What Are the Online Safety Basics in Ten Minutes?

I've had this conversation more times than I can count, a friend, a neighbour, someone at a dinner party who finds out what I do for a living and asks the same question: where do I even start? I used to try to answer that properly, walking through passwords, two-factor authentication, backups, phishing, and VPNs, the lot. By the time I'd finished, most people had glazed over, and worse, they hadn't actually changed anything. So I stopped trying to cover everything, and now I keep it to what I can genuinely explain in about ten minutes, standing in a kitchen, without a single slide or link.

Why I Stopped Trying to Cover Everything at Once

The problem with a comprehensive answer is that it sounds like homework, and homework gets postponed indefinitely. If I list ten things someone should do, they leave with a vague sense of guilt and do none of them. If I give them two things, they can actually go home and do those two things that evening. I'd rather someone properly finish two changes than half-remember eight. So the first thing I do now, before I say anything technical, is pick the two most consequential things instead of trying to be thorough.

The Two Things I Always Explain First

The two things are a password manager and turning on two-factor authentication for email, in that order, because email is the account that can reset almost everything else if it's compromised. I don't get into the technical detail of how a password manager works or which one to choose in that first conversation, I just tell them it exists, that it takes about five minutes to install, and that it will fix the reused-password problem almost every person I've ever talked to has without realising how much risk it creates. Once that's installed, turning on two-factor for email is usually a two-minute job inside the account's own security settings, and I stay on the phone or in the room while they do it, because a task that gets left for later usually stays left.

The One Habit That Matters More Than Any Setting

If there's a third thing I make time for, it's not a setting at all, it's a habit: treating any message that creates pressure to act immediately as suspicious by default, regardless of who it claims to be from. I've written elsewhere about why that particular pressure is the thread running under almost every scam format, but in a ten-minute conversation I keep it simple: if something wants an answer right now, wait five minutes and check it a different way before doing anything. That one habit catches more than any piece of software does, and unlike a setting, it doesn't need updating or renewing.

What I Deliberately Leave Out of That First Conversation

I don't mention VPNs, antivirus software, router settings, or backup strategy in that first ten minutes, not because they don't matter, but because introducing five more things guarantees none of them get done either. Those are things I'll happily go into if someone's genuinely interested or comes back with a specific worry, but they're not where the risk actually concentrates for most people. A reused password and a slow reaction to a fake emergency cause far more real damage, in my experience, than a missing VPN ever does. Being selective isn't the same as being incomplete, it's recognising that ten minutes spent on the two highest-impact changes beats an hour spent on everything at once.

Where I Send Someone Once They Want to Go Further

For the people who do want more once the basics are in place, I point them toward a proper priority order to work through themselves, rather than trying to cram it into the same conversation. The NCSC also has solid general guidance if someone wants a source that isn't just my opinion. And I always mention my free Safety Toolkit at the end, mostly because it means the conversation doesn't have to end when I leave the room, they've got something to come back to if a question occurs to them later that evening.

I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.

A ten minute plan you can follow tonight

Here is the same conversation as a plan you can run through with a cup of tea. It follows the order the NCSC, the UK's National Cyber Security Centre, gives in its top tips for staying secure online, and it is the order I'd give a neighbour.

Minutes one to four: lock down your email

Your email is the master key. Anyone who gets into it can click "forgot password" on your other accounts. So give it a strong password that you don't use anywhere else, then turn on 2-step verification so a stolen password isn't enough. The NCSC lists both as top tips, and email is where it tells you to start. I explain why in why my email login gets more protection than any other.

Minutes five to eight: let a password manager do the remembering

Once your email is sorted, a password manager creates and remembers a different strong password for every other account, so you only have to remember one. It is the single change that stops one leaked password opening ten doors. If you're not sure where to start, my guide to choosing a password manager if I were starting today keeps it simple.

Minutes nine and ten: updates and a backup

Switch on automatic updates for your phone and computer, because updates carry security fixes. Then check that your photos and key documents are copied somewhere else, such as an external drive or cloud storage, so a lost phone is an annoyance and not a disaster.

Online safety basics: quick answers

Is ten minutes really enough?

It is enough to stop the most common ways people get caught out, and that is the point. You can add the rest, like a VPN or router settings, once these habits stick. Trying to do everything at once is how people end up doing nothing.

What if I only have time for one thing?

Do the email. If a scammer gets into your inbox, every other account is at risk, so that one change protects the most.

What should I do after the ten minutes?

Spend a few more minutes learning to spot a dodgy message, because no setting stops you tapping a link yourself. Why I treat two-factor authentication as non-negotiable is a good next read.

Keep reading

This guide is part of Kells Security Solutions, where I explain online safety in plain English. Next, have a look at how to build a password worth trusting or how to choose a VPN service. If something has already gone wrong, here is where to report a scam in the UK.