Why a Checklist
The internet in 2026 is more hostile than ever — but the defensive playbook for an individual is short, well-understood, and works. You can implement most of it in a weekend, and once done, you barely have to think about it again.
1. Update Everything
- Enable automatic OS updates.
- Enable automatic browser updates.
- Restart your computer at least once a week so patches actually apply.
- Apply firmware updates on your router every few months.
The single most effective thing you can do.
2. Use a Password Manager
Every account gets a unique, random password. You only remember one master password. See our guide on password managers.
3. Turn On MFA Everywhere
Email first, then banking, then social media, then work tools. Use an authenticator app or a hardware key — avoid SMS if you can. See our MFA explainer.
4. Lock Down Your Email
Your email is the master key to most of your other accounts (it controls password resets). Treat it accordingly:
- Long, unique password.
- Hardware key or authenticator app for MFA.
- Review the "logged-in devices" list periodically.
- Delete old or unused linked applications.
5. Be Sceptical of Unsolicited Messages
If you didn't ask for it, treat it as suspicious — regardless of how convincing it looks. This applies to emails, texts, phone calls, DMs, and unexpected pop-ups.
When in doubt, verify through a separate channel.
6. Scan Unknown Files
A 10-second scan with a tool like Virus Purge before opening any file from outside your normal email/cloud workflow is one of the highest-ROI safety habits you can build.
7. Back Up Your Important Data
Follow the 3-2-1 rule: three copies, two different media, one off-site. See the backup guide.
Even one cloud backup that is not continuously writable (object lock, versioning) puts you ahead of most people.
8. Limit the Personal Information You Share
The less information about you is publicly searchable, the harder it is to social-engineer you. Practical steps:
- Tighten privacy settings on every social network.
- Remove yourself from data-broker sites (or use a service that does it for you).
- Use a separate email address for online accounts vs personal correspondence.
- Never publish your phone number or address openly.
9. Use a Reputable Antivirus
On Windows, Defender is usually enough. On macOS, the built-in protections plus a careful approach to downloaded files are sufficient for most users. Whatever you use, keep it on and updated.
10. Make a Plan for "What If"
Spend ten minutes thinking through:
- If my email is hacked, what do I do first? (Spoiler: change the password, sign out everywhere, contact your bank.)
- If my laptop is stolen, can I wipe it remotely? Is the disk encrypted?
- If my main accounts are compromised, do my close family know how to verify the request is really me?
Having even a rough mental playbook turns a panic moment into a manageable one.
The Final Rule
Slow down. Almost every successful attack relies on the victim acting quickly under social pressure. If something feels urgent and uncomfortable, pause for sixty seconds before doing anything. That pause is the most underrated security control in the world.