10 minutes · Everyone with a phone or computer
The Ten-Minute Kit
For iPhone, Android, Mac, and Windows. Seven settings that stop most real-world attacks.
Menus move around between versions, so each step says what to search for. Every device has a search box at the top of Settings (on Windows, the search box in the Settings app).
1. Automatic updates on, and restart when asked
Why: most attacks that hit regular people use bugs that are already fixed. The gap is the update sitting there waiting for a restart.
How: - iPhone / iPad / Mac: search Settings for Automatic Updates. Turn on everything you see there, including security responses. - Android: search Settings for System update and Google Play system update. Also open the Play Store, tap your profile picture, and turn on auto-update apps. - Windows: search Settings for Windows Update. Turn on the option to get updates as soon as they are available. - Browsers (Chrome, Edge, Safari, Firefox) update themselves but only finish when you close and reopen them.
When your device asks to restart, say yes that day.
Time: 2 minutes.
2. Passkeys or a password manager
Why: reused passwords are how one leaked site becomes ten broken accounts. Passkeys can't be phished or reused.
How: - Use the password manager built into your device (Apple Passwords, Google Password Manager, or Microsoft's in Edge) or a well-known paid one. Pick one and use it everywhere. - When a site offers to create a passkey, say yes. Start with email, bank, and Apple, Google, or Microsoft account. - Search your password manager for a security or password checkup section. Change any password it flags as reused or leaked, email first.
Time: 5 minutes to start. Fix the rest as you log in to things.
3. Two-step login with an app or passkey, not text messages
Why: text-message codes can be stolen by someone who takes over your phone number. An authenticator app or passkey can't.
How: in your email, bank, and social accounts, search the security settings for two-step verification or 2FA. Choose passkey or authenticator app (Google Authenticator, Microsoft Authenticator, or the one built into your password manager). Save the backup codes in your password manager. If text is the only option a site offers, it is still far better than nothing.
Time: 2 minutes per account.
4. Lock your phone number with your carrier
Why: in a SIM swap, a scammer convinces your carrier to move your number to their phone, then receives your login codes.
How: log in to your carrier's app or website, or call them. Ask for a port-out PIN, number lock, or SIM protection (each carrier uses its own name). Set a PIN that is not your birthday or the last four of your Social Security number. Store it in your password manager.
Time: 5 minutes.
5. Freeze your credit (US)
Why: a freeze stops anyone from opening new credit in your name. It is free by federal law and does not affect your credit score.
How: create an account at each of the three bureaus and choose freeze: - Equifax: equifax.com - Experian: experian.com - TransUnion: transunion.com
You can lift it for a day when you apply for a loan or card. Freeze your kids' credit too; each bureau has a process for minors.
Time: 15 minutes for all three.
6. Backups
Why: if your device is lost, stolen, or locked by ransomware, a backup turns a disaster into an afternoon.
How: - iPhone: search Settings for iCloud Backup and turn it on. - Android: search Settings for Backup and turn it on. - Mac: search System Settings for Time Machine and point it at an external drive. Or keep Desktop and Documents in iCloud Drive. - Windows: search the Start menu for Windows Backup, or keep files in OneDrive.
Once a year, try restoring one file to make sure it works.
Time: 3 minutes to turn on.
7. Extra-strong mode, for people who are specifically targeted
Why: journalists, activists, officials, executives, and people dealing with a stalker or abusive ex sometimes face expensive, targeted attacks. These modes shut off features those attacks rely on.
How: - iPhone / iPad / Mac: search Settings for Lockdown Mode. - Android: search Settings for Advanced Protection (on recent versions). - Google account: search for Google's Advanced Protection Program.
Be honest with yourself: this breaks some things. Some websites load slower, some attachments and link previews are blocked, some calls from new contacts may be limited. Most people don't need it. If you think someone is personally after you, turn it on and keep it on.
Time: 1 minute.
Why these seven
Most attacks on regular people are not clever. They use a bug that was patched months ago, a password that leaked from another site, or a phone company employee who was talked into moving your number. These settings close those doors. Antivirus apps, VPNs, and "phone cleaner" apps are not on this list because they matter far less than the seven above. If you only do two, do updates and two-step login.