The order of operations
Security advice tends to arrive as a list of twenty equally urgent commandments. It is not equally urgent. For most people, attackers get in through three doors: a reused password exposed in someone else's breach, a convincing fake login page, or an unpatched device. Close those, and you are ahead of the majority of accounts on the internet. The rows below are ranked by how much risk each change removes per minute spent.
Habit changelog
Patch 1.0 · Email first
Secure the account that resets all others
Your email inbox is the master key: every "forgot password" link goes there. Give it a unique password, turn on two-step verification and add a passkey if offered. Do this before anything else on this page.
Patch 1.1 · Passwords
Use a password manager
Bitwarden (open source, generous free tier), 1Password (paid, polished) and KeePassXC (offline, free) all generate and store unique passwords. Your browser's built-in manager is also far better than reuse.
Patch 1.2 · Passkeys
Swap passwords for passkeys where offered
Passkeys use public-key cryptography under the FIDO2 and WebAuthn standards. The private key never leaves your device or manager, and it only works on the genuine site, which makes phishing pages useless.
Patch 1.3 · Two-step
Prefer an authenticator app over SMS
Text-message codes beat nothing, but SIM-swap attacks exist. Authenticator apps or hardware keys such as a YubiKey are stronger. Save your recovery codes somewhere offline.
Patch 1.4 · Breaches
Check Have I Been Pwned
Launched by security researcher Troy Hunt in 2013, the service indexes billions of leaked accounts. Enter your email, change any password tied to a listed breach and sign up for free alerts.
Patch 1.5 · Updates
Turn on automatic updates everywhere
Phone, laptop, browser, router. Most real-world attacks exploit flaws that already have a fix. The update you postpone is the one that matters.
Browser privacy, without the paranoia
Modern browsers have improved their defaults considerably. Safari's Intelligent Tracking Prevention limits cross-site tracking, Firefox ships Enhanced Tracking Protection with Total Cookie Protection, and Brave blocks most trackers and ads out of the box. Whichever you use, three settings are worth a look: block third-party cookies, enable HTTPS-only mode where available, and turn on Global Privacy Control if your browser supports it. GPC sends a signal asking sites not to sell or share your personal data, and some privacy laws, including California's, treat it as a valid opt-out.
Extensions deserve scrutiny too. Every add-on with permission to "read and change data on all websites" can see everything you do in that browser. Keep the list short, remove anything you have not used in a month, and prefer well-known open-source options such as uBlock Origin where your browser still supports it.
Spotting the fake login page
Phishing has grown more polished, with AI-written emails that no longer give themselves away through bad grammar. The reliable tell is the address bar, not the message. Your password manager helps here: if it does not offer to fill a login, stop and check the domain character by character. Never sign in through a link in an unexpected message; open the site from a bookmark instead. Urgency, such as "your account will be closed in 24 hours", is the attacker's favourite tool.
The quarterly re-check
Set a calendar reminder every three months. Review which apps can sign in with your Google, Apple or Microsoft account and revoke the strangers. Check your password manager's security report for weak or reused entries. Confirm your recovery email and phone number are current. Fifteen minutes, four times a year, is the cheapest insurance on the internet.