Key takeaways
- Most successful attacks exploit simple weaknesses: reused passwords, missing updates and phishing.
- A password manager plus multi-factor authentication blocks a large share of account takeovers.
- Keep software updated and back up important files regularly.
- When a message creates urgency or asks for credentials or money, stop and verify through another channel.
You do not need to be a security expert to protect yourself online. Most cyberattacks against individuals and small businesses are not sophisticated — they rely on predictable habits such as reusing passwords, clicking links in urgent-sounding messages or postponing updates.
These 12 cybersecurity tips cover the habits that make the biggest difference. Each one is practical, free or low-cost and can be set up in an afternoon.
1. Use a password manager
The biggest password problem is reuse: when one website is breached, attackers try the same email and password on other services. A password manager generates and stores a long, unique password for every account, so you only need to remember one strong master password.
2. Turn on multi-factor authentication (MFA)
MFA requires a second proof of identity — such as a code from an authenticator app, a prompt on your phone or a physical security key — in addition to your password. Even if your password is stolen, MFA makes it much harder for someone else to log in. Enable it first on your email, banking, cloud storage and social media accounts.
Tip: authenticator apps and security keys are generally more secure than SMS codes, which can be intercepted through SIM-swap attacks. Consider passkeys where available.
3. Keep your devices and apps updated
Updates often fix security vulnerabilities that attackers actively exploit. Turn on automatic updates for your operating system, browser and apps, and replace devices that no longer receive security updates.
4. Learn to spot phishing
Phishing messages impersonate trusted organisations to trick you into clicking a link, opening an attachment or sharing information. Watch for these warning signs:
- Urgency or threats: "Your account will be closed in 24 hours."
- Requests for passwords, codes, payment or personal details.
- Sender addresses or links that do not quite match the real organisation.
- Unexpected attachments or prizes.
When in doubt, do not click. Open the official website or app yourself, or contact the organisation using details you already trust.
5. Back up important data
Backups protect you from ransomware, device theft, hardware failure and accidental deletion. Follow the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy offsite or in the cloud. Test restoring a file occasionally.
6. Secure your home Wi-Fi
- Change the router's default admin password.
- Use WPA3 encryption, or WPA2 if WPA3 is not available.
- Keep the router's firmware updated.
- Create a separate guest network for visitors and smart-home devices.
7. Be careful on public Wi-Fi
Public networks in cafés, hotels and airports may be insecure. Stick to websites using HTTPS, avoid sensitive tasks such as banking on unknown networks, and consider using your phone's mobile data or a reputable VPN.
Recommended free courseCybersecurity Essentials: Protect Systems, Data and People View course 8. Lock your devices
Use a PIN, password or biometric lock on every phone, tablet and laptop, set a short auto-lock time and enable device encryption. Turn on "find my device" features so you can locate or wipe a lost device remotely.
9. Limit what you share
Details such as your birthday, pet's name, school or travel plans can help attackers guess security answers or craft convincing scams. Review the privacy settings on your social media accounts and think before posting personal information publicly.
10. Review app permissions and accounts
Remove apps you no longer use, and check which apps can access your location, camera, microphone and contacts. Delete old online accounts you no longer need — every unused account is a potential risk.
11. Verify payment and money requests
Scams increasingly involve fake invoices, impersonated managers or family members asking for urgent transfers, sometimes using AI-generated voices or messages. Always confirm unusual payment requests through a separate, trusted channel before sending money.
12. Know what to do if something goes wrong
- Change the password of the affected account and any account using the same password.
- Enable MFA and sign out of all sessions.
- Contact your bank immediately if financial information was exposed.
- Scan your devices with reputable security software.
- Report the incident to the relevant service and, where appropriate, to local authorities.
Extra tips for small businesses
- Require MFA for all staff accounts, especially email and administrator access.
- Give people only the access they need (least privilege).
- Run short, regular security awareness training.
- Keep an inventory of devices and software, and update them consistently.
- Write a simple incident response plan so everyone knows who to call.
Interested in making security your career? Read how to start a cybersecurity career with no experience.
Conclusion
Staying safe online is mostly about consistent habits: unique passwords in a password manager, multi-factor authentication, regular updates, healthy suspicion of urgent messages and reliable backups. Put these twelve tips into practice and you will be protected against the vast majority of everyday cyber threats.
Frequently asked questions
What is the most important cybersecurity tip?
Use a unique password for every account, stored in a password manager, and turn on multi-factor authentication for important accounts such as email and banking.
How can I recognise a phishing email?
Look for urgency, threats, requests for passwords or payments, unexpected attachments and sender addresses or links that do not match the real organisation.
Is public Wi-Fi safe to use?
Public Wi-Fi can be risky. Use HTTPS websites, avoid sensitive tasks like banking on unknown networks, and consider mobile data or a reputable VPN.
What should I do if my account is hacked?
Change the password immediately, enable multi-factor authentication, sign out of all sessions, check account settings for changes and contact your bank if financial details may be exposed.
