Understanding threats

Six online safety habits that matter more than any antivirus

By Losa · Last reviewed September 24, 2026 · 3 min read

Security software is one layer. But most of the problems people actually run into, such as hacked email accounts, scam payments and lost photos, are prevented by a handful of habits. None of them cost anything, and together they do more than any product you can buy.

1. Let updates install

Updates to your operating system, browser and apps regularly fix security weaknesses that attackers already know how to exploit. Turning on automatic updates is the single most effective step most people can take.

• Windows: Settings → Windows Update
• Mac: System Settings → General → Software Update
• iPhone: Settings → General → Software Update
• Android: usually Settings → System → Software update (the name varies by manufacturer)

If your phone or computer no longer receives security updates at all, that's a bigger risk than which antivirus you use, and it's worth planning a replacement.

2. Use a different password for every important account

When a website is breached, attackers automatically try the stolen email and password combinations on other popular sites. If you reuse passwords, one breach becomes many. Unique passwords stop that chain.

Nobody can remember dozens of unique passwords, and you don't need to. A password manager does it for you. Those built into modern browsers, and into iPhones and Android phones, are free and good enough for most people.

3. Turn on two-step verification

Two-step verification (also called two-factor authentication or 2FA) asks for a second proof when you sign in, usually a code from an app or a prompt on your phone. Even if someone has your password, they usually can't get in without it.

Start with your email account, because email can be used to reset the password for almost everything else. Then add it to your bank, your Apple or Google account, and social media.

4. Learn the signs of phishing

Phishing messages pretend to be from a company you trust and try to rush you into clicking or sharing details. Warning signs include:

• Urgency: "your account will be closed today"
• A problem you didn't know about, such as a failed delivery or unpaid invoice
• A link or attachment you're asked to open to fix it
• A sender address or web address that's slightly off

The habit that beats almost all of it: never fix a problem through the link in the message. Go to the company's website or app yourself. If the problem is real, you'll see it there. Already clicked? See what to do if you clicked a suspicious link.

5. Download software only from official sources

Use your device's official app store or the developer's own website, reached by typing the address yourself. Pirated software, "free" versions of paid programs, and downloads from unfamiliar sites are among the most common ways malware and adware get onto computers. Be particularly wary of anything that pops up offering to "speed up" or "clean" your device.

6. Keep a backup of what matters

A recent backup means a broken laptop, a stolen phone, an accidental deletion or a ransomware attack doesn't have to mean losing your photos and documents. Use an external drive, a cloud service, or both. The built-in options (iCloud, Google One, OneDrive or Time Machine on a Mac) are the simplest place to start.