Last updated: July 30, 2026
There are countless guides and recommendations available on cybersecurity and privacy. This checklist summarizes the most important best practices to help you protect yourself and stay safe online.
Device Security and Updates
- Keep your operating system and applications up to date by enabling automatic updates.
- Regularly update your router, IoT devices, and web browsers.
- Change your router’s default password and disable remote administration.
- Use a strong screen lock (PIN, password, or biometric authentication).
- Configure your device to lock automatically after a short period of inactivity.
- Install reputable security software, especially on Windows and Android devices.
- Remove unnecessary applications and review their permissions regularly.
Passwords and Authentication
- Use a unique password for every service.
- Create long, strong passwords or passphrases.
- Use a password manager.
- Enable two-factor or multi-factor authentication (2FA/MFA) on all important accounts.
- Whenever possible, use an authenticator app, a passkey, or a physical security key instead of SMS-based verification.
- Enable passkeys wherever they are supported.
- Regularly check whether your email addresses or passwords have been exposed in a data breach.
Links, Scams, and Phishing
- Never click links directly from emails or messages. Instead, type the website address manually into your browser and bookmark the legitimate site.
- Verify suspicious links before opening them.
- Be cautious of messages that create a sense of urgency, make threats, or claim that your account will be closed.
- Never provide passwords or banking credentials in response to an email or phone call.
- If you receive a login alert, first confirm whether it was you who signed in. If necessary, log in to the service directly to review recent sign-in activity—never through a link in the message.
- Carefully check the sender’s email address for misspellings or suspicious domain names.
- Be cautious when opening email attachments.
Networks and Online Banking
- Use a VPN when connected to public Wi-Fi.
- Prefer your mobile data connection over public Wi-Fi for banking and work-related activities.
- Access online banking only through the official banking app or a trusted web browser.
- Avoid using your online banking credentials to authenticate to third-party services whenever possible. If you do, always verify that the login page is genuine before entering your credentials.
- Consider using a mobile certificate or a digital identity wallet that uses your national ID card (such as Hightrust.id) for strong authentication with non-banking services.
- Always verify the website address before signing in.
- Always verify that websites use HTTPS before entering sensitive information.
Backups and Physical Security
- Back up your important data regularly.
- Enable your device’s location tracking, remote lock, and remote wipe features before they are needed.
- Encrypt your device’s storage whenever possible.
- If your device is lost or stolen, lock it and erase its data remotely without delay.
- Never leave your devices unattended in public places.
Privacy and Permissions
- Review app permissions regularly.
- Grant applications only the permissions they genuinely need (camera, microphone, location, and similar permissions).
- Delete old accounts and online services you no longer use.
- Limit the amount of personal information you share on social media.
- Use separate email addresses for important accounts and less important online services.
Incident Response
- Change your passwords immediately if you suspect one of your accounts has been compromised.
- Contact your bank immediately if you notice suspicious activity.
- Regularly review active login sessions for your most important accounts.
- Store recovery codes for critical accounts in a secure location.
- Learn to recognize common scams, including phishing, QR code scams, and fake technical support scams.
- If someone unexpectedly asks you to install software on your device, do not install it.
- Never share your passwords or authentication credentials, and never enter them on a website unless you are certain it is legitimate.