Guides
Short checklists you can work through at your own pace. Start with the first one: it protects you from the most common attacks.
For everyone
Sensible protection for your accounts, your phone and everyday life online.
Start here
-
Secure your accounts and passwords
Protect your email, social media and other accounts from takeover, the most common way people get hacked.
-
Lock down your phone
Protect what is on your phone if it is lost, stolen or picked up by someone else.
See all 9 steps
- Set a strong screen lock
- Install updates automatically
- Turn on Find My or Find Hub
- Hide message previews on the lock screen
- Check what your apps can access
- Install apps only from the official store
- Lock your SIM card with a PIN
- Turn on theft protection
- Erase the phone before you sell or give it away
-
Make your messaging apps private
Stop others from taking over your account or reading your chats, in the apps you already use.
Everyday habits
-
Spot fake messages and calls
Most scams start with a message or a call that pushes you to act fast. Learn the signs, and what to do if you already clicked.
-
Control who sees you on social media
Decide who can see your posts, your profile and where you are, in the apps you already use.
-
Make your web browser more private
Your browser sees nearly everything you do online. A few settings cut down who else does.
-
Control who knows where you are
Your phone and your photos can show where you live and where you are now. Decide who sees that.
-
Use AI chatbots without oversharing
AI chatbots keep what you type, and people at the company may read it. Know what to keep out, and change the settings that matter.
See all 9 steps
- Keep sensitive information out
- Know who can read your chats
- Turn off training on your chats
- Delete old chats and memories
- Use temporary chats for one-off questions
- Know the services that say they keep less
- Check shared links and secure the account
- Think before uploading files and photos
- Follow your employer's rules
Devices and network
-
Secure your computer
Keep your Windows PC or Mac updated, locked and encrypted, without risking a lock-out.
See all 8 steps
-
Back up, and be ready to lose a device
Phones get lost, stolen and broken. With a backup and a plan, you lose the device, not your photos and accounts.
-
Secure your Wi-Fi and understand VPNs
Lock down your home router, use café Wi-Fi without worry, and know what a VPN can and can't do.
See all 9 steps
- Change the router's admin password
- Use WPA3 or WPA2 and a strong Wi-Fi password
- Keep the router updated
- Give guests and smart devices their own network
- Use public Wi-Fi sensibly
- Know what a VPN does and doesn't do
- Choose a VPN carefully
- Use a DNS service that blocks harmful sites
- Stop joining networks automatically
When something goes wrong
-
If your account was hacked
Someone got into your account. Get back in through the official route, sign them out, check what they changed and warn the people they could reach.
See all 10 steps
For people at higher risk
For activists, journalists and anyone who has a reason to expect targeted attention. Start with the first guide: it helps you work out which of the others you need.
Start here
-
Make your security plan
Before you change settings, work out what you protect and from whom. Your answers decide which guides you need and which steps could backfire.
Harden the basics
-
Harden your phone against targeted attacks
Settings that make a phone harder to break into for someone who targets you personally, with what each one costs and what it doesn't stop.
See all 9 steps
- Install security updates as soon as they arrive
- Use a long passcode and know how to switch off face and fingerprint unlock
- Turn on Lockdown Mode on iPhone, iPad and Mac
- Turn on Advanced Protection on Android
- Restart your phone regularly
- Keep fewer apps and connections
- Block data through the cable while the phone is locked
- Turn off 2G
- Know when GrapheneOS is worth it
-
Make your accounts hard to take over
Codes can be phished; security keys can't. Add keys, turn on the strictest account settings and plan how you will get back in if you lose them.
-
Keep sensitive conversations private
Signal protects what you write, not who you are or what is on the other person's phone. Check who you are talking to, hide your number and know the limits.
-
Use email when it's sensitive
Email leaves a record of who wrote to whom, when and about what. Move sensitive talk to Signal, keep subject lines bland, and save your recovery code before you rely on encrypted mail.
Situations
-
Protect your phone and others at a protest
Your phone can show where you were, who you know and who was beside you. Prepare it before you go, protect the people in your photos, and know what to do if it is taken.
-
Travel and cross borders with your devices
At a border your devices can be searched or taken out of your sight. Carry less, prepare at home, switch off before the crossing and know what to do afterwards.
-
If your phone or computer may be taken
Encryption protects a device that is switched off, not one that is unlocked. Know what stays readable, keep less on the device and plan who you will call.
Threats aimed at you
-
Spyware aimed at you
Targeted spyware is rare, expensive and hard to see. Know the real warnings, don't wipe your phone before an expert looks at it, and make attacks harder.
-
Handle online harassment and doxxing
Search yourself the way an attacker would, keep evidence before you report or delete, and put your physical safety first if your address is exposed.
-
Go online without revealing who you are
Tor Browser hides where you are from the sites you visit, but not that you use Tor. Most people lose their anonymity through their own habits, not a broken tool.
Working with others
-
Protect sources and sensitive documents
A first message, a file or a forgotten copy can lead back to a source. Plan first contact, clean and redact files properly, and keep as little as you can.
-
Keep a small team secure
Give each person their own access, require two-step verification, have more than one admin, remove access the day someone leaves, and agree in advance what to do in an emergency.