Steps to Take for Online Security

Why a few simple steps go a long way

Most of us bank, shop, chat with family and store our photos online. That makes our accounts and devices valuable, and criminals know it. The good news is that most attacks on everyday people aren't clever Hollywood-style hacking; they rely on reused passwords, missing updates and people being tricked into clicking.

That means a handful of sensible habits blocks the large majority of everyday threats. You don't need to be technical, and you don't need to do everything at once.

Some advice you may have heard over the years has also changed. Complicated passwords you change every few months, hiding your Wi-Fi network and always needing a VPN are no longer the recommended approach. This post covers what current guidance actually says, explains every term along the way, and finishes with a checklist you can work through over a weekend.

Passwords, passphrases and password managers

Long beats complicated

For years we were told to make passwords like Tr0ub4dor&3: short, with a mix of capitals, numbers and symbols. The trouble is that these are hard for people to remember but not especially hard for computers to guess, because people follow predictable patterns (capital at the start, number and symbol at the end).

Current advice favours length. A passphrase is a password made of several random words strung together. Australia's cyber security agency suggests aiming for at least 15 characters, with four or more random words, such as purple duck potato boat.

The words should be genuinely random, not a famous saying or song lyric, and not related to you (no pet names, footy teams or birthdays).

One password per account

The single most important rule is to use a different password for every account. Websites get hacked all the time, and when they do, the stolen usernames and passwords are tried on other sites. This is called credential stuffing. If you reused that password, the criminal now has a key to your other accounts too.

You don't need to change good passwords on a schedule, either. The US standards body NIST, whose guidance is widely followed, finalised updated rules in 2025 that move away from complexity requirements and calendar-based changes, and towards length and changing a password when there's a reason to (such as a breach).

Let a password manager do the remembering

Nobody can remember dozens of unique passphrases. A password manager is an app that creates, stores and fills in your passwords for you, kept in an encrypted (scrambled) vault. You remember just one strong passphrase to unlock it.

• Built-in options: Apple Passwords (iPhone, iPad, Mac), Google Password Manager (Chrome and Android) and Microsoft's options in Edge are free and easy to start with.
• Standalone options: apps such as Bitwarden and 1Password work across every brand of device, which helps if your household mixes Apple, Android and Windows.

A bonus: a password manager only fills in your password on the real website it was saved for. If it doesn't offer to fill in on a page that looks like your bank, that's a warning sign you may be on a fake site.

Multi-factor authentication and passkeys

Multi-factor authentication (MFA), often called two-factor authentication or 2FA, means proving who you are in two different ways when you log in: usually something you know (your password) plus something you have (your phone). Even if a criminal steals your password, they can't get in without the second factor.

Not all MFA is equally strong. Here's how the common types compare:

What is a passkey?

A passkey is a newer way to log in that replaces your password altogether. Instead of typing something, you unlock your phone or computer with your fingerprint, face or PIN, and it proves your identity to the website behind the scenes.

Passkeys can't be guessed, reused or typed into a fake site, which makes them very resistant to phishing. Many big services, including Google, Apple, Microsoft and a growing number of banks and shops, now offer them. If you see "Create a passkey" in your account settings, it's worth saying yes.

Where to turn MFA on first

1. Your main email account. It's the master key: password resets for everything else go there.
2. Banking and payment accounts, including PayPal.
3. myGov and other government accounts.
4. Social media and messaging, to stop scammers using your account to trick your friends.
5. Your Apple, Google or Microsoft account, which often holds your photos, backups and saved passwords.

Updates and security software

Turn on automatic updates

Software updates fix vulnerabilities, weaknesses that criminals can use to break into a device. Once a fix is released, attackers study it and target people who haven't installed it yet, so updating promptly really matters.

• Phones and tablets: turn on automatic updates in Settings, and update your apps automatically too.
• Computers: let Windows Update or macOS Software Update install automatically, and restart when asked.
• Browsers: Chrome, Edge, Firefox and Safari update themselves, but only fully apply after a restart, so close them now and then.
• Your router: the box that provides your Wi-Fi needs updates too (see the next section).

Watch for devices that no longer get updates

Every device eventually reaches end of life, when the maker stops sending security fixes. For example, Microsoft ended regular support for Windows 10 in October 2025. An old phone, tablet or computer that no longer receives updates becomes riskier every month, so plan to upgrade or replace it, or at least avoid using it for banking.

Security software

Antivirus software scans for malware (malicious software, designed to harm your device or steal information). The good news is that modern devices come with solid protection built in:

• Windows includes Microsoft Defender, switched on by default. For most home users it's enough, as long as it's kept updated.
• Macs, iPhones and iPads have built-in protections and only allow apps from trusted sources by default.
• Android phones include Google Play Protect, which scans apps.

Paid security suites can add extras, but they're not essential for everyone. What matters more is installing apps only from official stores and websites, and not switching off the protection you already have.

Home and public Wi-Fi

Securing your home Wi-Fi

Your router (the box from your internet provider) creates your home Wi-Fi network. A few settings make a big difference. You'll usually find them by typing an address such as 192.168.0.1 or 192.168.1.1 into your browser, or through your router's app; the details are often on a sticker on the router itself.

1. Change the admin password. This is the password for the router's settings, separate from your Wi-Fi password. Defaults are sometimes easy to find online.
2. Use strong encryption. Choose WPA3 if available, or WPA2 otherwise. Avoid anything labelled WEP or "open".
3. Set a long Wi-Fi password. A random passphrase works well. There's no need to keep changing it unless you think someone unwelcome has it.
4. Turn on automatic firmware updates. Firmware is the software inside the router. If your router is very old and no longer updated, ask your provider about a replacement.
5. Use the guest network for visitors and smart gadgets such as plugs and cameras, so they're kept separate from your computers and phones.

Public Wi-Fi: less scary than it used to be

Public Wi-Fi at cafés, airports and hotels used to be genuinely risky, because many websites didn't encrypt their traffic. Today, almost all websites and apps use HTTPS, which encrypts the connection between you and the site, so others on the same Wi-Fi can't read what you send.

Sensible precautions still apply:

• Check the network name with staff, as scammers can set up lookalike networks such as "Airport_Free_WiFi".
• Ignore warnings at your peril: if your browser shows a security or certificate warning, disconnect.
• Use your phone's hotspot instead for anything sensitive if you'd rather not take chances.
• A VPN is optional, not essential. A VPN (virtual private network) encrypts all your traffic through another server. It's useful on untrusted networks, but choose a reputable paid provider; free VPNs may make money from your data.

Backups you can actually restore

A backup is a spare copy of your files kept somewhere else. It protects you from hardware failure, loss, theft, accidents and ransomware, a type of malware that locks your files and demands payment to unlock them.

The 3-2-1 rule

A simple, widely used rule of thumb:

• 3 copies of anything important (the original plus two backups),
• on 2 different types of storage (for example, your computer and an external drive),
• with 1 copy kept away from home or offline (such as cloud storage, or a drive at a relative's house).

Finally, test your backup. Once in a while, try restoring a file or a photo. A backup you've never tried to restore is only a hope.

Scams, alerts and keeping watch

Spotting phishing

Phishing is when criminals pretend to be someone you trust, such as your bank, a delivery company or myGov, to trick you into clicking a link, logging in or paying. Common warning signs:

• Urgency: "your account will be closed today".
• Unexpected messages: a parcel you didn't order, a refund you didn't ask for.
• Requests for sensitive details: passwords, card numbers or login codes.
• Hidden links: shortened links like bit.ly/… conceal where they go. You can reveal the real destination safely with ExpandURL.

The safest habit is to go direct: if a message claims to be from an organisation you deal with, ignore its links and phone numbers and use the official app or website instead.

Set up alerts and check in

• Banking alerts: most banking apps can notify you of every transaction or anything over a set amount. Turn them on.
• Sign-in alerts: email, Apple, Google and Microsoft accounts can warn you about new logins. Don't ignore them.
• Credit reports: in Australia, you can get a free credit report from each of the credit reporting bodies (Equifax, Experian and illion) every three months. Unfamiliar applications can be an early sign of identity theft.
• Review connected apps: every so often, check which apps have access to your Google, Apple, Microsoft or social media accounts, and remove ones you no longer use.

If something goes wrong

Act quickly, and don't be embarrassed; these things happen to careful people. Contact your bank straight away if money or card details are involved. Then report it: Australia's cyber security agency runs cyber.gov.au, including ReportCyber and a 24/7 hotline on 1300 CYBER1 (1300 292 371). Scams can be reported to Scamwatch, and IDCARE offers free support if your identity details have been stolen.

A weekend security checklist

You don't need to do everything at once. Work down this list in order; the first few items give the biggest benefit.

Over the following weeks, move your other accounts into your password manager whenever you next log in to them. It's much easier than doing them all in one go.

Quick reference glossary

Wrapping up

Online security isn't about being an expert or being paranoid. It's a small set of habits that, once set up, mostly run themselves in the background and make you a much harder target than the average person.

If you remember four things, make them these:

1. Use a unique password for every account, and let a password manager remember them.
2. Turn on multi-factor authentication or passkeys, starting with your email.
3. Keep everything updated automatically, and replace devices that no longer get updates.
4. Back up your important files in at least two places, and test that you can restore them.

Pick one step from the checklist today. Future you will be glad you did.