Most cybersecurity advice is either too vague to act on ("be careful online") or too technical to bother with. This guide skips both. It's a short list of habits that stop the overwhelming majority of attacks aimed at everyday people, and it's built to be finished in one sitting.
Start with your passwords
Reused passwords are still the single biggest reason personal accounts get compromised. When one site is breached, attackers try the same email-and-password combination everywhere else. The fix isn't memorising dozens of complex passwords — it's using a password manager to generate and store a unique one for every account. You only need to remember one master password after that.
Turn on two-factor authentication everywhere it's offered
Two-factor authentication (2FA) means that even if someone steals your password, they still can't log in without a second code, usually from an app on your phone. Prioritise turning this on for your email account first, since it's the account attackers can use to reset everything else. An authenticator app is safer than receiving codes by text message, but text-message 2FA is still far better than no 2FA at all.
Learn the shape of a phishing attempt
Phishing emails and texts have gotten more convincing, but they still tend to share a pattern: unusual urgency, a request to click a link or "verify" something, and a sender address that looks almost — but not quite — right. Before clicking a link in any message asking you to log in, go to the site directly by typing the address yourself instead of clicking through.
If a message is trying to make you feel rushed, that urgency is usually the attack, not a side effect of it.
Keep software updated
Software updates aren't just new features — a large share of them patch security holes that are already being actively exploited. Turning on automatic updates for your operating system, browser, and phone apps closes those gaps without requiring you to think about it.
Back up the things you can't afford to lose
Ransomware attacks and simple hardware failure both end the same way if you're unprepared: your files are gone. The standard advice is the "3-2-1" rule — three copies of important data, on two different types of storage, with one copy stored somewhere offsite (a cloud backup counts).
A five-minute weekly habit
- Check your password manager for any accounts flagged as reused or breached, and update them.
- Review recent login activity on your email and banking apps if they offer it.
- Confirm your phone and laptop have installed pending updates.
None of this requires technical expertise. It requires about the same effort as locking your front door — a small, repeatable habit that closes off the easiest paths in.
Have a correction or a follow-up question about this article? Get in touch — we read every message.