Safety is a set of habits, not a product
No single tool makes someone safe online. Most harm comes from a small number of ordinary situations: a reused password that leaks, a convincing message that tricks someone into handing over a code, or a device that has not been updated in years. Because the common problems are ordinary, the most effective defenses are ordinary too. They are habits that take a few minutes to set up and then mostly run in the background.
This guide covers the habits that matter most for everyday users. Each one is explained briefly here, and the other articles in this section go deeper on individual topics. No habit gives perfect protection, and the goal is to make an attack harder and a mistake less costly, not to reach zero risk.
Protect your accounts
Your accounts are usually the most valuable thing an attacker can reach, because an email account in particular can be used to reset passwords elsewhere.
Use a different password for every account. When a site is hacked, its stored passwords are often tried against other sites. If you reuse a password, one leak can open many doors. Long passwords made of several unrelated words are generally stronger and easier to remember than short, complicated ones.
Let a tool remember them. Nobody can memorize dozens of unique passwords. A password manager creates and stores them for you, so you only need to remember one strong passphrase. Browsers and phones also include built-in versions of this.
Add a second step. Two-factor authentication asks for something besides the password, such as a code from an app or a physical key. If your password leaks, an attacker still cannot sign in easily. Turn it on first for email, banking and any account that stores payment details.
Consider passkeys where offered. Some services now let you sign in with a key stored on your device, unlocked by your fingerprint, face or screen lock. Because there is no typed secret to steal, this approach resists several common attacks.
Keep your devices current
Software has flaws, and when researchers or vendors find them, a fix is released. Installing it promptly closes a hole that may already be known to attackers. Turn on automatic updates for your phone, computer, browser and apps where possible. It also helps to know that devices eventually stop receiving fixes, so an old phone or router may become riskier over time even if it still seems to work.
Basic housekeeping helps too. Use a screen lock on every device, install apps only from official stores, and remove apps you no longer use. Be thoughtful about app permissions, since an app that asks for access it does not obviously need deserves a second look.
Recognize tricks before they work
Many attacks do not break any technology at all; they persuade a person to do something. Typical warning signs include urgency (“act within an hour”), threats, unexpected requests for money or codes, and links that lead to a page that looks slightly off. Phishing emails are the best-known example, but the same tactics appear in text messages, phone calls and social media messages.
A few rules of thumb cover most situations:
- Do not click a link in an unexpected message. Open the company’s site or app yourself instead.
- No legitimate service should ask you to read out a one-time code to them.
- Be cautious about anything that offers a prize, a bargain far below normal prices, or a rescue from a problem you did not know you had.
- If something feels rushed, slow down and verify through a separate channel.
Be careful on networks
The padlock in your browser address bar means the connection to that site is encrypted. That is useful, but it does not mean the site itself is trustworthy, since fraudulent sites can use encryption as well. On shared networks such as cafes and airports, stick to sites and apps that use encryption, avoid sensitive tasks if you can, and keep your device updated. A VPN can add a layer of privacy in some situations, though it does not make a risky site safe or stop you from being tricked.
At home, change the default administrator password on your router and keep its firmware up to date. A secure setup for your home networks protects every device connected to it.
Limit the damage if something goes wrong
Assume that at some point a company holding your data will be breached or an account will be compromised. Preparing for that makes the event less stressful.
- Keep backups. Copies of important files stored separately from your main device protect against ransomware attacks, hardware failure and accidental deletion. A backup that you have never tested may not work, so check it occasionally.
- Share less. Information that is never given out cannot be leaked. Provide only what a form genuinely needs.
- Watch for signs of trouble. Unfamiliar sign-in alerts, unexplained charges or password reset emails you did not request are early warnings. Act on them quickly by changing the password and reviewing recent activity.
- Know what to do after a leak. If a service tells you your data was exposed, change the affected password, change it anywhere else you used it, and watch your accounts for odd activity.
Where to start
Trying to do everything at once is a common reason people do nothing. A reasonable order is:
- Secure your main email account with a unique password and a second step.
- Start using a password manager and gradually replace weak or repeated passwords.
- Turn on automatic updates.
- Set up a backup of the files you would hate to lose.
- Practice pausing before you click or respond to anything urgent.
These steps address the large majority of everyday risks. Over time, the habits become routine, and staying safe online takes less effort than it first appears.