Most cybersecurity advice online is either too technical, too paranoid, or too focused on threats that almost never affect regular people. The reality is that the vast majority of cyberattacks succeed because of a small number of common, preventable mistakes. You don't need to be a security professional to protect yourself. You just need a handful of consistent habits. Here are the five that matter most.
Use a Password Manager
Reusing passwords is the single most dangerous thing most people do online. When one site gets breached (and it will, eventually), attackers take those leaked credentials and try them on every other major platform. This attack is called credential stuffing, and it's automated, fast, and extremely common.
The solution is a unique, random password for every account. That sounds impossible to manage manually, which is where a password manager comes in. Apps like Bitwarden (free and open source), 1Password, or Dashlane generate and store strong passwords for you. You only need to remember one master password. It's one of the highest-leverage security changes you can make, and it costs almost nothing to set up.
Enable Two-Factor Authentication
Even if someone gets your password, two-factor authentication (2FA) stops them from logging in. With 2FA enabled, your account requires a second piece of proof, typically a time-based code generated by an app on your phone, before granting access.
Use an authenticator app like Aegis (Android), Raivo OTP (iOS), or Google Authenticator rather than SMS-based 2FA. SMS codes can be intercepted through SIM-swapping attacks. App-based codes are generated locally and never transmitted over the network. Enable 2FA on your email first. It's the master key to almost everything else.
Recognize Phishing Attempts
Phishing is the most common vector for account takeovers and malware infections. Attackers send fake emails or messages designed to look like they're from a trusted source, such as your bank, Google, Amazon, or a colleague, and trick you into clicking a link or entering your credentials.
A few things to watch for:
- Urgency and fear: "Your account will be suspended in 24 hours." Legitimate companies rarely threaten you like this.
- Mismatched sender addresses: The display name might say "PayPal Support" but the actual email address is something like support@paypa1-secure.com.
- Suspicious links: Hover over any link before clicking. The actual URL should match the company's real domain.
- Unexpected attachments: Don't open attachments you weren't expecting, even from people you know, since their account may have been compromised.
When in doubt, go directly to the website by typing the address yourself rather than clicking a link in the message.
Be Careful on Public WiFi
Public WiFi networks at coffee shops, airports, and hotels are convenient but risky. On an open network, it's relatively easy for someone on the same network to intercept unencrypted traffic. While HTTPS has made this harder than it used to be, you should still take precautions.
The best option is a VPN (Virtual Private Network), which encrypts all traffic between your device and the internet. Reputable options include Mullvad and ProtonVPN. At minimum, avoid accessing sensitive accounts like banking, work email, and healthcare portals over public networks. If you must, make sure the site uses HTTPS (the padlock icon in your browser) and that 2FA is enabled on those accounts.
Keep Your Software Updated
Software updates are not just about new features. The majority of updates patch security vulnerabilities, which are known flaws that attackers actively exploit. Running outdated software means leaving doors unlocked that attackers know exactly how to open.
Enable automatic updates on your operating system, browser, and any apps you use regularly. This is especially critical for your browser and your phone's OS, which are the two surfaces most exposed to the internet. You don't need to update the moment a patch drops, but being weeks or months behind is a real risk. If you're still running an OS version that no longer receives security updates, consider upgrading or replacing the device.
None of these habits require technical expertise or significant time investment. Set them up once, and they work in the background protecting you continuously. Security doesn't have to be complicated. It just has to be consistent.