These six habits take an afternoon to set up.

1. Use a password manager

Reusing a password means one leaked site can unlock everything else. A password manager creates and remembers a different strong password for every account. You only remember one.

2. Turn on two-factor authentication

Two-factor authentication (2FA) asks for a second proof after your password. Start with your main email, your payment platforms and your social accounts. Prefer an authenticator app or a security key over SMS codes when the option exists.

3. Protect your main email first

Your email is the key to every password reset. If someone controls it, they control everything. Give it the strongest password and 2FA before anything else.

4. Learn to spot phishing

Common signs:

• Urgency: “your account will be deleted in 24 hours”.
• A sender address that is almost right.
• Links that lead to a login page you did not ask for.
• Messages offering partnerships or prizes that require you to “verify” your account.

When in doubt, do not click. Open the app or website yourself and check from there.

5. Save your backup codes

When you enable 2FA, platforms give you backup codes. Store them somewhere safe and offline. They are what saves you if you lose your phone.

6. Review who has access

Old collaborators, apps you tested once and devices you no longer use may still have access to your accounts. Check the security settings of your main platforms every few months and remove what you do not recognize.

Security is not a one-time project, but these basics stop most of the problems creators actually face.