Practical guide · No commercial links on this page

Online security basics: the free measures worth doing before you buy anything

Security advice for home users has a poor ratio of volume to usefulness. This is the short version: six things, in rough order of how much risk each removes per hour of effort, with the reasoning for each. None of them costs anything.

1. Turn on automatic updates and leave them on

A very large share of successful attacks on home machines exploits a flaw that was patched weeks or months earlier. The exploit is public, the fix is public, and the machine has not been restarted. This is the cheapest risk reduction available anywhere in computing.

• Windows Update, macOS Software Update, and your phone's system update: automatic, and actually restart when asked.
• Your browser, which is the program most exposed to hostile input. Chrome, Edge and Firefox update themselves; they still need a restart to apply it.
• Everything that opens files from the internet: PDF reader, office suite, media player, archiver.
• Your router's firmware, which almost nobody checks. Log in once a year and look.

Uninstall what you do not use. Software that is not installed cannot be exploited, and browser extensions in particular accumulate broad permissions and change hands quietly.

2. Use a password manager and stop reusing passwords

The realistic threat is not that someone guesses your password. It is that a service you signed up to years ago is breached, the credentials appear in a list, and someone tries the same email and password against your email provider and your bank. This is called credential stuffing and it is automated and cheap.

The fix is one unique password per site, which is impossible to do in your head and trivial with a manager. Every major browser has one built in at no cost, and there are capable standalone managers, including free and open-source ones. Which you choose matters far less than using one at all.

Protect the manager itself with a long passphrase you have never used anywhere else, and turn on two-factor authentication for it. Length beats complexity: four or five unrelated words are stronger and far easier to remember than a short string of substituted characters.

3. Turn on two-factor authentication where it matters

Two-factor authentication means a stolen password is not enough on its own. You do not need it everywhere; you need it on the accounts that can be used to reset the others.

1. Your email account, first. Whoever controls your email can reset almost every other account you have. This is the single highest-value account you own.
2. Banking and payment services.
3. Your password manager.
4. Cloud storage, and any account with a payment card saved.
5. Social accounts, which are used to reach the people who trust you.

On method: an authenticator application is meaningfully better than codes by SMS, because SMS can be intercepted through SIM-swap fraud. A hardware security key is better still and is the only widely available method that resists phishing outright, because it will not authenticate to a look-alike domain. SMS is nevertheless much better than nothing — do not let the choice stop you switching it on.

4. Back up, and test that the backup restores

Ransomware is the one category where prevention can fail completely and recovery is still possible. A backup you have never restored from is a hypothesis, not a backup.

The rule of thumb professionals use is 3-2-1: three copies of anything you care about, on two different kinds of media, one of them kept offline or off-site. For a household that usually means the original, an external drive kept disconnected between backups, and a cloud copy.

The offline copy matters specifically because ransomware encrypts everything it can reach, including an always-connected external drive and, in some cases, a synchronised cloud folder. Unplug the drive. Once a quarter, restore a few files at random and confirm they open.

5. Learn to read a link before you click it

No product stops a person from typing their password into a convincing copy of a login page. This is the layer that stays yours, and it is worth ten minutes to learn.

Beyond the address itself, the reliable tells are: urgency and a deadline; a request to “verify”, “confirm” or “reactivate” an account; an attachment you did not expect; a request for payment through an unusual channel; and any message where the fastest resolution involves you not checking with anyone. When in doubt, do not use the link in the message — open the site yourself, or call the organisation on a number you already had.

The same applies to renewal notices for security software. If you have bought an antivirus subscription, expect look-alike renewal emails, and renew only from the application on your machine or from the vendor's site typed in yourself. Figure 5 of our main guide shows what one of these messages looks like, marker by marker.

6. Give your devices a smaller surface

• Use a standard, non-administrator account for daily work on Windows and macOS. Malware runs with the rights of the account that starts it.
• Lock your screen and use full-disk encryption — BitLocker on Windows, FileVault on macOS, and the default encryption on any current phone. Lost hardware is a far more common data loss than any hack.
• Change your router's administrator password from the factory default, and use WPA2 or WPA3 on the wireless network.
• Review app permissions on your phone occasionally. Location, microphone, camera and contacts are the ones worth checking.
• Prune browser extensions. They can read everything on every page you visit. Keep the ones you actually use.

Where paid software fits

After all six of the above, a paid security suite is a genuine but incremental addition. It can be worth buying if you need one subscription across several devices and operating systems, if you want a VPN and an antivirus on one bill, if you want ransomware controls that are easier to configure than the built-in ones, or if you want a support channel to call when something goes wrong. Our guide to Avast works through that decision in detail, including the case for using the free Microsoft Defender that is already on your Windows machine. That guide carries partner links and says so; this page does not.