ID is like a static address – once leaked, it’s vulnerable. A random ID is only valid for that one meeting.
Require registration for large or public events. If your meeting link might be shared publicly, enable “Registration” in the schedule form. Attendees must provide an email and you can approve or deny each one.
Lock the meeting once everyone is in. After the meeting starts, click “Security” → “Lock Meeting.” This prevents anyone new from joining, even with the link and passcode.
Remove and block disruptive participants. If an intruder gets in, hover over their video, click the ellipsis (…), choose “Remove,” and check “Report” to block them from future meetings.
Update your Zoom app regularly. Zoom frequently patches security holes. Keep the desktop client updated to ensure you have the latest protections.

Common Mistakes

Sharing the meeting link publicly. Even with a passcode, posting the link on social media or a public forum invites trouble. Use private channels like email or a password-protected calendar.
Using the same passcode for every meeting. If one meeting is compromised, all future ones are at risk. Let Zoom generate a new passcode each time.
Forgetting to enable the waiting room. A passcode alone isn’t enough – it can be guessed or shared. The waiting room gives you a human check.
Allowing participants to share their screen. Even with host-only sharing, a participant can sometimes take over if you accidentally switch to “All Participants.” Always double-check the setting.
Ignoring the “Security” icon during the meeting. Many hosts set up protections before, but forget they can also lock down live. Use the shield icon anytime.

Tips

Set a custom waiting room message. Tell attendees you’ll admit them shortly – this reduces confusion for legit participants.
Use a “one-time” meeting link. For sensitive discussions, schedule a new meeting each time rather than reusing a recurring link.
Assign a co-host. A co-host can also admit people from the waiting room and remove disruptors, so you’re not the only gatekeeper.
Check your default settings. Go to Zoom web portal → Settings → “Meeting” and set passcode, waiting room, and host-only sharing as defaults for all future meetings.
Educate participants. Tell attendees not to share the link or passcode with others. A quick note in the invitation helps.

Troubleshooting

You forgot to enable the waiting room and an intruder is already in. Immediately lock the meeting (Security → Lock Meeting), remove the intruder (hover over their video → Remove), and then enable the waiting room for any latecomers. You can also end the meeting and restart with a new ID if needed.

Your legitimate attendees are stuck in the waiting room. Click “Admit” on each person, or use “Admit All” if you recognize everyone. If you accidentally set the waiting room to “Only users not in your account,” your own colleagues may still be held – check the security settings and adjust.

Participants can still share their screen despite host-only setting. This can happen if you changed the setting during the meeting but an earlier share request was already approved. Ask the participant to stop sharing, then re-verify the setting. Also, make sure you’re not in “All Participants” mode.

You can’t find the security settings. In the desktop app, the “Security” icon is at the bottom toolbar (shield). On the web portal, go to Settings → Meeting → Security. If you don’t see these options, update your Zoom client – older versions lack some features.

Your passcode isn’t working for attendees. Double-check that you’re sharing the correct passcode – Zoom auto-generates one that’s different from your meeting ID. Also, ensure the passcode is included in the invitation link (it usually is). If attendees are using the web client, they may need to enter the passcode manually.

Frequently Asked Questions

Can I prevent zoom bombing without a paid Zoom account?

Yes. All the essential protections – passcode, waiting room, host-only sharing, lock meeting – are available on the free plan. Paid plans add features like registration and cloud recording, but not needed for basic security.

What’s the difference between a passcode and a waiting room?

A passcode is a password that must be entered to join. A waiting room is a virtual lobby where the host manually admits each person. Passcodes keep out random guessers; waiting rooms let you screen who’s actually there.

Can I set these protections as defaults for all my meetings?

Yes. In the Zoom web portal, go to Settings → Meeting → Security, and enable “Require a passcode,” “Enable waiting room,” and “Host-only screen sharing.” These will apply to all future meetings you schedule.

What should I do if someone shares inappropriate content before I can stop them?

Immediately remove them (hover over their video → Remove), then lock the meeting. You can also disable screen sharing for all participants. If the content is illegal or threatening, report it to Zoom and consider contacting authorities.

Will my attendees be annoyed by the waiting room?

Most understand it’s a security measure. To reduce friction, set a custom waiting room message like “You’ll be admitted shortly” and admit people promptly. For trusted groups, you can allow your organization’s members to bypass the waiting room.

Does using a personal meeting ID increase my risk?

Yes. Your personal meeting ID is permanent and can be guessed or shared. If you must use it, always combine with a passcode and waiting room. For sensitive meetings, use a randomly generated ID instead.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.