You do not need to be an expert to be much safer online. One focused hour covers the steps that stop most account takeovers and cut down how much of your life is tracked. Do them in this order. Each block takes about fifteen minutes.
Minutes 0 to 15: a password manager
The single biggest risk is the same password on several sites. When one site leaks, criminals try that e-mail and password everywhere else. A password manager makes a different strong password for every site and fills it in for you.
You probably have one already. Apple's Passwords app, Google Password Manager and the managers built into Firefox and Edge are free and sync between devices. Dedicated password managers add sharing and work across every platform. Any of them is far better than reuse.
- Protect the manager with a long passphrase you do not use anywhere else, or with your device unlock.
- Change the passwords for your e-mail and your bank first, then the rest as you sign in to each site.
- Use the built-in check for reused and leaked passwords. You can also look up your e-mail address on haveibeenpwned.com to see which breaches it appears in.
Minutes 15 to 30: passkeys and two-factor sign-in
A password alone is not enough for the accounts that matter. Start with your main e-mail account, then your bank, your phone account (Apple or Google) and your social accounts.
- Passkeys are the best choice where a site offers them. They replace the password with your fingerprint, face or device PIN, and they only work on the real site, so a phishing page cannot steal them.
- An authenticator app is the next best. It shows a new six-digit code every 30 seconds.
- Codes by text message are weaker, because phone numbers can be hijacked. Use them only when nothing else is offered.
Save the recovery codes each site gives you, in your password manager or on paper in a safe place. On Internetivo you can add a passkey on the Security page; our account safety guide shows how.
Minutes 30 to 45: updates and your phone
Updates close the holes attackers use. Turn on automatic updates for your computer, your phone, your browser and your apps. Check your home router too: many have an automatic update setting in their admin page. Replace any device that no longer gets updates.
Then spend ten minutes in your phone's settings:
- Use a screen lock with at least six digits, plus your fingerprint or face. Current iPhones and Android phones encrypt their storage once a screen lock is set.
- Turn on Find My on an iPhone or Find Hub on Android (it was called Find My Device until 2025), so you can lock or erase a lost phone.
- Review app permissions for location, microphone, camera, contacts and photos. Choose "while using the app" or "ask every time" over "always".
- Delete apps you no longer use.
- Hide message content on the lock screen, so codes and private messages do not show to anyone holding your phone.
Minutes 45 to 60: your browser and public Wi-Fi
Almost every site now uses HTTPS, which encrypts what you send and receive. Browsers can insist on it. Turn on HTTPS-Only Mode in Firefox, "Always use secure connections" in Chrome, or the matching setting in Edge. Safari upgrades most connections automatically. The old HTTPS Everywhere extension was retired in January 2023 for this reason; if you still have it, remove it.
- Block third-party cookies. Firefox and Safari block many trackers by default; check that the setting is on.
- Open your list of extensions and remove any you do not recognise or no longer use. Extensions can read the pages you visit.
- Private or incognito mode only stops your own device saving history. Websites and your internet provider still see your visits.
- For private conversations, use a messaging app with end-to-end encryption, such as Signal, WhatsApp or iMessage.
Public Wi-Fi is safer than it used to be, because HTTPS protects your pages from other people on the network. The remaining risks are fake hotspots with a convincing name and sign-in pages that ask for more than they need. Check the network name with staff, turn off automatic joining of open networks, and use your phone's own data or hotspot for banking if you are unsure. A VPN helps on networks you do not trust. It also moves your trust to the VPN company, so pick a well-known one and avoid free services that pay for themselves with your data.
For more, the UK NCSC's top tips for staying secure online and CISA's Secure Our World cover the same ground in short steps.
Common questions
- Is the password manager in my browser good enough?
- For most people, yes. It is free, it syncs and it fills passwords only on the right site. What matters most is using one at all.
- What happens to my passkeys if I lose my phone?
- Passkeys saved in Apple Passwords or Google Password Manager sync to your other signed-in devices. Keep a second sign-in method and your recovery codes for each important account anyway.
- Do I need a VPN at home?
- Not for security on a home network you control. Some people use one for privacy from their internet provider. That part is optional.
- Do I need antivirus software?
- Windows and macOS include built-in protection that is on by default. Keep it on and keep the system updated.
Put a reminder in your calendar for six months from now and spend fifteen minutes going through this list again.