Digital fingerprint over an electronic circuit board
Personal security baseline

21 cybersecurity
tips that matter

A practical hardening checklist for the accounts, devices, messages, data, and money you rely on every day.

By Joel LimRevised for current guidance

Threat model: everyday life

You do not need to be a high-profile target.

Most attacks do not begin with a movie-style hacker choosing you. They begin with reused passwords, delayed updates, deceptive messages, exposed personal details, or automated scans looking for an easy opening.

The goal is not perfect safety. It is to remove the easiest paths in, notice problems sooner, and make recovery possible.

Your hardening progress

0 / 21 complete

Control group A

Lock down your accounts

Person signing in to a social media account on a phone
01

Use a password manager

Generate a unique, long password for every account. A password manager removes the need to memorize or reuse them.

Do thisStart with your primary email account.
02

Turn on strong MFA

Use a passkey, security key, or authenticator app when available. SMS codes are still better than password-only access, but resist phishing less effectively.

Do thisProtect email, banking, cloud storage, and social accounts first.
03

Adopt passkeys where offered

Passkeys replace typed passwords with a device-based sign-in and are designed to resist fake login pages.

Do thisStore passkeys only on devices and accounts you control.
04

Save recovery codes offline

MFA can lock you out when a phone is lost. Download one-time recovery codes and keep them somewhere separate and secure.

Do thisDo not leave the only copy inside the account it unlocks.
05

Review active sessions

Account settings often show signed-in devices and locations. Remove anything unfamiliar and change credentials after suspicious activity.

Do thisCheck your most important accounts every few months.

Control group B

Harden every device

Phone showing a security lock interface
06

Install updates automatically

Operating-system, browser, router, and app updates close known security gaps. Turn on automatic updates wherever possible.

Do thisReplace devices that no longer receive security patches.
07

Use a screen lock and encryption

Set a strong PIN or password and enable device encryption. Biometrics are convenient, but keep a strong fallback code.

Do thisAvoid easy PINs such as birthdays or repeated digits.
08

Back up important files

Keep recoverable copies of documents and photos so ransomware, loss, or hardware failure is not a catastrophe.

Do thisUse the 3-2-1 idea: three copies, two media types, one off-site.
09

Remove apps you do not use

Every installed app adds permissions, data collection, and update obligations. Delete abandoned software and browser extensions.

Do thisAudit apps and extensions quarterly.

Control group C

Slow down social engineering

Phone displaying social media and messaging applications
10

Verify unexpected requests

Pause when a message creates urgency, fear, or secrecy. Contact the person or company through a known number or official app.

Do thisNever trust contact details supplied inside the suspicious message.
11

Inspect links before opening

Check the actual domain, spelling, and destination. For sensitive accounts, open the official app or type the known address yourself.

Do thisHTTPS encrypts a connection; it does not prove a site is honest.
12

Treat attachments as untrusted

Unexpected invoices, shared documents, archives, and installers can carry malware or lead to fake sign-in pages.

Do thisConfirm with the sender through a separate channel.
13

Download from official sources

Use official app stores and vendor websites. Bundled installers and pirated software commonly add unwanted or malicious programs.

Do thisRead install screens and reject unrelated add-ons.

Control group D

Reduce your exposed data

Close-up view of a camera lens
14

Audit app permissions

Remove access to location, contacts, photos, microphone, and camera when an app does not need it.

Do thisChoose one-time or while-in-use access when available.
15

Limit public social posts

Names, routines, locations, schools, travel dates, and family details can support impersonation or targeted scams.

Do thisReview past posts, audience settings, and tagged content.
16

Protect camera and microphone access

Use hardware shutters where available and watch the operating system’s camera or microphone indicators.

Do thisA cover protects the camera, but permissions and updates protect more.
17

Secure your home network

Change default router credentials, use WPA2 or WPA3, update firmware, and create a separate guest network for visitors or smart devices.

Do thisA VPN can protect traffic in some situations, but it does not prevent phishing or malware.

Control group E

Protect money and recovery

Person taking a payment card from a wallet beside a laptop
18

Turn on transaction alerts

Enable notifications for purchases, transfers, password changes, and new payees so suspicious activity appears quickly.

Do thisContact the institution using the number on your card or official app.
19

Review statements regularly

Small unfamiliar charges may be a test before larger fraud. Check bank, card, and payment-account activity.

Do thisReport unauthorized activity immediately.
20

Use safer payment options

Prefer payment methods with fraud protections and avoid entering card details on unfamiliar sites or shared devices.

Do thisDo not let a site store payment details unless the convenience is worth the exposure.
21

Write an incident plan

Know how to freeze cards, secure email, change passwords, revoke sessions, restore backups, and report identity theft.

Do thisKeep key phone numbers and steps somewhere accessible offline.

Three useful corrections

Security tools are not magic shields.

VPN

Encrypts traffic between your device and the VPN provider. It does not stop fake sites, malicious downloads, account takeover, or unsafe behavior.

HTTPS

Protects data in transit to the site shown in your address bar. Criminal sites can also use HTTPS, so verify the domain and the request.

Antivirus

Can detect many threats, but it cannot compensate for unsupported software, reused passwords, or approving a fraudulent login.

If something feels wrong

Contain first.
Investigate second.

  1. 01

    Disconnect a compromised device from the network if malware is suspected.

  2. 02

    From a known-clean device, secure your email, financial accounts, and password manager.

  3. 03

    Change exposed credentials, revoke sessions, and preserve evidence such as messages and transaction details.

  4. 04

    Contact your bank, employer, platform provider, or local authorities as appropriate.

Keep learning

Use official guidance when the stakes are high.