Updated September 2026. Security products change often; the order of priorities below does not.

Most people are protected by four things, and only one of them costs money. Getting those four right matters far more than the brand of security software you buy — and several products sold to beginners protect against threats that barely exist any more. This guide covers what to set up, in what order, what you can skip, and why.

The order that actually matters

1. A password manager

The single highest-value change. It creates a different password for every site, remembers them, and fills them in — which also means it will not fill your bank password into a convincing fake, because the address does not match. Bitwarden and Proton Pass both have capable free plans, and Apple and Google now include one with your account. Our guide to password managers walks through setting one up without locking yourself out.

2. Two-factor authentication

A password alone is one thing someone can steal. Two-factor adds something they would also need: a code from an app, a passkey, or a physical key. Start with your email account, because it can reset everything else. See the 2FA setup guide for the exact steps on the main services, including how to avoid being locked out.

3. Antivirus: you probably already have it

Windows includes Microsoft Defender, and it is genuinely good. macOS has built-in protections. For most people these are enough, and they have two advantages over add-on products: they are already there, and they do not slow the machine down or nag you to renew.

Consider paid security software when you handle client data and want central management, when someone in the house downloads a lot of unfamiliar software, or when you need a specific feature such as parental controls. Skip the bundles that add a “PC cleaner”, a browser toolbar or a registry optimiser — those exist to justify a subscription.

4. Backups, tested

The only real answer to ransomware and to dropped laptops. Aim for more than one copy, and at least one that is not permanently connected — an external drive you plug in weekly, or a backup service with version history. Then do the part everyone skips: restore one file, and confirm the copy is actually readable. See our cloud storage and backup guide.

5. Recognising phishing

Most people who get compromised are not hacked in any technical sense; they are asked nicely. A message creates urgency, sends you to a page that looks right, and you type your password in. The habits that defeat it: never follow a link from an unexpected message about an account — go to the site yourself; treat “verify your account now” as a warning sign; and never read a verification code aloud to anyone who rings you. Our guide to spotting phishing attacks covers the signs in detail.

6. A VPN, honestly

A VPN hides your browsing from the network you are on and from your internet provider, and makes you appear to be somewhere else. It is genuinely useful on hotel, café and conference networks, and for privacy from your provider.

What it does not do: it does not make you anonymous, it does not stop malware, it does not protect an account whose password has leaked, and it does not encrypt anything at the far end. Most websites already use HTTPS, so the “anyone on café Wi-Fi can read your banking” warning in older adverts is largely out of date. Buy one for the reasons above, not out of fear — and remember you are moving your trust from your provider to the VPN company, so choose one with an independently audited no-logging policy.

Worth doing, quietly

• Check which accounts have appeared in breaches at Have I Been Pwned, and change those passwords first.
• Turn on device encryption — BitLocker on Windows, FileVault on macOS, on by default on modern phones.
• Set a screen lock on every device, phones included.
• Remove software and browser extensions you no longer use. Extensions can read what you do on pages.
• Keep a recovery plan: know where your backup codes are, and which email address controls your accounts.

What you can skip

• Multiple antivirus products at once — they conflict and slow the machine.
• “Registry cleaners” and speed boosters — no security value.
• Dark-web monitoring subscriptions — the free breach check above tells you the same thing.
• Changing passwords on a schedule — current guidance says change them when there is a reason, not every few months.
• Hiding your Wi-Fi network name — inconveniences you, not an attacker.

A weekend plan

1. Saturday morning: install a password manager, change your email password, turn on two-factor for email.
2. Saturday afternoon: work through banking and your main shopping accounts, using generated passwords.
3. Sunday: set up a backup, restore one file to prove it works, and switch on automatic updates everywhere.
4. Later: add the remaining accounts gradually as you sign in to them.

Frequently asked questions

Do I need to pay for antivirus?

Usually not. The protection built into Windows and macOS covers most home users. Pay when you need a specific feature, not as a default.

Is a free password manager safe?

Reputable free plans use the same encryption as their paid tiers. What matters is choosing an established provider with independent audits, then protecting it with a long, unique master password and two-factor authentication.

What is the very first thing to do?

Secure your email: a unique password and two-factor authentication. Whoever controls your email can reset almost everything else you own.

Do phones need security software?

Rarely. Keeping the system updated and installing apps only from the official store covers most of the risk. Phones need the same account protections — a screen lock, a strong account password and two-factor.

Related guides

• Password managers for beginners
• Two-factor authentication setup guide
• How to spot phishing attacks
• What to do when your data is exposed in a breach