Your web browser is the program you use most, and the one attackers aim at most. A few settings and habits keep fake sites, harmful downloads and nosy extensions out, without making the web any harder to use.
About 10 minutes to read20 minutes to set upBeginner
1Use an up-to-date browser with protection turned on
Chrome, Edge, Firefox, Safari and Brave all update themselves, but an update only finishes when the browser restarts. If you never close your browser, you may be running an old, vulnerable version for weeks.
Do this
Restart your browser when it shows an update button or a coloured dot, or at least once a week.
Check the version: in the browser menu choose Help → About (or Settings → About). This also triggers any waiting update.
Turn on the built-in protection that warns about dangerous sites and downloads:
Safari: Settings → Security → Warn when visiting a fraudulent website.
Take warnings seriously
If your browser shows a full-screen red warning about a site or download, go back. These warnings are rarely wrong, and clicking through is exactly what attackers hope you will do.
2Know where you really are
Fake websites can copy a real one perfectly. The page itself proves nothing; the web address is what counts.
Read the address from the right. The real site name is the part just before the first single slash, such as bank.com in www.bank.com/login. In bank.com.account-check.net/login, the site is actually account-check.net.
The padlock does not mean safe. It only means the connection is encrypted. Fake sites have padlocks too.
For banking and important accounts, use a bookmark, the official app, or type the address yourself, rather than following a link or a search result.
Be careful with search ads. The top results for popular software and services are sometimes paid ads that lead to look-alike sites. Scroll past ads, or go to the official site directly.
Let your password manager help. It only fills in passwords on the real site. If it doesn't offer your login where you expect it to, stop and check the address. (See Module 1.)
For more on spotting and handling fake messages that lead to these sites, see Module 4.
3Download only from the source
Most harmful software arrives because someone chose to install it, thinking it was something else: a free version of a paid program, a video player, a document or an “update”.
Do this
Install apps from the official app store (App Store, Google Play, Microsoft Store) or the developer's own website, reached by typing its address or from a trusted link.
Avoid “free” versions of paid software, cracks, key generators and download sites that bundle extra installers. They are one of the commonest sources of malware.
Update your browser and apps only through their own update settings, never from a pop-up on a website saying you need to.
Before opening a downloaded file, check its type. A file called invoice.pdf.exe, or a “document” that is actually a program or script, is a red flag. Our File Hash Checker shows what a file really is and lets you compare it with the publisher's checksum.
If a file asks you to turn off your antivirus or “enable content” to view it, don't.
4Keep extensions to a minimum
Browser extensions (add-ons) can be very useful, but many ask for permission to “read and change all your data on all websites”. That includes your email, banking and passwords as you type them. Extensions are also sometimes sold to new owners who quietly add tracking or worse in an update.
Open your extensions list (Chrome and Edge: Menu → Extensions; Firefox: Menu → Add-ons; Safari: Settings → Extensions) and remove anything you don't use or don't recognise.
Install extensions only from the browser's official store, from developers you recognise, with many users and recent updates.
Check the permissions it asks for. A simple tool that wants access to every website deserves a second thought.
If an extension suddenly changes behaviour, shows ads or redirects your searches, remove it.
5Shut down pop-ups and notification spam
Many sites ask to “show notifications”. Allowing a dodgy one lets it push alarming messages, fake prizes and fake virus warnings straight onto your screen, even when the site isn't open.
Do this
Say Block to notification requests unless you really want alerts from that site.
Review and remove existing permissions: in Chrome and Edge, Settings → Privacy and security → Site settings → Notifications; in Firefox, Settings → Privacy & Security → Permissions → Notifications; in Safari, Settings → Websites → Notifications. Check location, camera and microphone permissions while you are there.
Remember that a website cannot scan your computer for viruses. A page that claims your device is infected or locked is lying: close the tab, or the whole browser if it won't let you.
6Understand what private browsing does
Private or incognito mode is useful, but it does less than many people think.
Private browsing makes me anonymous online.
It only stops your own browser keeping history, cookies and form data after you close the window. Websites, your employer or school network, and your internet provider can still see what you do.
Clearing cookies stops websites recognising me.
Sites can often recognise a browser from its combination of settings, screen, fonts and hardware, known as a fingerprint. See what yours gives away with our What Your Browser Reveals page.
Private windows are still handy on a shared or borrowed computer, or to sign in to a second account without signing out of the first. To reduce tracking more broadly, use your browser's tracking protection, block third-party cookies, and consider a content blocker from your browser's official store.
Check your understanding
A site shows a padlock in the address bar. What does that tell you?
Only encryption. Fake sites use padlocks too. Check the actual web address.
In the address paypal.com.secure-login.info/account, which site are you really on?
secure-login.info. Read the name just before the first single slash. Everything to its left can be made up.
A web page says your computer is infected and you must act now. What should you do?
Close it. Websites cannot scan your computer. Your real antivirus will tell you itself, not through a web page.
Your checklist
Your ticks are saved only in this browser. Nothing is sent anywhere.
This module is general educational information, not professional advice, and following it cannot guarantee you will not encounter harmful sites or software. Browser menus and feature names change; follow each browser's current instructions. Products are named as examples only; Rondel Group is not affiliated with them.