Home device security checklist

Use this list once to set things up, then revisit it every few months. Most of the steps cost nothing and take minutes.

Computers

• Automatic updates are on for the operating system and the browser.
• One real-time antivirus is active. On Windows this can be the built-in Microsoft Defender or a third-party product, but not two at once.
• The firewall is switched on (built into Windows and macOS).
• You use a standard user account for everyday work, and keep an administrator account for installing software.
• Software you no longer use, especially old browser plug-ins and extensions, is uninstalled.
• The disk is encrypted (BitLocker or device encryption on Windows, FileVault on macOS), which protects your data if the device is stolen.

Phones and tablets

• The operating system and apps update automatically.
• Apps come only from the official store (Google Play or the App Store).
• A screen lock (PIN, password or biometrics) is set.
• “Find my device” is switched on so you can locate or wipe a lost phone.
• App permissions, such as location, contacts and microphone, are reviewed now and then.

Accounts

• Your email account has a long, unique password and two-step verification. Email is the key to resetting everything else.
• Banking, shopping and social media accounts also use two-step verification.
• Passwords are not reused. A reputable password manager makes this practical.
• Recovery phone numbers and email addresses are up to date.
• You know how to check whether your email address has appeared in a known data breach, and you change passwords when it has.

Home Wi-Fi

• The router's default administrator password has been changed.
• Wi-Fi uses WPA2 or, where available, WPA3 encryption with a strong passphrase.
• Router firmware is updated, automatically if the router supports it.
• Visitors and smart-home devices use a guest network where possible.

Backups

• Important files are backed up automatically, following the 3-2-1 rule.
• At least one backup is kept disconnected or off-site, so ransomware cannot reach it.
• You have tested restoring a file within the last few months.

Habits

• You check links and senders before clicking. See how to spot phishing.
• You are sceptical of urgent requests for money, codes or passwords, even from people you know.
• Public Wi-Fi is used only for sites using HTTPS, or with a trusted VPN.
• Family members, especially children and older relatives, know they can ask before clicking.

This guide contains no partner links.