You do not need to be a security expert to protect yourself online. Most successful cyberattacks exploit simple mistakes that are easy to avoid with a few good habits. This guide covers the essential cybersecurity practices that will protect you from the vast majority of threats — written in plain language, no technical background required.

1. Use a Password Manager

Weak or reused passwords are the number one cause of account takeovers. A password manager generates strong, unique passwords for every site and remembers them for you. You only need to remember one master password.

• Bitwarden: Free, open-source, excellent — this is what we recommend for most people
• 1Password: Premium, very polished, great for families and teams ($3/month)
• Apple Keychain: Built-in to iPhone and Mac, works well within the Apple ecosystem

2. Enable Two-Factor Authentication (2FA)

Two-factor authentication adds a second layer of security beyond your password. Even if someone steals your password, they cannot log in without the second factor. Enable 2FA on every important account: email, banking, social media, and any account with payment information stored.

Use an authenticator app (Google Authenticator, Authy, or the one built into your password manager) rather than SMS codes wherever possible — SMS 2FA can be bypassed through SIM swapping attacks.

3. Recognise Phishing Attempts

Phishing is when attackers send fake emails or messages pretending to be legitimate companies to steal your login credentials or payment information. Red flags to watch for:

• Emails creating urgency: “Your account will be suspended in 24 hours”
• Sender address that does not match the company (e.g. support@paypa1.com)
• Links that do not go to the official website (hover over links before clicking)
• Unexpected attachments, especially .zip or .exe files
• Requests for passwords, credit card numbers, or verification codes via email or text

4. Keep Your Software Updated

Software updates patch security vulnerabilities. Attackers actively exploit known vulnerabilities in outdated software — this is how many ransomware attacks spread. Enable automatic updates for your operating system, browser, and apps. This is one of the simplest and most effective security measures available.

5. Use a VPN on Public Wi-Fi

Public Wi-Fi networks in cafes, airports, and hotels can be monitored by attackers. A VPN (Virtual Private Network) encrypts your internet traffic, preventing others on the same network from intercepting it. Recommended VPNs: Mullvad (most privacy-focused), ProtonVPN (free tier available), or ExpressVPN (fastest speeds).

6. Back Up Your Data

Ransomware attacks encrypt your files and demand payment to restore them. The best protection is having recent backups that the attacker cannot reach. Follow the 3-2-1 rule: keep 3 copies of your data, on 2 different media types, with 1 stored off-site or in cloud storage.

7. Be Careful What You Share Online

Information you share publicly on social media can be used by attackers for social engineering — using personal details to make phishing attempts more convincing, guess security questions, or impersonate you. Think carefully before posting your birthday, phone number, home address, or information about your family members.

The Most Important Things to Do Today

1. Install Bitwarden and change your most important passwords to unique, strong ones
2. Enable 2FA on your email account (this is the most critical account to secure)
3. Enable automatic updates on your phone and computer
4. Back up your important files to cloud storage or an external drive

Do these four things and you will be more secure than the vast majority of internet users. Cybersecurity is not about being paranoid — it is about making yourself a harder target than average.