How to Secure Your Laptop and Personal Data: 22 Steps That Actually Work

Install OS updates before changing anything else, because unpatched systems are the easiest way for malware to enter. On Windows, macOS or Linux, use the built-in update tool and restart when prompted. More Computers and Electronics guides follow the same update-first habit.

Turn on BitLocker on Windows, FileVault on macOS, or the encryption option provided by your Linux distribution. Encryption does not protect against every attack, but it makes a stolen device much less useful to a thief.

Choose a reputable password manager and let it generate unique passwords for each site. Save recovery information offline as well, because losing access to the manager can lock you out of everything. The FTC has practical password guidance for consumers.

If one website is breached and you reuse the same password, attackers can try it on your email or bank. Start by fixing email, payment accounts and cloud storage, then move to smaller accounts over time.

Use an authenticator app or hardware key where available. SMS is better than nothing, but app-based codes and security keys are harder to intercept. Keep backup codes in a safe place so you are not locked out.

Extensions can read browsing data, so keep only the ones you actively need. Delete old ad blockers, shopping helpers and download tools you no longer use, then check permissions for the rest.

Do not browse, email or test software from an administrator account. Keep a separate admin account for installations, so accidental malware has less power to change the system.

The built-in firewall is usually enough for a home laptop. Keep it enabled unless a trusted application specifically asks for a narrow exception, and avoid turning it off just to make a device work.

Use the 3-2-1 rule: three copies, two local media types and one off-site backup. Cloud backup plus an external drive is a simple setup for most people, and it can save you after a failed update or stolen laptop.

If you keep backups on a portable SSD or USB drive, encrypt it or use a drive with hardware encryption. Label the drive, store it away from the laptop, and test that you can restore a file.

Log into your router and check for firmware updates. If the router is old and no longer receives updates, replace it. The UK NCSC provides practical router security advice.

Default admin passwords are often printed on the device and widely known. Replace the router admin password with a unique one stored in your password manager.

Set the wireless security mode to WPA3 if available, otherwise WPA2 AES. Avoid open or WEP networks, and do not reuse the Wi-Fi password as the router admin password.

Wi-Fi Protected Setup can make connecting easier, but older implementations have known weaknesses. If your router offers WPS, turn it off unless you specifically need it and understand the risk.

Check the router client list for devices you do not recognise. If something looks wrong, change the Wi-Fi password, update firmware and reconnect only trusted devices.

Turn on device location and remote lock through Apple, Microsoft or your Linux desktop account. This does not replace encryption, but it gives you a better chance of recovery.

Set a short inactivity lock and require a password on wake. In cafes, trains and shared homes, a locked screen is one of the simplest protections available.

Public networks can be convenient but risky. Avoid banking on unfamiliar Wi-Fi, keep browser HTTPS warnings enabled, and use a trusted VPN or mobile data when you need extra protection.

Keep the browser, email client, PDF reader and media apps updated. Enable automatic updates where safe, and remove software you no longer use.

Check which apps can access the camera, microphone, files and location. Revoke permissions for apps that do not need them, and cover or disconnect devices when not in use.

Do not click urgent payment or account alerts without checking the sender and visiting the official site directly. The CISA phishing guidance applies to home users too.

Print or write down account recovery codes, then store them in a secure place. Do not keep all codes in the same cloud account you are trying to protect.