Keep your browser and operating system updated, protect important accounts and check unexpected links before opening them. These habits reduce common online risks. You do not need to treat every website as dangerous, and no single antivirus or private-browsing mode can make every action safe.
Ten mistakes worth fixing
| Mistake | A better habit |
|---|---|
| Putting off browser and system updates | Install available supported updates and restart when required. |
| Reusing the same password | Use a password manager and unique passwords, or passkeys where available. |
| Ignoring extra account protection | Enable suitable multifactor authentication and keep recovery options current. |
| Trusting a link because a message looks familiar | Open the service through its known app or saved address when a request is unexpected. |
| Downloading from the first search advert | Check the publisher and the real download address. |
| Installing extensions without reviewing access | Choose only those you need and check their developer and permissions. |
| Overriding a security warning without checking it | Read the exact warning and investigate the file or site. |
| Assuming public Wi-Fi or a VPN guarantees safety | Check the network and website; avoid unexpected sign-in prompts. |
| Leaving shared computers signed in | Sign out, remove downloaded personal files and close the session. |
| Having no way to recover important files | Keep appropriate backups and check that you can restore them. |
CISA’s Secure Our World guidance covers phishing, strong passwords, multifactor authentication and updates. Work or school devices may have their own approved security tools and procedures.
Check the address, not just the padlock
A secure connection helps protect traffic between you and a site. It does not prove that the shop or person behind the site is honest. Look at the domain, the reason for the request and whether you expected to be there.
If a message says an account is locked, open the service directly rather than using the message’s button. The same applies to requests to enter a password, approve an unexpected sign-in or transfer money.
Understand what private browsing changes
Private browsing mainly limits the session data kept on that device after all private windows close. It does not make you anonymous to every website or erase files you download. Our Edge InPrivate guide explains the limits.
Respond to a blocked download carefully
A “virus detected” message can describe a real threat, an unwanted app or another type of browser warning. Keep the block in place while you check the publisher and detection details. See our guide to Windows download alerts for the next steps.
Installing several real-time antivirus products at once is not a substitute for these checks. Use the protection recommended for your device and keep it current.
Frequently asked questions
Does a padlock mean a website is trustworthy?
No. It describes the connection, not the honesty of the site’s operator.
Can antivirus prevent every phishing attempt?
No. You still need to check unexpected requests for passwords, payments or account approval.
Does private browsing hide me from my internet provider?
It is not a general anonymity tool. Its main purpose is to limit local session data.
What should I improve first?
Update supported software, secure your main email account, use unique passwords or passkeys, and review account recovery options.