The Shortlist I Actually Give People Who Ask How to Stay Safe Online

People ask me for a shortlist all the time. Something they can actually stick to, not a fifty-point checklist that gets skimmed once and then forgotten. So here's the handful of things I genuinely tell friends, family, and clients to do, roughly in the order I'd tackle them if I were starting from nothing today.

None of this is complicated or expensive, and it's not exhaustive either, there are entire books written on this subject. But get these six things properly in place and you'll be ahead of most people online, and ahead of what the overwhelming majority of scams and attacks are actually built to catch. I'd genuinely rather someone did these six things well than half-heartedly attempt every tip on a much longer list and abandon it by February.

Get a Password Manager Before You Do Anything Else

Everything else on this list assumes you're not reusing the same password across a dozen accounts, and a password manager is what actually fixes that in an afternoon rather than a New Year's resolution that never happens. I use NordPass myself, mainly because it won't autofill your login on a lookalike site even if a phishing email gets past your filter, which has caught me out at least once. Once it's set up, every account gets its own long, random password and you never have to remember or type one again. This single change closes off the single biggest way accounts actually get compromised: one leaked password reused somewhere else.

Turn On Two-Factor Authentication Everywhere It's Offered

A password manager fixes weak and reused passwords. Two-factor authentication is the backstop for the day a password leaks anyway, through a data breach you had nothing to do with, or a moment your judgement slips on a convincing fake. It takes minutes to set up on each account and it stops almost every automated account takeover attempt cold, even when the attacker already has your correct password in hand. If an app offers an authenticator-based option rather than a text message code, take it, it's meaningfully harder to intercept.

Slow Down Before You Click Anything That Feels Urgent

Urgency is the one ingredient every convincing scam has in common, a locked account, a missed delivery, a payment that needs confirming within the hour. It's designed to make you react before you think, and it works on careful, switched-on people just as often as anyone else. I've gone through the specific phishing myths I still hear all the time in more detail elsewhere, but the short version is this: whatever the message claims is urgent, it can wait the thirty seconds it takes you to check it properly, through a channel you already trust rather than the one it handed you.

Keep Everything Updated, Even When It's Annoying

Software updates exist largely to patch security holes that have already been found and are already being exploited somewhere. Delaying an update because the prompt is inconvenient right now leaves that door open for exactly as long as you put it off. I set most of my own devices to update automatically overnight so I never have to think about it, and I'd genuinely recommend doing the same rather than relying on remembering to do it manually.

Back Up Anything You'd Be Gutted to Lose

This one isn't really about scams at all, it's about ransomware, a dead phone, a stolen laptop, or just an update that goes badly wrong. A proper backup, ideally an automatic one that runs somewhere other than the device itself, turns any of those from a genuine disaster into an afternoon's inconvenience. Photos, documents, anything you'd actually notice losing, cloud storage or an external drive both work, the important part is that it happens automatically rather than depending on you remembering to do it manually every few months.

Know Where to Report It When Something Slips Through

Even doing everything right, something will eventually get through, an unusually good fake, a moment of distraction, bad luck. What matters then is knowing what to do next rather than just feeling embarrassed and moving on. In the UK that's Action Fraud, and reporting genuinely helps, it feeds into the intelligence that gets the next version of that same scam caught before it reaches someone else. It costs a couple of minutes and it means the mistake wasn't wasted.

Why This Shortlist Works

None of this requires becoming paranoid or treating every message as a threat. It's six habits, most of which you set up once and then barely think about again, that together cover the vast majority of how people actually get caught out, from the accounts a scammer might target to the device itself failing on an ordinary Tuesday. If you want the fuller version of everything I recommend, my Safety Toolkit has the tools and settings I use myself, free to browse any time. And if you're ever unsure about something that's landed in your inbox, get in touch with me directly, I'm always happy to take a look.