To protect your data, start with four habits CISA highlights in its Secure Our World framework: recognize and report phishing, use strong passwords, turn on multifactor authentication (MFA), and install software updates. The 15 practices below build on that foundation to help protect your accounts, devices, and files. They are practical habits, not a formal ranking or a guarantee against every attack.
Protect your accounts
1. Use a password manager and give every account a unique password
A password manager can generate and store long, random passwords so you do not have to remember a different one for every site. CISA’s 2024 Secure Our World tip sheet advises passwords of at least 16 characters that are random and unique to each account. Reusing a password lets a stolen credential put other accounts at risk.
As an Amazon Associate I earn from qualifying purchases.
When choosing a manager, consider whether it works across your devices, how account recovery works, whether it supports MFA for the vault, and whether you prefer cloud convenience or local storage that you maintain yourself. Choose a provider you trust, and make sure you understand how you would regain access if you lose a device or forget the master password.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Turn on MFA for important accounts
MFA requires another factor beyond your password, such as a physical security key or an authenticator app. CISA describes it as “a layered approach to securing your online accounts and the data they contain.” Enable it first on email, financial, social, and shopping accounts, then on other services that offer it. Email is especially important because it can be used to reset passwords elsewhere.
#1 Best Overall
Where a service supports it, a security key is a strong option; authenticator apps are another. MFA methods differ in how well they resist phishing, and not every account supports hardware keys. Before relying on a key, check that it works with your devices and the specific service, and set up a recovery method or spare key so a lost key does not lock you out. CISA’s MFA guidance discusses security keys and authenticator apps.
3. Review recovery details, sessions, and alerts
Check that important accounts have recovery email addresses or phone numbers you still control. Review signed-in devices or active sessions, and turn on login or security alerts when available. Remove sessions you do not recognize and update recovery details after a phone number or email change. Services use different menus and controls, so look in each account’s security or privacy settings.
Spot and handle phishing
4. Pause before opening unexpected links or attachments
Do not let urgency make the decision for you. Be cautious of alarming claims, requests for personal information, unexpected attachments, or offers that seem too good to be true. Check who sent the message and whether the request makes sense in context. If unsure, go to the organization’s website or app directly rather than following a message link.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches5. Report and delete suspicious messages
Use the email or messaging service’s report-phishing control when available, then delete the message. Do not reply, click links, or open attachments to challenge the sender. For an urgent payment, password, or account request, verify it through a separate channel you already know—such as a phone number on an official statement—not contact details included in the message. CISA’s Secure Our World framework includes recognizing and reporting phishing.
Keep devices harder to access or compromise
6. Install updates promptly
Keep your operating system, browser, and apps updated. Turn on automatic updates where available, and restart devices when an update requires it. Updates can include security fixes; postponing them indefinitely leaves known issues unaddressed. CISA lists software updates among its core Secure Our World practices.
7. Change default passwords on routers and connected devices
Replace factory or default administrator passwords on your home router and other connected devices with unique credentials. Use a non-default password for the Wi-Fi equipment’s administration settings; do not confuse that with the password you share to join the Wi-Fi network. If a device’s setup instructions do not make clear how to change its administrator credentials, consult its official support materials.
Rank #3
8. Lock your phone and computer
Set a strong passcode or equivalent screen lock on each phone and computer, and configure the device to lock when not in use. Keep your unlock code private. A screen lock helps prevent casual access to files, messages, and account sessions if a device is left behind or borrowed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →9. Use a standard account for everyday computer tasks
When your computer supports separate account types, use a standard, non-administrator account for routine work and elevate privileges only when a task requires them. This limits how much a routine app or action can change on the system. Keep an administrator account available for maintenance, and protect it with a strong password.
10. Keep built-in security protections enabled
Leave your operating system’s built-in security protections on and keep them current. CISA’s older digital-home guidance mentions antivirus software, while its newer Secure Our World materials emphasize updates, backups, encryption, and phishing awareness. These sources do not establish that every user needs a paid third-party security suite.
11. Install apps carefully and review permissions
Get apps from official sources where possible. Before granting access, consider whether the requested permissions make sense for the app’s purpose; a flashlight app, for example, may not need access to contacts. Remove apps you no longer use, which also reduces the number of accounts and software components you need to maintain. App stores and permission controls vary by device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect files from loss and exposure
12. Encrypt devices and sensitive files—with recovery in mind
Encryption helps protect data stored on a computer, phone, removable drive, or in a sensitive file if someone gains access to the storage. Use the encryption features available on your device or a trusted tool appropriate to the data. Before enabling encryption, back up important files and securely store the recovery key or password. Without the required recovery information, you may be unable to retrieve your own data. CISA’s device data guidance recommends planning for recovery as well as protecting stored data.
Free tools Windows power users keep installed
One-click scans. No signup required.
13. Back up important files regularly
Keep copies of files you cannot afford to lose in a vetted cloud service or on an external drive. CISA advises users to “Frequently back up your data to reduce the risk of permanent data loss.” For an external drive, disconnect it when a backup is complete and store it safely; leaving it attached can expose it to the same incident affecting the computer, including ransomware. Check that you can restore files from your chosen backup rather than assuming the copy will work when needed. See CISA’s guidance on protecting data stored on devices.
Best Value
Reduce what others can see or use
14. Share less personal information publicly
Review who can see your profile, posts, and location information on social and other services. Share only what you intend to make public, and revisit visibility settings when a service changes its controls. The exact settings and labels vary across platforms, so check each service rather than assuming one setting applies everywhere.
15. Be deliberate with shared devices and networks
Use a connection you trust for sensitive tasks when practical. On a shared computer, avoid saving passwords, sign out of accounts when finished, and close the session. A VPN may protect some traffic between your device and the VPN provider, but it does not make browsing automatically safe or make a suspicious link trustworthy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
