12 Online Safety Habits Every Beginner Should Use

Updated: 10 September 2026 · Reading time: about 9 minutes

Online safety is not one special app or one perfect setting. It is a small group of repeatable habits that reduce the chance of account theft, scams, lost data and unwanted access. You do not need to become a cybersecurity expert. Start with the accounts and devices that would hurt most to lose.

If you only have 15 minutes

1. Update your phone and browser.
2. Give your primary email a unique password.
3. Turn on a strong second sign-in method.
4. Check recovery phone and email details.
5. Back up the files and photos you cannot replace.

Why these habits work together

Each habit covers a different failure. Updates close known software weaknesses. Unique passwords prevent one breach from spreading. Multi-factor authentication adds another barrier. Backups reduce the damage from loss or ransomware. Independent verification defeats many scams. If one layer fails, another may still protect you.

The U.S. Federal Trade Commission recommends prompt software updates, strong passwords, two-factor authentication, caution with suspicious messages and a plan for incidents. Google’s account-security guidance similarly emphasises security checkups, recovery options, stronger sign-in methods, updates and removing unneeded access.

1. Install updates promptly

Software companies issue updates not only for new features but also to repair security problems. Turn on automatic updates for the operating system, browser, security software and important apps. Restart when an update requires it.

Use update controls built into the device or the developer’s official app store. A random webpage that says “Your browser is outdated—download now” may be an advertisement or malware attempt.

2. Lock every personal device

Use a screen lock on phones, tablets and computers. Choose a PIN or password that is not easy to observe or guess. Configure automatic locking after a reasonable period and require the lock after a restart.

A fingerprint or face check can make daily unlocking easier, but protect the underlying device PIN because it may also unlock stored credentials. Do not share a device unlock code by chat or use the same code for banking and other accounts.

3. Use a unique password for every account

A reused password lets one breach spread to email, shopping, social media and financial services. Use a trusted password manager to generate and store long random passwords. Memorise only the manager’s strong master passphrase and keep a safe recovery plan.

Start with email, the password manager, banking, mobile carrier and cloud storage. Follow our step-by-step guide to creating strong passwords without reusing them.

4. Turn on multi-factor authentication

An extra sign-in step can stop someone who has only your password. Prefer phishing-resistant methods such as a supported passkey or hardware security key when practical. Trusted device prompts and authenticator apps are useful options. SMS is generally better than leaving an important account password-only, but it relies more heavily on the security of the phone number.

Our two-step verification comparison explains the trade-offs and recovery needs of each method.

5. Keep account recovery current

Review recovery email addresses, phone numbers, backup codes and trusted devices. Remove a number or device you no longer control. Protect the recovery email as strongly as the account it can reset.

Store backup codes away from the everyday phone. Never read a recovery or one-time code to a caller, even if the caller knows your name, email address or recent account activity.

6. Pause before acting on unexpected messages

Phishing messages use fear, excitement and authority to make you click quickly. Do not use an unexpected message’s link, attachment, QR code, reply address or phone number to resolve a sensitive issue. Open the official app or contact the organisation through details you already trust.

A real logo, correct grammar and your real name do not prove a message is genuine. Use our 60-second phishing checklist whenever a message asks you to sign in, pay, share a code or install something.

7. Install fewer apps and browser extensions

Every app and extension adds code, permissions and an update dependency. Install only what you need, from the genuine developer or official store listing. Check the developer name, requested permissions, recent updates and whether the function justifies the access.

Review installed apps and extensions every few months. Remove those you no longer use. Avoid pirated software, unofficial “premium unlocks” and tools recommended by unsolicited support messages.

8. Review permissions and connected accounts

An app may retain access to email, files, contacts, location or social accounts even after you stop using it. Open each important account’s security or connected-app page and remove access that is unfamiliar or unnecessary.

On the device, limit camera, microphone, location, contacts and photo access to apps that need it. “Allow only while using the app” is often a sensible choice when available. A permission is not automatically dangerous, but it should match the app’s purpose.

9. Secure the home Wi-Fi and router

The router connects household devices to the internet. Change any default administrator password, install router firmware updates and use modern Wi-Fi encryption supported by your equipment. Give the Wi-Fi network a strong unique password.

Do not expose the router’s administration page to the internet unless you understand and need that feature. Use a separate guest network for visitors or less-trusted smart devices if the router supports it. Replace a router that no longer receives security updates.

10. Back up important data—and test recovery

Decide which photos, documents, contacts and project files cannot be replaced. Keep more than one copy, with at least one copy separated from the everyday device. Depending on the data, that may combine a reputable cloud backup with an external drive that is disconnected when not in use.

A sync service is helpful, but synchronisation can also copy accidental deletion or corruption. Check when the last backup completed and practise restoring a harmless sample file. Back up before a factory reset, major operating-system change or device repair.

11. Share less information publicly

Public birthdays, travel plans, workplace details, family names and phone numbers can make impersonation or security-question guessing easier. Review who can see old posts and profile fields. Avoid posting tickets, identity documents, recovery screens, addresses or images containing QR codes and barcodes.

Assume that a public post can be copied even if you later delete it. For private details, use an appropriate direct channel and still share only what is necessary.

12. Notice problems and respond quickly

Enable useful sign-in and transaction alerts through official apps. Periodically review recent devices, connected apps, recovery details and payment activity. An alert is a reason to inspect the official account—not a reason to click the alert’s link.

If you find unauthorised access, use our 12-step hacked-account checklist. Secure the primary email, change reused passwords, remove unknown sessions and repair recovery settings.

A simple priority table

Priority	Protect first	Minimum action
Critical	Primary email, password manager, banking	Unique password, strong second step, verified recovery
High	Mobile carrier, cloud files, work accounts, social media	Same protections plus session and app review
Device	Phone, computer, router	Updates, screen lock, safe apps and backup
Routine	Less important accounts	Replace reused passwords and close unused accounts carefully

A one-week beginner plan

1. Day 1: Update devices and turn on automatic updates.
2. Day 2: Secure primary email and review recovery details.
3. Day 3: Set up a password manager and fix financial accounts.
4. Day 4: Enable stronger sign-in methods and save recovery codes.
5. Day 5: Remove unused apps, extensions and connected-account access.
6. Day 6: Back up essential files and test one restore.
7. Day 7: Review privacy settings and teach one family member the phishing check.

Five rules for public or shared devices

• Do not save passwords or select “trust this device.”
• Use private browsing only for local history control; it does not make an unsafe computer trustworthy.
• Sign out fully when finished.
• Do not access banking or a password vault if you can wait for a trusted device.
• Assume installed software or physical observers may capture what you type.

Frequently asked questions

Do I need paid security software?

Not necessarily. A supported operating system, built-in security features, prompt updates and safe behaviour provide a strong foundation. Higher-risk users or organisations may need additional managed protection.

Is public Wi-Fi always unsafe?

Modern encrypted websites reduce some risks, but a public network and the people around you remain outside your control. Keep devices updated, verify sites, avoid sensitive work when possible and never bypass a browser security warning.

Does private browsing hide me online?

No. It mainly limits what the browser saves locally after the session. Websites, network operators, employers or signed-in services may still observe activity.

Which account should I secure first?

Your primary email, because it often resets other accounts. Then secure the password manager, financial accounts, mobile carrier and cloud storage.

Final monthly check

• Updates are installed.
• Backups completed and one restore was tested recently.
• No important password is reused.
• Recovery methods and registered devices are current.
• Unknown apps, extensions and connected access are removed.
• Suspicious messages are verified through a separate trusted route.

Sources and review note

• U.S. Federal Trade Commission: Protect Your Personal Information From Hackers and Scammers
• Google Account Help: Make your account more secure

Editorial note: Security controls differ across devices and services. Use current official instructions for exact menus, and seek qualified help for an active financial, workplace or identity incident.