VPN Lab Plain-English online safety

A practical guide · Updated for 2026

Your 2026 Online Safety Checklist

See what's already handled — and what still deserves attention.

How this checklist works

Eight simple checks show what you already have covered — and what is still worth fixing.

Most people don't need dozens of security tools — they need a handful of common gaps covered. The eight steps below walk through them — and reading without tapping is fine too.

Mark completed steps as you go
Your online setup

0 of 8 layers covered

You have a good place to start. Mark a step, and the first window lights up.

Step 1 of 8 · Devices

Keep your devices updated

Updates have a reputation for being annoying, but many include fixes for security weaknesses that have already been discovered. An out-of-date device keeps those known gaps open.

Why it matters: many common attacks rely on old, well-known weaknesses that updates have already fixed.

One practical action Turn on automatic updates for your operating system and your web browser. Once it's on, this step largely takes care of itself.

Good. This closes many known security gaps before they can become a problem.

Show me how

Not every update is about security — some add features or fix bugs — but security fixes ride along often enough that staying current is the simplest protection there is.

  1. Windows: Start → Settings → Windows Update → make sure updates install automatically.
  2. Mac: Apple menu → System Settings → General → Software Update → turn on Automatic Updates.
  3. Phone: in Settings, search for “Software update” and enable automatic installation.
  4. Browser: Chrome, Edge, Firefox and Safari update themselves — just restart the browser now and then.

Step 2 of 8 · Accounts

Protect your main email account

Your main email address can reset the password for many of your other accounts — your bank, your shopping accounts, your subscriptions. That makes it the account most worth protecting first.

Why it matters: access to your email can give someone a route into many of your other accounts through password resets.

Three practical actions
  • Give your email a password you don't use anywhere else.
  • Turn on two-factor authentication (a code on your phone at sign-in).
  • Check that your recovery phone number and backup email are current.

Well done. Your most important account now has real protection around it.

Show me how
  1. Sign in to your email provider and open its security settings (Gmail: Manage your Google Account → Security; Outlook: Account → Security).
  2. Look for “2-Step Verification” or “Two-factor authentication” and follow the setup — it usually takes about two minutes.
  3. While you're there, review “Recovery phone” and “Recovery email” and update anything out of date.

Step 3 of 8 · Accounts

Use unique passwords for important accounts

When a website is breached, passwords from it often end up in lists that criminals try on other sites. If you reuse a password, one leak can open several doors.

Why it matters: password reuse is how a breach at a site you barely remember can reach your bank or your email.

One practical action Start with just four accounts: email, banking, your main shopping account, and your phone/Apple/Google account. Give each a password that isn't used anywhere else.

Good. One leaked password can no longer travel to your other important accounts.

Show me how

You don't have to fix every account today — the four above cover the most damaging scenarios.

  1. A long passphrase of several unrelated words — something like copper-lantern-radio-42, though you should invent your own — is both strong and possible to remember.
  2. Your browser's built-in password manager can create and remember unique passwords for you — it's already on your computer and free.
  3. Writing passwords in a notebook kept at home is not ideal, but it is far safer than reusing one password everywhere.

Step 4 of 8 · Files

Back up files that cannot be replaced

Some files — family photos, key documents, financial records — exist only on your device, and a failed drive or lost phone can erase them permanently. Syncing alone may not be enough: a backup is a separate copy.

Why it matters: lost irreplaceable files are the one kind of damage nothing can undo afterwards.

One practical action Pick the one folder you'd most hate to lose and copy it somewhere separate today — an external drive, or a cloud service with version history.

Excellent. The files that matter most now exist in more than one place.

Show me how

Three related ideas, from weakest to strongest: sync mirrors your files — including deletions and damage. Version history (offered by some cloud services) lets you restore an earlier copy of a file, which softens that problem. A separate backup is the strongest: a copy that stays safe even if the original — and its sync — go wrong. Worth protecting: photos, work documents, financial records, scans of important papers, recovery codes.

  1. Simplest: buy an external USB drive, plug it in, and copy your photos and documents folders onto it. Repeat every month or two.
  2. More automatic: use a cloud backup service with version history, so even a deleted or damaged file can be restored. If you'd rather have backups happen by themselves, see a cloud-backup option →.
  3. For the truly irreplaceable (recovery codes, key documents): keep two copies in two different places.

Step 5 of 8 · Devices

Protect your devices from unsafe files and websites

Phones and computers already include basic protections, but much of what we do now happens through browsers, apps, downloads and links. An additional security layer can help flag suspicious websites, unsafe downloads and other threats before a mistake turns into a bigger problem. Think of it as a second pair of eyes — not a replacement for careful judgment.

Why it matters: one bad click, download or unsafe page can be enough — an extra protection layer can help catch problems earlier.

One practical action Start with the protection already built into your devices. Keep the operating system and browser updated, make sure built-in security features haven't been disabled, and remove any expired security software that may be interfering with them.

Done. Your devices now have a second pair of eyes for the moments attention slips.

Show me how

Start with the protections your devices already include.

  1. On Windows: open Windows Security and check that Microsoft Defender is active if you aren't using another security app.
  2. If a third-party antivirus expired long ago, remove it — while it stays installed, the built-in protection stays switched off, and the expired product may no longer be updating its own defenses.
  3. Mac: macOS ships with its own built-in protections; the main additions a paid tool offers are web filtering, download scanning and support.
  4. On phones and tablets: keep the operating system and browser updated, install apps from trusted sources, and make sure built-in security warnings are enabled where available.

If you want an additional layer across the devices you use, a dedicated security app can make protection easier to manage in one place and add features such as web protection and threat scanning where the device supports them — see a dedicated protection option →.

Step 6 of 8 · Browsing

Reduce intrusive ads and tracking

If a product you looked at once seems to follow you across the web, that's tracking. Some ads also imitate things they aren't — fake “Download” buttons, fake virus warnings — and an ad blocker removes many of these before you ever see them.

Why it matters: a quieter web removes a whole category of look-alike buttons and fake warnings that exist to be clicked by mistake.

One practical action Install a reputable ad blocker in your main browser. The difference is visible on the very next news site you open.

Nice — browsing just got quieter, and a common category of fake buttons disappeared with the noise.

Show me how

No blocker removes everything — some ads and trackers get through — but the everyday difference is large.

  1. Open your browser's extension store (Chrome Web Store, Firefox Add-ons, or Safari Extensions in the App Store).
  2. Install a well-reviewed ad blocker from a known developer — check the number of users and reviews before installing.
  3. Visit a news site to confirm it's working. Most blockers need no configuration at all.

If you'd rather use a dedicated ad-blocking tool than manage a browser extension yourself, see an ad-blocking option →.

Step 7 of 8 · Connections & privacy

Add a privacy layer to your internet connection

Public Wi-Fi is safer than it once was, and most websites already encrypt their traffic. What the network you're on can still typically see is which sites and services you connect to. A VPN adds an encrypted layer between your device and the VPN provider, reducing what the networks you use can learn about where you connect. It's one additional privacy layer that can travel with you across the different networks you use.

Why it matters: a VPN gives you one consistent privacy layer across the different networks you use, instead of relying on each network to provide it.

One practical action Set up a VPN once on the devices you use most. After that, your extra privacy layer is there whenever you want it — usually one tap away.

That's covered. The networks you use can now see less about where your device connects.

Show me how

A VPN gives your internet connection an extra privacy layer. Instead of each network you use seeing which sites and services your device connects to, the local network mainly sees a connection to the VPN provider. That makes it especially useful on Wi-Fi and other networks you don't control.

Think of it as connection privacy, not complete anonymity. Websites you sign in to can still know who you are, and a VPN doesn't replace HTTPS, antivirus or protection from phishing. It simply handles a different job: reducing what the network between you and the internet can see.

  1. Choose a reputable VPN provider and install its app on the devices you use every day.
  2. Sign in once. After that, protecting a connection is a single on/off switch.
  3. Make it a habit on networks you don't control: joining the Wi-Fi and tapping the VPN on become one motion.

If you don't already have a provider, see a VPN option for everyday use →.

Step 8 of 8 · Personal information

Review exposed personal information and old accounts

Over the years, most of us scatter pieces of ourselves online — old accounts, public profiles, personal details on people-search sites. None of it is an emergency, but the more a stranger can learn about you, the more convincing a scam call or phishing email sounds.

Why it matters: information you've forgotten about is still out there working — just not for you.

One practical action Search your own name in a private browser window and see what a stranger sees. Then close one old account you no longer use, and set one social profile to friends-only.

Good. There's now less of you lying around for strangers to work with.

Show me how

Also worth a look: app permissions on your phone (location, contacts, microphone) — many apps keep access they never needed.

  1. Search “[your name] + [your town]” in a private window. Note which sites show your details.
  2. Many data-broker sites offer a free opt-out page, often linked in their footer, and some US states give residents additional removal rights. California residents can now send one deletion request to every registered data broker through the state's free DROP tool at privacy.ca.gov.
  3. On your phone: Settings → Privacy → review which apps have your location, contacts and microphone, and revoke what isn't needed.
  4. For old accounts: search your email inbox for “welcome to” to rediscover accounts you've forgotten, and close the ones you no longer use.

Your result

0 of 8 protection layers covered

Mark the steps above as you go, and this section will keep track of what's left.

Things you can do yourself

    Things a tool can simplify

      A note from the editors

      We built this checklist because most online-safety advice does one of two things: it either tries to scare you, or it tries to sell you something on the first line. Neither helps anyone actually get safer.

      You don't need to become a security expert. You need a small number of gaps closed — most of them free, most of them done once. If this page helped you close even one, it did its job.

      A few useful things to know

      What matters most if I don't want to do all eight today?
      Start with your main email account, unique passwords and automatic updates. Then work through the rest when you have time. The point of this checklist isn't to give you eight new chores — it's to help you see what's already handled and choose the next useful step.
      Do I need to buy anything to complete this checklist?
      Not necessarily. Several of the most important steps — updates, stronger account security, unique passwords and reviewing exposed information — can be handled with settings and tools you already have. Where a dedicated tool can make a job simpler, we've shown it as an option rather than a requirement.
      What does “covered” actually mean?
      It means you've taken the practical action described for that area — not that the risk can never happen. Online safety isn't about making yourself impossible to scam, hack or track. It's about closing the common gaps that are worth closing.
      Why are there different kinds of protection?
      Because they do different jobs. Updates close known software gaps. Unique passwords help contain account breaches. Backups protect files you can't replace. Device protection helps catch unsafe files and websites. Ad blocking reduces intrusive ads and misleading buttons, while a VPN adds privacy to your internet connection. That's why the checklist uses layers rather than treating “online safety” as one switch.
      What if my devices already have security built in?
      That's a good start, and the checklist deliberately begins with protections you may already have. Keep them updated and switched on. A dedicated security tool is an additional layer for people who want features such as web protection, threat scanning or simpler protection across supported devices.
      Where does a VPN fit into the checklist?
      A VPN handles one specific job: connection privacy. It adds an encrypted layer between your device and the VPN provider, reducing what the networks you use can learn about where you connect. It doesn't replace passwords, device protection or careful browsing — those are separate layers in the checklist.
      How does VPN Lab choose which products to show?
      VPN Lab has spent years testing tools for personal online security and privacy. We use that hands-on experience to recommend products we believe fit the specific job described in the checklist — not as a replacement for the free steps, but where a tool can make one of those jobs simpler. Some of the links are affiliate links, which means we may earn a commission at no extra cost to you. You can use the entire checklist without buying anything.