Online security depends on repeatable habits, appropriate controls and a recovery plan. This reviewed guide replaces the dated 2025 edition with practical advice whose suitability still depends on your accounts, devices and circumstances.
1. Protect accounts with unique credentials
Use a different, unpredictable password for each account, preferably generated and stored by a password manager. For a password you must remember, choose a long passphrase; do not copy an example from an article. Review recovery details and protect your primary email account.
2. Add multifactor authentication
Enable MFA where supported. Passkeys or security keys can provide phishing-resistant authentication. Authenticator codes and SMS have different risks; if SMS is the only additional factor offered, it can still improve on a password alone. MFA does not make every account takeover impossible.
3. Maintain devices and software
Use supported systems, install security updates and remove software you no longer need. Check updates for browsers, applications, plugins and connected devices. Plan changes and recovery for systems where an interruption would matter.
4. Understand network protection
Use correctly validated HTTPS and never ignore certificate warnings. A VPN can protect traffic between your device and the VPN service in suitable situations, but it moves trust to that provider and does not make a phishing site or infected device safe. Avoid sensitive work on a network or device you cannot trust.
5. Check unexpected requests
Use a known app, bookmark or independently verified contact channel before sharing credentials or payment information. A polished message can still be fraudulent; spelling mistakes are not a necessary sign of phishing.
6. Limit exposure
Review application permissions, account sessions and the personal information you publish. Revoke access that is no longer needed. Use privacy settings that fit the service and your requirements.
7. Test recovery
Maintain backups that cannot all be changed through the same account or infected device, and test restoring important files. Synchronisation alone may replicate deletion or corruption. Know whom to contact if an account or device is compromised.
Review: 30 October 2026. These measures reduce risk; they do not guarantee the absence of incidents.
