Getting Started: The Three Things That Matter Most

Security advice tends to arrive as a list of forty things, which is a reliable way to get someone to do none of them. So let’s be honest about the ranking.

Three things account for most of the risk most people face. Do these and you’ve closed the doors attackers actually walk through.

Who this is for. Anyone who uses email and a phone. No technical background assumed — every term gets defined the first time it shows up.

1. Stop reusing passwords

Here’s the part that surprises people: attackers usually aren’t guessing your password. They already have one.

When a company gets breached, the stolen usernames and passwords end up in collections that circulate freely. Attackers then take those pairs and try them on hundreds of other sites — your bank, your email, your work login. This is called credential stuffing, and it works constantly, for one reason: most people use the same password in more than one place.

One reused password means a breach at a company you’d forgotten about becomes a break-in at your bank.

What to do: use a password manager. It generates a different random password for every site and remembers them, so you only memorize one. Bitwarden’s free tier covers this completely; there are alternatives on our resources page.

Start by changing the passwords on your email account first. Email is the master key — anyone with it can reset everything else.

Don’t try to do all of them at once. Change email, banking, and your primary work login today. Let the password manager pick up the rest as you naturally log in over the following weeks.

2. Turn on multi-factor authentication

Multi-factor authentication (MFA, sometimes 2FA) means logging in takes two things: your password, plus a code or a tap on your phone. Steal the password, and you still can’t get in.

Not all MFA is equal:

Method	Strength	Notes
SMS text codes	Weak, but far better than nothing	Vulnerable to SIM swapping
Authenticator app	Strong	Free; Aegis or Ente Auth work well
Hardware key	Strongest	A physical key like a YubiKey

Turn it on for email first, then banking, then anything holding payment details or personal data.

Save your backup codes. Most services show you a list of one-time recovery codes when you enable MFA. Put them in your password manager. If you lose your phone without them, getting back in ranges from tedious to impossible.

3. Learn to recognize phishing

Phishing is a message designed to look like it’s from someone you trust, to get you to hand over a password or click something harmful. It’s how most successful attacks start — not through clever technical exploits, but by asking.

Modern phishing is well written. Spelling mistakes are no longer the tell. What gives it away instead:

Urgency. “Your account will be closed in 24 hours.” Manufactured time pressure is the single most reliable signal.
An unexpected link or attachment, especially an invoice or delivery notice you weren’t waiting on.
A request that bypasses normal process — a colleague asking for gift cards, a supplier suddenly changing bank details.
A sender address that’s close but wrong. micros0ft-support.com reads as legitimate at a glance.

The habit that protects you: never log in through a link in an email. Open a new tab and type the address yourself, or use your own bookmark. This alone defeats nearly every credential-phishing attempt, because the fake site never gets the chance to see your password.

If you think you’ve entered a password somewhere you shouldn’t have: change that password immediately, change it anywhere else you reused it, and check the account’s recent login activity.

What’s next

That’s the high-value work. Once it’s done, the next tier is worth your time:

Keep devices and browsers updated — patches close holes that are already public
Back up anything you’d hate to lose, with one copy offline
Review which apps have access to your Google or Microsoft account

Writing your own guide

Copy this file to src/content/guides/your-slug.md — the filename becomes the URL, so keep it short and readable
Set order to where it belongs in the sequence, and difficulty to beginner, intermediate, or advanced
Write a description — it’s the card excerpt and the search-result snippet
Delete this section and everything above it

Guides are ordered by the order field, not by date and not by filename. Leaving gaps (10, 20, 30) means you can insert one between two others without renumbering.