Online Security Guide
A Step-by-Step Guide to Protecting and Securing All Your Social Media Profiles, Personal Accounts, and Online Identity
Choose your security topic
Start with your main email and recovery options. Use passkeys where supported, or two-step verification for password-based sign-in. Menu names and features differ; the official instructions are the final reference.
Device locks and biometrics
A device lock uses a PIN, passcode, fingerprint or face check to restrict access. It helps protect your information when someone else picks up your device.
- Open your device settings and choose its screen-lock or sign-in options.
- Set a strong PIN or passcode, then enrol fingerprint or face recognition if supported.
- Set automatic locking and practise unlocking before relying on it.
- Keep the fallback passcode private. A device lock does not automatically enable two-step verification on online accounts.
Set up passkeys
Passkeys let you sign in to supported accounts using your device unlock or a security key. They resist fake sign-in pages without requiring you to type a password.
- Use a device you own, with an up-to-date browser and screen lock.
- Open the genuine account security settings and find Passkeys, if offered.
- Create a passkey and approve the device prompt. Do not create one on a shared computer.
- Check your recovery route and test sign-in before removing older access methods. Sync and device-bound behaviour varies by provider.
Turn on two-step verification
Two-step verification adds another check to password-based sign-in. It makes a stolen password less useful, but you must still protect codes and recovery methods.
- Open the account through its official app or independently typed website.
- Find security or sign-in settings and enable two-step verification where passkeys are not available or for remaining password-based routes.
- Follow the provider instructions to enrol your chosen supported method. Never share the setup QR code or verification codes.
- Store recovery codes securely, separately from the device they recover. Test access before signing out everywhere.
Passwords and your password manager
A password manager keeps your logins in a protected vault and helps create unique passwords. Securing the vault reduces the risk of one reused password exposing several accounts.
- Choose a reputable password manager and install it through its genuine website or official store.
- Use a long, unique master password where the manager requires one.
- Protect the vault with supported two-step verification and save its recovery instructions securely.
- Generate a different password for each account. For Bitwarden, its two-step recovery code removes the second-step requirement; it does not replace a forgotten master password.
Android phone security
Android security combines updates, a screen lock, permissions and account protection. These checks help limit unwanted access and prepare you for losing or replacing your phone.
- Open Settings and check system and security updates. Install supported updates.
- Review screen lock, app permissions and applications you no longer need.
- Check Google account security, backups and the current device-finding feature through the official settings.
- Confirm what your backup includes and how to recover your account before changing phones. Features and menu names vary by manufacturer.
iPhone and iPad security
iPhone and iPad protections help secure the device, Apple Account and personal information. Reviewing locks, sharing and recovery settings helps you stay in control.
- Open Settings and install supported software updates.
- Review your passcode, Face ID or Touch ID and privacy permissions.
- Check Apple Account security, Find My and backups; consider supported theft-protection features.
- Check trusted numbers and recovery arrangements. Use Apple instructions for your software version before changing protective settings.
Protect your email
Your inbox often receives password-reset messages for other accounts. Protecting sign-in, recovery settings and mail rules helps prevent an intruder spreading access.
- Open the genuine provider security page. Use a unique password or supported passkey.
- Enable supported additional sign-in protection and check recovery details.
- Review recent activity, devices and connected applications. Remove access you do not recognise.
- Check forwarding rules and filters, especially after suspected compromise. A password change alone may not remove every access route.
Banking and payment safety
Banking safety combines secure devices, payment checks and independent verification. It helps you spot scams before approving a payment or disclosing information.
- Install the bank app from its verified official source and secure your phone.
- Check transaction alerts and use the bank-supported sign-in controls.
- Read the payment amount and payee before authorising. Never move money to a safe account on a caller instruction.
- If you suspect fraud, contact your bank immediately through its official app or the number on your card. Do not use a number from the suspicious message.
Cookies and browser cleanup
Cookies remember sessions and preferences, while cache and history serve different purposes. Understanding these categories helps you clean up without deleting information you still need.
- Open the browser privacy settings and review the available browsing-data categories.
- Choose only the categories you intend to remove. Cookies, cache, history and saved passwords do different jobs.
- Before clearing cookies, confirm you can sign back in with your password manager and second factor.
- Review extensions and remove those you do not need. Private browsing does not make you anonymous or erase records held by websites.
Mac security and care
Mac care combines supported updates, controlled access, encryption and recoverable backups. Each protects a different part of your device or data.
- Open System Settings and check for supported software updates.
- Review login protection, app permissions and applications you no longer need.
- Read Apple instructions before enabling or changing FileVault; retain the appropriate recovery route privately.
- Make a separate backup and test restoring a file. Encryption protects confidentiality but cannot replace a recoverable backup.
Check links and website addresses
Checking the genuine destination helps you recognise misleading addresses. HTTPS alone cannot tell you whether a website owner is honest.
- Do not open an unexpected link just to investigate it.
- Use the official app or a known address instead. A brand name in the beginning or path of an address does not identify its owner.
- Check the actual domain and spelling. HTTPS encrypts a connection but does not prove the owner is trustworthy.
- Treat short links, QR codes and link-checker results as incomplete evidence. Never enter credentials on a page reached from a suspicious message.
Phishing and scams
Phishing uses impersonation to trick you into sharing information or approving actions. Pausing and checking independently helps you avoid reacting to a convincing fake.
- Stop before replying, clicking, paying or sharing codes. Urgency and impersonation are common tactics.
- Check the request independently using a known number or official app. Caller ID and good spelling are not proof.
- Report suspicious messages through the provider and current NCSC reporting guidance.
- If you entered a password, used a code or approved a payment, follow the affected provider recovery process and contact your bank if money is involved.
If an account is hacked
Account recovery restores access through the genuine provider. Reviewing sessions, settings and exposed credentials helps close routes an intruder may have left behind.
- Use a trusted device and open the genuine provider account-recovery route.
- Secure the linked email and affected account. Replace exposed or reused passwords and review additional sign-in protection.
- Review sessions, recovery details, connected apps and forwarding rules. Remove changes you do not recognise following provider instructions.
- Warn contacts through a separate trusted route if the account sent scams. Preserve evidence and contact your bank immediately if money is at risk. Do not pay someone to hack it back.
Backups and recovery
A backup keeps a recoverable copy separate from your working files. Checking restoration helps you prepare for device failure, deletion or other data loss.
- List the documents, photographs and records you cannot afford to lose.
- Choose a separate backup destination and check what it includes. Another folder on the same device is not a separate backup.
- Check backup completion and restore a sample file. Cloud sync may also synchronise deletions, so check version history and retention.
- Keep a suitably protected separate or offline copy. If storage is clicking or failing, stop routine testing and seek advice before attempting recovery.
Recovery details and safety codes
Recovery contacts and emergency codes help when your normal sign-in method fails. Keeping a usable, protected fallback reduces the risk of permanent lockout.
- Review each important account recovery email, phone and backup methods through its genuine settings.
- Choose a fallback you can still access if the main phone or account is lost.
- Store emergency codes privately and securely. They are credentials; do not send them in chat or email.
- Before replacing a device or number, test your recovery route and follow the provider migration instructions. Codes and recovery policies vary.
Official guidance and review
Reviewed 12 October 2026. Settings vary by device and provider. Use the linked official instructions for your version.
NCSC: online securityNCSC: scamsGoogle: passkeysApple: personal safetyBitwarden: recovery codes
Secure your social media and messaging
Account security protects who can sign in; privacy settings control who can see or contact you. Reviewing both helps reduce impersonation, unwanted access and oversharing.
- Open each genuine app: Instagram, Facebook, WhatsApp, X, TikTok, LinkedIn, Snapchat or your Google/YouTube account. Find account security settings; the menu varies by service.
- Use supported passkeys or a unique password with two-step verification. Protect the linked email and recovery phone first.
- Review signed-in or linked devices and remove sessions you do not recognise. Review connected apps and login alerts where available.
- Review audience, tagging, direct-message and location settings. Save recovery options privately. Verify a friend requesting money using a known contact route.
Official guidance ↗Back to topics ↑