The basics of protecting yourself online

Internet safety comes down to three things: controlling who sees your information, preventing someone else from using your accounts, and avoiding programs that damage your device. You cannot eliminate risk entirely — the internet connects you to billions of people, and some of them have bad intentions — but you can make yourself a harder target than the next person. Most attacks succeed because they are straightforward, not because they are sophisticated.

The threats you actually face depend on what you do online. Someone who shops occasionally faces different risks than someone who runs a business or manages money. Someone who uses public WiFi faces different risks than someone who only uses home internet. This guide covers the protections that matter for most people, in order of how much they actually reduce your risk.

Key Takeaways

  • A strong, unique password for each account stops someone who steals one password from accessing everything else you own.
  • Two-factor authentication — a second code sent to your phone or email — blocks most account takeovers even if your password leaks.
  • Keeping your operating system and browser updated patches the holes that attackers use to install malware or steal data.
  • Phishing emails that look like they come from your bank or PayPal are the most common way attackers get your password, and they work because they look real.
  • Public WiFi is not inherently dangerous, but you should not log into financial accounts or enter credit card numbers on it without a VPN.

Passwords: why unique and strong matters more than you think

When a company gets hacked, attackers steal the password file along with your email address. If you use the same password everywhere, that one stolen password opens every account you own — email, bank, social media, shopping sites. A unique password for each account means a stolen password only compromises that one place.

A strong password is one an attacker cannot guess by trying common words or patterns. "Password123" or "Qwerty" or your birthday will crack in seconds. A password that works is 12 characters or longer and mixes uppercase letters, lowercase letters, numbers, and symbols — something like "Tr0pic@lM0nk3y!" or "BlueSky#Lamp92". The longer it is, the harder it is to crack, and random is better than memorable.

You cannot remember 50 unique strong passwords. Use a password manager — a program that stores passwords in an encrypted vault that only you can open. You remember one strong master password, and the manager fills in the rest. Popular password managers include Bitwarden, 1Password, and Dashlane. Your browser (Chrome, Firefox, Safari) has a built-in password manager that works for most people. The trade-off is that if someone gets your master password, they get everything, so that one password has to be genuinely strong and genuinely unique.

Two-factor authentication: the second lock on your door

Two-factor authentication (often called 2FA or two-step verification) requires a second piece of proof beyond your password. After you type your password, the service sends a code to your phone via text message or an authenticator app, or asks you to approve the login on another device. You cannot log in without that second code, even if someone has your password.

Two-factor authentication stops most account takeovers. An attacker who steals your password cannot get in without that second code. Turn it on for anything that matters: your email (which is the master key to resetting passwords on everything else), your bank, your payment apps, your social media. Text message codes are better than nothing, but authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator are more find because attackers cannot intercept them the way they can intercept text messages.

The downside is friction — logging in takes an extra 30 seconds. The upside is that your account is dramatically harder to break into. For accounts that contain money or personal information, that trade is worth it.

Updates: closing the holes attackers use

Your operating system (Windows, macOS, iOS, Android) and your browser (Chrome, Firefox, Safari, Edge) get updated regularly. Most updates fix security holes — places where an attacker can install malware, steal data, or take over your device. When you see an update notification, install it. Do not wait for a convenient time. Security updates are the convenient time.

Attackers often know about security holes before the company that made the software does. They use those holes to attack people until the company releases a patch. If you delay updating, you are sitting in that window of vulnerability. Automatic updates are on by default in most systems — check your settings to make sure they are enabled and actually running.

The same applies to apps on your phone. Keep your apps updated. If an app stops getting updates from its maker, uninstall it. An abandoned app is a security liability.

Phishing: how attackers trick you into giving them your password

A phishing email looks like it comes from your bank, PayPal, Amazon, or Apple. It says your account has a problem, your payment method failed, or you need to confirm your identity. It includes a link that takes you to a fake website that looks exactly like the real one. You log in, and the attacker now has your password.

Phishing works because it looks real. The email address might say "noreply@paypal-security.com" or something close to the real thing. The website looks identical to the real PayPal. The message creates urgency — "Your account will be closed in 24 hours" — so you do not stop to think.

The defense is skepticism. Your bank will not ask you to log in via email. PayPal will not send you a link to confirm your identity. If you get an email asking you to click a link and log in, do not click it. Instead, go directly to the website by typing the address in your browser, or call the company's phone number from your statement. If the email is real, your account will show the same problem when you log in directly. If it is phishing, you just avoided giving your password to an attacker.

Hover over links in emails to see where they actually go. If a link says "Click here to verify your PayPal account" but the address bar shows "paypal-verify.ru" or something that is not PayPal's real domain, it is phishing. Delete it.

Public WiFi: the risk and how to reduce it

Public WiFi at a coffee shop or airport is not encrypted by default. Anyone on the same network can see the data you send — including passwords and credit card numbers if you type them in. This is a real risk, but it is specific: it only affects unencrypted data, and it only affects people on that exact network at that exact time.

Do not log into your bank account or enter a credit card number on public WiFi without protection. Do not check your email if you are worried about someone nearby. If you need to do these things on public WiFi, use a VPN (virtual private network). A VPN encrypts all the data you send, so even if someone is on the same network, they cannot see it. Popular VPNs include Proton VPN, Mullvad, and ExpressVPN. Some are free, some charge a monthly fee.

For casual browsing — reading news, watching videos, shopping for things you do not need to log into — public WiFi is fine without a VPN. The risk is real but small, and most people do not need protection for every moment online.

Malware: what it is and how you catch it

Malware is a program that does something you did not intend: stealing data, showing you ads, slowing down your device, or locking your files until you pay. You catch it by downloading it, usually from a website that is not what it claims to be.

The most common source is a fake read button. You search for "free video player" and click what looks like a read button, but it is actually an ad that installs malware instead. Real software comes from the official website or an official app store (the Apple App Store, Google Play Store, Microsoft Store). If you want VLC media player, go to videolan.org, not a random site that promises a faster read.

Antivirus software (Windows Defender on Windows, built-in protection on macOS and iOS, Google Play Protect on Android) catches most malware. It is not perfect, but it stops the common stuff. Keep it enabled and keep it updated. Do not read cracked software or pirated movies — those are common vectors for malware because the attacker controls the read.

What to do if you think you have been compromised

If you think your password has been stolen, change it when ready. Go directly to the website (do not click a link in an email), log in with your current password, and change it to something new and strong. If that account has two-factor authentication, make sure it is still enabled and that the phone number or email address is still yours.

If you think malware is on your device, restart it in safe mode and run a full scan with your antivirus software. If that does not work, you may need to back up your files and reinstall your operating system. If you think someone has access to your email account, change your password and check the recovery email and phone number — if an attacker changed those, they can lock you out and reset all your other passwords.

If money is involved — you think someone used your credit card or bank account — contact your bank or credit card company when ready. They can freeze the account, dispute charges, and issue a new card. The sooner you call, the more they can do.

Frequently Asked Questions

Is it safe to use the same password if I make it really strong?

No. A strong password only protects that one account. When a company gets hacked, attackers steal the password file. If you use the same password everywhere, one stolen password compromises everything. A unique password for each account means a breach at one company does not affect your other accounts.

Do I really need two-factor authentication if I have a strong password?

Two-factor authentication stops most account takeovers even if your password leaks. A strong password alone does not protect you if the company storing it gets hacked. For accounts with money or sensitive information, two-factor authentication is worth the extra 30 seconds per login.

Is a VPN necessary for everyday browsing?

Not for most people on home internet. A VPN protects you on public WiFi if you are logging into financial accounts or entering credit card numbers. For casual browsing at home, the risk is low enough that most people do not need one. Use your judgment based on what you are doing and where you are.

What should I do if I accidentally clicked a phishing link?

If you clicked the link but did not enter your password, you are fine — close the page. If you entered your password, change it when ready on the real website. If you entered credit card information, contact your credit card company. If you entered your email and password, change that password and check your email recovery settings to make sure an attacker did not change them.

Can my phone get malware from just visiting a website?

Modern phones (iOS and Android) are designed to prevent this. You cannot catch malware just by visiting a website the way you could on older computers. You catch malware by downloading and installing an app from outside the official app store, or by downloading a file and opening it. Stick to the Apple App Store or Google Play Store and you are protected against most malware.