Recommendations
The recommendations section provides practical tips for improving your online security.
Click on a selected topic to view detailed guidance.
What does a strong password look like?
abc123 weak — cracked in <1 second
John2001! medium — cracked in minutes
Coffee&Bike#Sun9 strong — decades
wX7$mPq!2Lz#eNr& very strong — practically impossible
Rules for creating a secure password
At least 12 characters — the longer the better. 16+ is the current standard.
Mix uppercase, lowercase, numbers and special characters — not just at the end. Example: C0ffee&Bike#9.
Avoid names, dates of birth and dictionary words — these are the first things attackers try. Also avoid “password”, “qwerty”, “123456”.
Use a different password for every service — if one site is breached, your other accounts stay safe.
Passphrase method — take a sentence you remember and use the first letters: “My cat has 4 paws and sleeps!” → McH4p&S! Easy to remember, hard to crack.
Password managers — what are they and why use one?
A password manager is an app that remembers all your passwords for you. You only need to remember one — the master password. Everything else is encrypted and secure.
Bitwarden
Best free manager. Open-source, works on all devices. Recommended for beginners.
KeePass
Stores passwords locally on your device. Full control over your data.
iCloud Keychain
Built into Apple devices. Sufficient for iPhone and Mac users.
Google Password Manager
Built into Chrome and Android. A good start for Google users.
Two-factor authentication (2FA)
2FA = password + a second element. Even if someone learns your password, they cannot log in without the second factor.
How to enable 2FA — Step by step
1
Go to the security settings of your account
Look for “Two-step verification”, “2FA” or “MFA”
2
Choose an authenticator app
Google Authenticator, Microsoft Authenticator or Authy — all free
3
Scan the QR code with the app
The site will show a QR code — scan it using the app’s camera function
4
Enter the 6-digit verification code
The app generates a new code every 30 seconds — enter it to confirm
5
Save your backup codes!
The site will generate one-time codes in case you lose your phone — print them or store them somewhere safe
SMS as 2FA is a weaker option — attackers can hijack your number via SIM swapping. Use an authenticator app whenever possible.
Check if your data has been leaked
Visit haveibeenpwned.com and enter your email address. You will find out if your data was part of a breach. If yes — change your passwords for those services immediately.
What is phishing?
Phishing is an attack method where criminals impersonate a trusted person or organisation (a bank, courier, police, or even a friend) to steal data or money. It is the most common type of cyber attack.
What does phishing look like? — Examples
🚩 Example phishing SMS
“Your parcel has been held due to an unpaid fee of £0.99. Pay here: bit.ly/xxx-parcel”
Fake domains — the address looks similar to a real one: amazon-secure-login.com instead of amazon.com
Urgency and pressure — “Your account will be blocked in 24 hours!”, “Act now!”
Requests for login credentials, ID numbers, card details or verification codes
Spelling mistakes, unusual fonts or logos that look unprofessional
Shortened links (bit.ly, tinyurl) or addresses with random characters
Unexpected attachments in emails — even if the sender looks familiar
How to protect yourself
Check the URL before clicking — hover over the link (without clicking) and check the address shown at the bottom of your screen.
Look for HTTPS — but remember: HTTPS only means the connection is encrypted, not that the site is safe. Scammers use HTTPS too.
Call and verify — if a bank or company asks for your details, hang up and call back on the official number from their website.
Stop and think — phishing plays on emotions (fear, urgency, curiosity). If something feels suspicious — pause before you click.
Do not open attachments from unknown sources — especially .exe, .zip, or .doc files with macros.
Warn others — if you receive a suspicious message, let your family and friends know. Phishing is often sent in mass campaigns.
What to do if you clicked a suspicious link
1
Do not enter any data
Close the page immediately
2
Change your passwords
For any accounts you may have accessed on that device
3
Scan your device
Run an antivirus scan
4
Report the incident
Report suspicious sites to your national CERT or cybercrime authority
Updates — why they matter
System and app updates patch security vulnerabilities that attackers exploit to take over devices. An outdated system = an open door.
Enable automatic updates for your operating system and apps — do not postpone them.
Update apps on your phone too — especially your browser and banking apps.
A smartphone no longer supported by the manufacturer will not receive security patches — consider replacing it.
Safe Wi-Fi habits
Public Wi-Fi is a risk — do not log into your bank, shop online or enter passwords on a public network (café, airport, hotel).
If you must use public Wi-Fi — use a VPN (e.g. ProtonVPN, free plan).
At home: change the default router password. Set encryption to WPA3 (or WPA2 if WPA3 is unavailable). Regularly check the list of devices connected to your network.
Consider a separate guest network for visitors — without access to your own devices.
Physical device security
Set a PIN, password or fingerprint as a screen lock on every device.
Shorten the auto-lock timeout — 1–2 minutes is enough.
Make regular backups — to an external drive or cloud. This protects against ransomware and hardware failure.
Before selling or giving away a device — perform a full factory reset and remove your account.
App permissions
Many apps request access to your microphone, camera, location and contacts — often without any real need.
Regularly review permissions: Settings → Apps → Permissions. A torch app asking for microphone access? Deny it.
Share location only while using the app — not “always”.
Delete apps you no longer use — fewer apps means a smaller attack surface.
Personal data online
Your data is a commodity. Companies collect information about what you do online to serve ads and sell profiles to others. You can control this.
Click “Necessary only” on cookie banners instead of “Accept all”. This limits tracking by advertisers.
Use incognito mode on shared computers — your searches and passwords are not saved.
Do not give your main email address everywhere. Consider a second address for signing up to services.
Search with DuckDuckGo instead of Google — they do not track your search history.
Social media
Quizzes and apps on social media often harvest data — “What animal are you?” is not fun, it is a phishing attempt.
Set your profile to private — only friends can see your posts and photos.
Review connected apps on your account — Settings → Privacy → Apps. Remove any you do not use.
Do not post photos of documents, boarding passes, keys or the view from your window when you are on holiday. This is information for burglars.
Your data rights (GDPR)
You have the right to:
- ✓Access — you can ask any company for a list of the data they hold about you
- ✓Rectification — correction of inaccurate data held about you
- ✓Erasure — the “right to be forgotten” — you can request deletion of your data
- ✓Portability — receiving your data in a machine-readable format
- ✓Complaint — to your national data protection authority if a company violates GDPR
Free security tools
Bitwarden — password manager
The best free password manager. Open-source, works on all platforms. Recommended for beginners.
FREEHave I Been Pwned (haveibeenpwned.com)
Check if your email was exposed in a data breach. Just enter your address.
FREEProtonVPN
VPN from the creators of ProtonMail. Free plan with no data limit. Protects your connection on public Wi-Fi.
FREE (basic plan)uBlock Origin — ad and tracker blocker
Browser extension blocking tracking ads and malicious sites. Install in Firefox or Chrome — free.
FREEGoogle Authenticator / Microsoft Authenticator
Apps for generating 2FA codes. Essential for enabling two-factor authentication.
FREEVirusTotal (virustotal.com)
Check whether a file or link is safe — scanned simultaneously by over 70 antivirus engines.
FREESimpleLogin / AnonAddy
Generate email aliases — use a different address for each registration. Your real email stays hidden.
FREE (basic plan)Where to report incidents
ENISA — enisa.europa.eu — European Union Agency for Cybersecurity, resources and guidance
Your bank — if you gave card details or made a transfer to a fraudulent account — call immediately and block your card
Police — if money was stolen or your identity was compromised — file a report
Your national data protection authority — if a company violated your data rights
Quick security checklist
- ✓I use a different password for every service
- ✓I have 2FA enabled on my email and banking accounts
- ✓My operating system and apps are up to date
- ✓I do not click suspicious links in texts or emails
- ✓My phone and computer have a screen lock enabled
- ✓I have backed up my data within the last 30 days
- ✓I have checked whether my email was in a breach at haveibeenpwned.com
- ✓I do not use public Wi-Fi without a VPN