Cyber Hygiene Checklist: Plain-English Steps

Most online crime against ordinary people does not need clever hacking: it works because of a reused password, a missed update or one rushed click. "Cyber hygiene" simply means the small, regular habits that keep your devices and accounts healthy, in the same way that washing your hands keeps you healthy. This guide turns the official advice from the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA) and the US Federal Trade Commission (FTC) into one checklist. It is written for individuals, families, older people and very small businesses, with no technical knowledge needed. Do the one-hour set-up once, then keep the monthly and yearly habits going.

Key takeaways

Your email password matters most. Whoever controls your email can reset almost every other account, so give it a strong password used nowhere else.
Turn on two-step verification. A second check, such as a code or a tap on your phone, stops most criminals who have stolen a password.
Let updates install themselves. Updates fix security holes. Switch on automatic updates for phones, computers, browsers and apps.
Back up what you cannot replace. A copy of your photos and documents in a separate place turns a lost phone or ransomware into an inconvenience, not a disaster.
Stop, check, then act. Never use the link or phone number in an unexpected message. Contact the company using details you already know.

Why these few habits work

The official agencies agree on a short list. The NCSC's Cyber Aware campaign asks people to protect their email with a strong and separate password, install the latest software and app updates, turn on two-step verification (2SV), use a password manager, back up data, and build passwords from three random words. CISA's Secure Our World campaign boils it down to four steps: recognise and report phishing, use strong passwords, turn on multi-factor authentication (MFA, another name for two-step verification), and update software.

The threat is real for small organisations too. The UK government's Cyber Security Breaches Survey 2025 found that 43% of businesses and 30% of charities reported a breach or attack in the previous 12 months. Among those affected, phishing (scam emails, texts and calls) was the most common type, hitting 85% of businesses and 86% of charities.

This guide gives you the checklist. Each step links to a fuller guide if you want more detail.

Set it up in one hour

Secure your email first (10 minutes). Change the password to three random words, for example a mix like "PurpleKettleRiver", with a number or symbol if the site asks. Do not use it anywhere else. See the Securing Your Email Account Guide.
Turn on two-step verification (10 minutes). Start with email, banking, social media and shopping accounts. The FTC and Google both say an authenticator app, a sign-in prompt on your phone or a security key is safer than a text message code, but a text code is still far better than nothing. See the Two-Factor Authentication for Everyone Guide.
Start a password manager (15 minutes). A password manager is an app that creates and remembers a different strong password for every site. The FTC suggests passwords of at least 15 characters; a password manager does this for you. See Password Managers Explained for Everyone Guide.
Switch on automatic updates (10 minutes). Use the settings in the table below.
Turn on backup (10 minutes). Switch on your phone's cloud backup and copy important files to an external drive or online storage. See the Backing Up Personal Data Guide.
Run your account security check (5 minutes). Google's Security Checkup, at myaccount.google.com/security-checkup, walks you through recovery options, 2-Step Verification, connected apps and screen locks. Apple and Microsoft accounts have similar security pages.

Settings to change on your devices

These paths come from the companies' own help pages, checked in October 2026. Menu names change between versions, so look for the nearest match.

Device or account	Where to go	What to switch on
iPhone or iPad	Settings > General > Software Update > Automatic Updates	"Automatically Install", which installs updates overnight while charging and on Wi-Fi
Windows 11 computer	Start > Settings > Windows Update	Select "Check for updates", then let updates install and restart when asked
Google account	Profile picture > Recommended actions, or Security Checkup	Recovery phone and email, 2-Step Verification, passkey, remove linked apps you do not use
Phones and tablets	Lock screen or security settings	A screen lock (PIN, fingerprint or face), so a lost device does not open for a stranger
Home router	The router's admin page or app	Change the default admin password and install firmware updates. See the Securing Your Home Router Guide

The FTC also advises turning on automatic updates for security software, browsers and mobile apps, because updates "often contain critical patches and protections against security threats". If a device is so old that it no longer gets updates, plan to replace it, especially if you use it for banking.

Spot and stop scams

Scam messages are the most common way in, and criminals now use AI to write them with good spelling and grammar. Look for the pressure, not the typos.

Urgency: "Your account will close today" or "pay now to avoid a fine".
Requests for codes or passwords: no real bank, delivery firm or tech company will ask you to read out a one-time code.
Unusual payment: gift cards, cryptocurrency or a "safe account" transfer.
Links and attachments you did not expect: the FTC advises not clicking them and contacting the company through a phone number or website you know is real.

Forward scam emails in the UK to [email protected]. See the How to Spot a Phishing Email Guide and the Recognising Tech Support Scams Guide.

Monthly and yearly habits

Hygiene is a habit, not a one-off. Put two reminders in your calendar.

Every month (10 minutes): restart your phone and computer so pending updates finish; check your backup ran; look at your bank and card statements for payments you do not recognise.
Every three months: open your password manager's security report and change any weak, reused or breached passwords; remove apps you no longer use from your phone.
Every year: review which apps and websites are connected to your Google, Apple, Microsoft and social media accounts; check privacy settings on social media; update your recovery phone number and email; test that you can actually restore a file from your backup.
When something changes: a new phone, a new router, a child's first device or a new family member online is the moment to run the one-hour set-up again for that device.

Security questions count as passwords too. The FTC suggests choosing questions only you can answer, or giving made-up answers stored in your password manager, because real answers such as your mother's maiden name can often be found online.

For very small businesses

A sole trader or a business with a handful of staff needs the same habits, plus a few more.

Separate accounts: each person has their own login. No shared passwords on sticky notes.
Admin rights only when needed: day-to-day work on an ordinary user account, not an administrator account, limits the damage if a bad link is clicked.
Leavers: remove access and change shared passwords on the day someone leaves.
Payment checks: confirm any change to a supplier's bank details by phone on a number you already hold.

See the Small Business Cybersecurity Basics Guide. For organisations, see the Cyber Essentials Guide.

What to do if it happens

Money lost or bank details shared: call your bank straight away using the number on your card.
Account taken over: use the provider's account recovery page, change the password, sign out of all other devices and turn on two-step verification.
Password leaked: change it on that site and anywhere else you reused it.
Device infected or locked: disconnect it from the internet, do not pay any ransom, and restore from your backup or seek trusted help.
Report it: see Where to get help below. Reporting helps police and agencies spot patterns and warn others.

Where to get help

UK, scam emails: forward to [email protected] (the NCSC's reporting service). Suspicious websites can be reported through the NCSC website.
UK, fraud and cyber crime: in England, Wales and Northern Ireland report to Report Fraud at reportfraud.police.uk or 0300 123 2040. In Scotland call Police Scotland on 101.
UK, advice: NCSC Cyber Aware for step-by-step guidance, Get Safe Online, and Citizens Advice for consumer problems.
US: report scams at ReportFraud.ftc.gov and identity theft at IdentityTheft.gov. CISA's Secure Our World pages give simple guidance, and online crime can be reported to the FBI's IC3 at ic3.gov.

Common failure patterns

One password everywhere: when one website is breached, criminals try the same email and password on banks and shops. A password manager fixes this.
Pressing "remind me later" for ever: updates that sit waiting leave known holes open. Turn on automatic installs and restart regularly.
A backup that was never tested, or always plugged in: a drive that stays connected can be encrypted by ransomware along with everything else. Unplug it after each backup and try a restore once a year.
Out-of-date recovery details: an old phone number on your email account can lock you out, or let someone else in.
Trusting the caller ID or the sender name: both can be faked. Always contact the organisation through details you found yourself.
Two-step verification on email but not elsewhere: banking, social media and shopping accounts are targets too.

Practitioner checklist

Tick these off once, then revisit them using the monthly and yearly habits above.

My email has a strong password (such as three random words) that I use nowhere else.
Two-step verification is on for email, banking, social media and shopping accounts.
I use a password manager, and every important account has a different password.
Automatic updates are on for my phone, computer, browser and apps.
Every phone, tablet and computer has a screen lock.
My photos and documents are backed up, and one copy is kept separate from my main device.
My account recovery phone number and email are up to date.
I have changed my router's default admin password.
I never use links or numbers from unexpected messages; I contact companies directly.
I know how to report scams: [email protected] and Report Fraud in the UK, ReportFraud.ftc.gov in the US.

Cyber Hygiene Checklist Guide: Plain-English Steps to Stay Safe