18 ways to stop
being an easy target.
Practical, no-BS security habits. Each one takes less than a day to implement.
Use a Passphrase, Not a Password
Length > Complexity. "correct-horse-battery-staple" is harder to crack than "P@ssw0rd1!".
Clear Your Cookies Weekly
Session hijacking is the easiest way to bypass MFA. Terminate stale sessions often.
Disable Auto-Join Wi-Fi
Evil Twin hotspots wait for your phone to auto-connect. Stay in manual mode.
Check the Return-Path
The "From" name is a lie. Check the actual return-path header to see the truth.
No Secrets in Git
Even private repos get leaked. Use environment variables for all API keys.
Use Cloudflare Proxies
Hide your actual server IP. If they can find your origin, they can bypass your firewall.
Isolate Your Database
Publicly reachable databases (port 3306/5432) are magnets for brute force. Keep them in a private subnet.
SIM Swap Protection
Call your carrier and add a "Port-Out PIN". Your phone number is the weakest link in your security.
Separate Your Lives
Use Different Browser Profiles (Firefox Containers) for work, personal, and shady site browsing.
Buy a YubiKey
Hardware codes beat SMS codes 100% of the time. Phishing-proof your identity.
Print Your Backup Codes
If you lose your MFA device and haven't saved your 10 recovery codes offline, you're locked out forever.
Scope Your Tokens
Never create a "Full Access" API token. Give it the absolute minimum permissions needed to function.
Update Your Firmware
Your home router is an at-risk Linux server. If the manufacturer stopped updates, the hardware is tech-trash.
Scrub Your Photos
Posting a photo from home? Strip the GPS coordinates first or everyone knows your origin.
Hover Before You Click
Links are masks. Hover over every link to see the ACTUAL destination in the bottom corner of your browser.
The 3-2-1 Backup Rule
3 copies, 2 different media types, 1 stored off-site. If it doesn't exist in 3 places, it doesn't exist.
Use Quad9 or 1.1.1.1
Default ISP DNS is slow and monitors your traffic. Switch to a secure, private resolver at the router level.
Check the "Lock" Details
A green lock just means the connection is encrypted, not that the site is safe. Verify the Certificate Owner.