Use a different password for every account
One reused password is the fastest way for a single leaked site to become five compromised accounts. A password manager lets you keep long, unique passwords without remembering them.
Free guide · always readable
Online safety tips that fit into an ordinary day.
Twelve practical habits, explained without jargon. Nothing here needs special software or technical training — start with one or two and the rest follow.
Read this first: safety is a habit, not a product
Most everyday digital problems do not come from sophisticated attackers. They come from a reused password, a link tapped in a hurry, an app that kept a permission it no longer needs, or a phone left unlocked. That is good news, because habits are cheaper and faster to change than technology.
Work through the twelve below at your own pace. If you only have five minutes today, do the two-step verification one and the update one — they prevent the largest share of common problems.
Five-minute version
If you do nothing else today
Six habits that carry most of the benefit. Tick them off in order — each takes only a few minutes on your phone.
- A unique password per account, kept in a manager
- Two-step verification on email, banking and social accounts
- Automatic updates switched on for the phone and apps
- Never entering credentials from a link you did not expect
- Screen lock, auto-lock timer and find-my-device enabled
- Monthly review of app permissions and connected devices
The twelve habits
Online safety, step by step
Each habit solves a specific, everyday problem. You do not need all twelve at once.
Turn on two-step verification everywhere it is offered
Even if a password is stolen, a second step blocks most attempts. Prefer an authenticator app or a security key over SMS where you can choose.
Keep your phone, laptop and apps updated
Updates usually close holes that are already being abused. Turning on automatic updates is one of the highest-value, lowest-effort habits there is.
Pause before you click or tap
Urgency is the giveaway. “Your account will be closed today”, “package awaiting delivery”, “invoice attached” — verify the sender in a second channel before acting.
Install apps from official stores, then read the permissions
A torch app asking for your contacts and microphone is answering a question nobody asked. If the permissions do not match the purpose, do not install it.
Review app permissions once a month
Location, microphone, camera, contacts and photos are the sensitive ones. Remove access for apps that no longer need it — most people find more than they expect.
Lock your screen and switch on find-my-device
A short auto-lock timer plus a strong screen lock turns a lost phone from a data loss into a minor inconvenience. Know how to remotely locate and erase before you need it.
Be careful where you log in on public Wi-Fi
Banking and email are the risky ones on shared networks. Use mobile data for those, or a VPN you deliberately chose and trust for the rest.
Back up what you could not afford to lose
Photos, documents and business records. One copy on the device plus one you control — an external drive or a cloud account with two-step verification — covers most everyday losses.
Do a privacy check-up on your main accounts
Who can see your posts, your friend list, your phone number, your date of birth? Set each one deliberately instead of accepting the default, and repeat every few months.
If someone is harassing you, do not delete the evidence
Screenshot what was said and when, block and report through the platform, and tell one person you trust. Responding in anger usually escalates; a calm record helps later.
Know in advance who you would contact
Your bank, your email provider, your platform’s report tool, a trusted family member, and — for anything serious — your local police cyber-crime unit. Deciding in advance removes panic from the moment.
Who it is for
The same habits, three different homes
What changes is not the advice but the way it gets talked about.
For families
Agree on a few house rules rather than a long list: devices stay charged in a shared space overnight, purchases need a second adult, and any “something feels wrong” message comes to an adult the same day. Children report problems far more often when the reaction is calm than when it is strict.
For schools and educators
Teach recognition instead of fear. Show what a misleading link looks like, walk through a permission screen together, and practise the pause. Students who can explain why something looked suspicious keep the habit longer than students who were told to be careful.
For small businesses
Start with shared accounts: give every person their own login so access can be removed when someone leaves. Keep one offline backup of your records, write down who is responsible for updates, and agree what to do if a payment request looks unusual.
When something goes wrong
Do this, in this order
Having a plan written down in advance is the difference between a bad hour and a bad month.
Something was clicked
Change that account’s password, switch on two-step verification, check for unfamiliar devices or forwarding rules, and review recent activity in the account.
A device is lost or stolen
Locate and lock it remotely, then erase it if it cannot be recovered. Change passwords for accounts that were signed in on that device.
Money or a payment is involved
Contact your bank immediately and tell them what happened. Speed matters more than anything else in this case.
Someone is being targeted or threatened
Keep the evidence, report it inside the platform, and contact your local police cyber-crime unit. Serious threats should never be handled alone.
Keep reading
Two more places to start
Both are free and written for people who do not work in technology.
A safer future starts with us
Help us build a safer digital future.
Early users, educators, community organizations and mission-aligned partners — there’s a place for you in our journey.