How Do I Stay Safe Online? A Simple Shortlist

People ask me for a shortlist all the time. Something they can actually stick to, not a fifty-point checklist that gets skimmed once and then forgotten. So here's the handful of things I genuinely tell friends, family, and clients to do, roughly in the order I'd tackle them if I were starting from nothing today.

None of this is complicated or expensive, and it's not exhaustive either, there are entire books written on this subject. But get these six things properly in place and you'll be ahead of most people online, and ahead of what the overwhelming majority of scams and attacks are actually built to catch. I'd genuinely rather someone did these six things well than half-heartedly attempt every tip on a much longer list and abandon it by February.

Get a Password Manager Before You Do Anything Else

Everything else on this list assumes you're not reusing the same password across a dozen accounts, and a password manager is what actually fixes that in an afternoon rather than a New Year's resolution that never happens. I use NordPass myself, mainly because it won't autofill your login on a lookalike site even if a phishing email gets past your filter, which has caught me out at least once. Once it's set up, every account gets its own long, random password and you never have to remember or type one again. This single change closes off the single biggest way accounts actually get compromised: one leaked password reused somewhere else.

Turn On Two-Factor Authentication Everywhere It's Offered

A password manager fixes weak and reused passwords. Two-factor authentication is the backstop for the day a password leaks anyway, through a data breach you had nothing to do with, or a moment your judgement slips on a convincing fake. It takes minutes to set up on each account and it stops almost every automated account takeover attempt cold, even when the attacker already has your correct password in hand. If an app offers an authenticator-based option rather than a text message code, take it, it's meaningfully harder to intercept.

Slow Down Before You Click Anything That Feels Urgent

Urgency is the one ingredient every convincing scam has in common, a locked account, a missed delivery, a payment that needs confirming within the hour. It's designed to make you react before you think, and it works on careful, switched-on people just as often as anyone else. I've gone through the specific phishing myths I still hear all the time in more detail elsewhere, but the short version is this: whatever the message claims is urgent, it can wait the thirty seconds it takes you to check it properly, through a channel you already trust rather than the one it handed you.

Keep Everything Updated, Even When It's Annoying

Software updates exist largely to patch security holes that have already been found and are already being exploited somewhere. Delaying an update because the prompt is inconvenient right now leaves that door open for exactly as long as you put it off. I set most of my own devices to update automatically overnight so I never have to think about it, and I'd genuinely recommend doing the same rather than relying on remembering to do it manually.

Back Up Anything You'd Be Gutted to Lose

This one isn't really about scams at all, it's about ransomware, a dead phone, a stolen laptop, or just an update that goes badly wrong. A proper backup, ideally an automatic one that runs somewhere other than the device itself, turns any of those from a genuine disaster into an afternoon's inconvenience. Photos, documents, anything you'd actually notice losing, cloud storage or an external drive both work, the important part is that it happens automatically rather than depending on you remembering to do it manually every few months.

Know Where to Report It When Something Slips Through

Even doing everything right, something will eventually get through, an unusually good fake, a moment of distraction, bad luck. What matters then is knowing what to do next rather than just feeling embarrassed and moving on. In the UK that's Report Fraud, and reporting genuinely helps, it feeds into the intelligence that gets the next version of that same scam caught before it reaches someone else. It costs a couple of minutes and it means the mistake wasn't wasted.

Why This Shortlist Works

None of this requires becoming paranoid or treating every message as a threat. It's six habits, most of which you set up once and then barely think about again, that together cover the vast majority of how people actually get caught out, from the accounts a scammer might target to the device itself failing on an ordinary Tuesday. If you want the fuller version of everything I recommend, my Safety Toolkit has the tools and settings I use myself, free to browse any time. And if you're ever unsure about something that's landed in your inbox, get in touch with me directly, I'm always happy to take a look.

I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.

Where I'd start if you only have an evening

Please don't try to do all six in one go. You'll burn out and the list ends up in a drawer. Here's the order I'd actually work through it, with the bits that matter most for anyone who wants to stay safe online.

Start with your email password

Your email account is the key to resetting almost everything else, so it goes first. Make it strong and make it different from every other password you use. The NCSC suggests joining three random words together for a password you have to remember. I've written about why this one account deserves extra care in why my email login gets more protection than any other.

Then switch on two-step verification

Once email is sorted, add a second step to your most important accounts. That way a stolen password on its own isn't enough to get in. If you're not sure where to begin, this is why I treat two-factor authentication as non-negotiable.

Then pick a password manager

Nobody can remember dozens of strong, different passwords. A password manager does it for you. The NCSC says the manager built into your browser or phone is fine on your own devices, as long as you protect the device and the account it sits in. Don't save passwords on a shared or public computer. If you want a dedicated one, read how I'd choose a password manager if I were starting today.

What to do if something slips through

It happens to careful people too. Don't panic and don't beat yourself up. Do the next sensible thing.

If you clicked or shared something

If you gave out banking details, ring your bank straight away, using the number on your card. If you clicked a link or installed something, run an antivirus scan on the device. If you reused that password anywhere else, change it on those accounts too, or move to a passkey where it's offered. If it happened on a work device, tell your IT team.

If it was a text or an email

Don't click anything in it. Forward a dodgy text to 7726, which is free with most phone providers. Forward a dodgy email to [email protected]. If you've lost money or been targeted, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland you can also call Police Scotland on 101. My own routine is in the first things I do the moment I suspect a scam, and where to report a scam lists who to tell.

Quick questions people ask me

Is a password manager safe to use?

For most people, yes. It's far safer than reusing the same few passwords. Protect it with a strong master password you can remember and turn on two-step verification for it.

Do I need to do all six at once?

No. Do one this week, one next week. Slow and finished beats fast and abandoned.

Keep reading

This guide is part of Kells Security Solutions, where I explain online safety in plain English. Next, have a look at how to build a password worth trusting or the difference between phishing and other scams. If something has already gone wrong, here is where to report a scam in the UK.