Blog

<h2>What a VPN Actually Protects You From, and What It Doesn't</h2><p>A VPN gets talked about like it's some sort of complete invisibility cloak for the internet, switch it on and nothing bad can touch you again. I use one myself, every day, on every device I own, and I still don't believe that. A VPN does something specific and does it well, but it was never designed to catch everything else that can go wrong online, and treating it like it does is how people end up with a false sense of security in exactly the areas where they still need to pay attention. If you're comparing VPN services, I've written up <a href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today">how I'd choose a VPN</a> if I were starting from scratch today.</p><p><br></p><h2>What a VPN Genuinely Does Well</h2><p><br></p><p>At its core, a VPN encrypts the connection between your device and the internet, then routes it through a server somewhere else before it reaches its destination. Anyone watching the network you're connected to, whether that's your internet provider at home or whoever runs the free wifi in a coffee shop, sees encrypted traffic instead of what you're actually doing. Your real IP address gets replaced by the VPN server's, so websites and the ads that follow you around see a different location rather than the one you're actually sitting in. For anyone who's ever logged into online banking on a hotel's guest network without thinking twice about who else might be sitting on that same connection, this is the exact gap a VPN closes.</p><p><br></p><h2>What a VPN Won't Stop</h2><p><br></p><p>Where people get into trouble is assuming that encryption on the way out means safety on the way in. A VPN has no opinion on the email sitting in your inbox asking you to confirm your card details, it doesn't check whether the file you're about to download is malware, and it won't stop you typing your password into a fake login page that looks identical to the real one. It protects the tunnel your data travels through, not the judgement calls you make once you're connected. I've heard people say they don't need to be as careful about suspicious links because they're "on the VPN," and that's exactly the kind of thinking that gets accounts compromised. A VPN also won't undo a weak, reused password, and it won't add a second step to your login if you haven't turned that on separately, both of which matter far more to whether an account actually gets broken into than which server your traffic happens to route through.</p><p><br></p><h2>Why I Still Think It's Worth Having</h2><p><br></p><p>None of that makes a VPN pointless, it just means it's one layer rather than the whole wall. The privacy angle alone is worth it to me, I don't love the idea of my internet provider building a profile of every site I visit and potentially selling that browsing history on, and I've broken the habit of <a href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke" data-mce-href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke">connecting to public wifi without a second thought </a>enough times over the years to know how exposed that moment actually is. Add in being able to check something on a work trip abroad without every site treating me like I'm accessing it from a different country and blocking half of what I'd normally use, and it earns its place running quietly in the background of everything I do online, doing one job well rather than promising to do everything.</p><p><br></p><h2>The Free VPN Trap I'd Avoid</h2><p><br></p><p>If you're going to use one, I'd steer well away from free VPN apps, because a lot of them make their money the exact way you're trying to avoid, by logging and selling the browsing data you installed the app to hide in the first place, or by quietly bundling in software that has nothing to do with privacy at all. Slow speeds and constant server drop outs are the more obvious annoyance, the kind that makes people give up within a week, but the privacy trade off is the real cost, and it's a harder one to notice because there's no obvious symptom, just a company somewhere with a detailed record of everywhere you've been online. <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>is the one I've used for years and the one I actually recommend when people ask, because it's built around not keeping logs rather than needing to justify why it does, and it's been independently audited on that claim rather than just stating it.</p><p><br></p><figure id="figure-dn0vczxifmtinzduv"><img id="dn0vczxifmtinzduv" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman using a laptop in a coffee shop on public Wi-Fi, What a VPN Actually Protects You From, and What It Doesn't" src="https://cdn.durable.co/covers/39Q9hBBQ4sG4Th8bNtVZ4BzVDjXU8Evw7zaz5TKV76EDqP1JvlbicNL2jskqjiZ0.jpg" alt="Woman using a laptop in a coffee shop on public Wi-Fi, What a VPN Actually Protects You From, and What It Doesn't" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/39Q9hBBQ4sG4Th8bNtVZ4BzVDjXU8Evw7zaz5TKV76EDqP1JvlbicNL2jskqjiZ0.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Public Wifi Is Where the Real Risk Lives</h2><p>I get asked about VPNs most often in the context of public wifi, and for good reason. Open networks in cafes, airports, and hotels rarely have proper encryption, which means anyone with basic tools sitting nearby can potentially intercept what you're sending, including passwords and card details if you're not careful. It's the same environment where a well timed <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">phishing link </a>does the most damage, because people's guard tends to drop when they're just trying to check email between meetings. A VPN closes that gap by encrypting your traffic before it ever touches the shared network. I switch mine on automatically the moment my phone joins any network I don't fully trust, rather than remembering to do it after I'm already connected.</p><h2>It Stops Companies Building a Profile on You</h2><p>Your IP address says more about you than you'd think. Sites and advertisers use it to <a href="https://ico.org.uk/for-the-public/online/cookies/" target="_blank" rel="noopener" data-mce-href="https://ico.org.uk/for-the-public/online/cookies/">track your location</a>, link your activity across different services, and build a profile they can sell on or use to target you. A VPN masks your real IP address behind the VPN provider's own, which makes that kind of tracking far harder to pull off. It won't make you invisible online, but it takes away one of the easiest tools companies use to follow you around the internet. It's one of the simplest ways to make yourself a slightly harder, less profitable target without changing anything else about how you actually use the internet.</p><h2>Booking Hotels and Flights Without My Search History Working Against Me</h2><p>The first time someone explained that travel sites can adjust prices based on what they know about you, I assumed it was exaggerated. Then I compared a flight search on my own laptop against the same search run through a VPN with a different location, and watched the price for the identical seat change. Booking sites build a picture from your browsing history, your device, and sometimes your apparent location, and there's a real financial incentive for that picture to nudge the price upward if it looks like you're already committed to buying. Running a VPN before I start comparing anything travel-related means I'm searching with a cleaner slate each time, closer to what a first-time visitor would see rather than someone who's already shown they're keen. It's not guaranteed to save money on every search, but I've seen it make enough of a difference that I now treat it as a normal part of booking anything, the same way I'd compare a few sites before committing.</p><h2>Reaching UK Services That Think I've Left the Country</h2><p>This is the one that first made me take VPNs seriously as something practical rather than just a privacy tool. I was abroad and needed to check something on my banking app, and it flatly refused to let me in because my location no longer matched what it expected, treating a normal login from a new country as suspicious enough to lock me out entirely. Switching my VPN's location back to the UK solved it immediately, and I've since learned plenty of UK services behave the same way, some banking apps, some streaming platforms, some council or government portals, all built with the assumption that you'll only ever access them from home. It's a strange reason to need a VPN, but it's turned out to be one of the most common ones for me in practice, and it's the one that surprises other people most when I mention it, because they assume a VPN is purely about hiding rather than about simply being let back in.</p><h2>Keeping the Kids' Tablets Covered When We're Away From Home</h2><p>Our home network has settings I've configured carefully over time, but a hotel room or a rented cottage obviously doesn't come with any of that, and the kids still want their tablets working the same way they do at home. I run a VPN on their devices whenever we're travelling, not because I think every hotel network is actively hostile, but because I have no way of actually verifying that it isn't, and I'd rather not find out the hard way while we're away and I'm not paying close attention to what's loading on a five-year-old's screen. It's one less thing to actively monitor on a holiday, which matters more than it sounds like when you're also trying to actually be on holiday.</p><h2>How I Actually Use Mine Day to Day</h2><p><br></p><p>I don't treat it as something I switch on for sensitive moments and off the rest of the time, it just runs on every device I own, phone included, the same way I don't think twice about wearing a seatbelt for a five minute drive. I've written before about why I run a VPN on every device I own, and the short version is that the moment you have to remember to turn something on is the moment you'll eventually forget. It sits alongside a password manager and two factor authentication as one of the handful of things I'd genuinely call essential rather than optional, and it's covered along with the rest of what I actually use in my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>if you want the fuller list in one place. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>also has its own plain guidance on VPNs if you want a second opinion before deciding whether one's worth it for you.</p><p><br></p><p>Use a VPN, and use a properly paid, no logs one rather than a free option built on selling your data, but don't let it replace the other habits that actually catch the scams and mistakes it was never designed to stop.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What a VPN Actually Protects You From, and What It Doesn't

<h2>The Different Kinds of Two-Factor Authentication, and Which One I Actually Trust</h2><p>People hear "turn on two-factor authentication" so often that it's started to sound like one single thing you either do or don't do. It isn't. There are several genuinely different ways to add that second step, they don't offer the same level of protection, and which one you end up with matters more than whether you've technically switched it on at all. I've used most of them myself at one point or another, and I've settled on a clear order of preference that I now recommend to almost everyone I talk to. If you haven't set it up yet, my <a href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients" data-mce-href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients">step-by-step guide to setting up two-factor authentication</a> walks you through it.</p><p><br></p><h2>Why I Don't Treat All Two-Factor Methods as Equal</h2><p><br></p><p>The whole point of two-factor authentication is that a stolen password alone shouldn't be enough to get into your account. But that second step can be intercepted, tricked, or bypassed depending on how it's built, and the gap between the strongest and weakest options is bigger than most people realise. Someone who's added a text message code to their accounts has done something genuinely worthwhile compared to a password on its own, but they haven't done the same thing as someone using an authenticator app or a hardware key, even though both would tick the same "2FA enabled" box on a settings page. I'd rather people understood the difference than assumed all forms of it are interchangeable.</p><p><br></p><h2>Text Message Codes: Better Than Nothing, But I'd Skip Them If I Could</h2><p><br></p><p>SMS codes are the most common form of two-factor authentication because they're the easiest to set up and need nothing extra installed, and for a long time they were treated as the gold standard. The problem is a technique called SIM swapping, where a scammer convinces your mobile provider to move your number onto a SIM card they control, after which every code meant for you lands with them instead. It's not a common event, but it's not a theoretical one either, and it specifically targets the exact accounts most worth protecting, banking and email among them. I still think SMS codes beat having no second factor at all, so I'd never talk someone out of using them if it's genuinely the only option in front of them, but I always mention there's something better if the account matters.</p><p><br></p><h2>Why Authenticator Apps Are My Default Recommendation</h2><p><br></p><p>An authenticator app generates a fresh code every thirty seconds directly on your phone, without that code ever travelling over the mobile network where it could be intercepted or redirected. That one difference removes the SIM swapping risk entirely, and it's why apps like this have become my standard recommendation for anyone asking where to start. Setting one up usually takes a couple of minutes, a quick scan of a QR code on the account's security settings page, and from then on the app just quietly generates what you need each time you log in. It works offline too, which surprises people the first time their phone has no signal and the code still appears without any trouble.</p><p><br></p><h2>Where Hardware Keys and Passkeys Actually Earn Their Place</h2><p><br></p><p>A small physical hardware key, the kind you plug into a USB port or tap against your phone, is about as close to unphishable as this category gets, because there's no code being displayed or typed anywhere for a scammer to trick you into handing over. Passkeys, the newer option built into most phones and browsers now, work on a similar principle using your fingerprint or face instead of a password at all. I don't think either of these is essential for most personal accounts, but for anything genuinely high value, the account tied to a business, or an email account that everything else can be reset through, I'd actively recommend moving up to one of these rather than stopping at an authenticator app. It's a bit more setup for a noticeably stronger result.</p><figure id="figure-7fsx33za0hmtin4mfs"><img id="7fsx33za0hmtin4mfs" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Hands typing a password on a laptop keyboard, The Kinds of Two-Factor Authentication and Which I Trust" src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" alt="Hands typing a password on a laptop keyboard, The Kinds of Two-Factor Authentication and Which I Trust" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>The One Thing I Tell Everyone Before They Turn Any of This On</h2><p><br></p><p>Whichever method you choose, the step people skip is saving the backup codes that get generated during setup, and it's the step that causes the most panic later. Lose the phone your authenticator app lived on without those codes saved somewhere safe, and you can end up locked out of your own account with no quick way back in. I keep mine stored inside a password manager rather than as a screenshot or a note on the same phone that might get lost alongside them, which keeps them accessible to me and nowhere useful to anyone else. It's a five minute step that people only regret skipping once, and by then it's too late to matter.</p><p><br></p><p>None of this needs to be complicated, and you don't need to fix every account at once. Start with whichever one would hurt the most if someone got into it, usually your email account since so much else can be reset through it, move it up to an authenticator app if it's still sitting on text message codes, and save the backup codes properly while you're there. I've written more on why I treat <a href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other" data-mce-href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other">my own email login </a>as the one that gets the most protection of all, and the <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">excuses I used to make </a>before I actually got round to doing any of this. If you want a password manager that makes storing backup codes and everything else this involves genuinely simple, <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>is the one I recommend, I've covered the fuller picture in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>if you want it all in one place, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on two-factor authentication if you want a second source to check mine against.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Kinds of Two-Factor Authentication and Which I Trust

<p><strong>The short answer:</strong> the best antivirus software in the UK is the one that scores consistently well in independent tests from AV-Test and AV-Comparatives, stays light on your device, and covers what you actually need. For most Windows users, the built-in Microsoft Defender is a sound free starting point. If you want ransomware protection, scam-site blocking and useful extras in one bundle, Bitdefender is the one I use on my own devices.</p><h2>How I Actually Compare Antivirus Software Before Recommending One</h2><p>People ask me which antivirus is best more often than almost anything else I get asked, and my honest answer usually disappoints them slightly, because there isn't a single one. What actually works best depends on the device you're protecting, how you use it, and what you're already running alongside it. What I can give instead is the process I actually use to compare products, the same one whether I'm choosing for myself or advising someone else, and it looks nothing like scrolling a list of names and picking whichever one has the flashiest badge on the box.</p><p><br></p><h2>Why I Don't Just Recommend One Antivirus to Everyone</h2><p><br></p><p>The honest reason I resist giving a single answer is that the right choice genuinely changes depending on who's asking. Someone running an older laptop that already struggles to keep up needs something lightweight far more than they need the product with the most features. A household with kids needs parental controls that a single professional living alone has no use for. Someone who already pays for a VPN and a password manager separately doesn't need a bundled suite duplicating tools they've already sorted, while someone starting from nothing might genuinely benefit from getting everything in one place. Treating antivirus as a single ranked list, with one winner everyone should install, ignores all of that, and it's part of why so much of the advice out there feels generic even when it's technically accurate.</p><p><br></p><h2>The Test Results I Actually Trust Over Marketing Claims</h2><p><br></p><p>Every antivirus company claims to catch nearly everything, and on their own marketing pages that claim is basically meaningless, since nobody's going to publish a number that makes them look bad. What I actually look at instead is independent lab testing, specifically the ongoing results from AV-Test and AV-Comparatives, which run the same products through repeated real-world detection tests every few months rather than accepting a vendor's own figures. What I care about isn't just the headline detection percentage, since most serious products now cluster close together there. It's the false positive rate, how often something legitimate gets flagged or blocked, because a product that's overly aggressive causes its own kind of disruption, and it's consistency across multiple testing rounds rather than one standout result, since a single good month doesn't tell me much about how a product performs over time.</p><p><br></p><h2>What System Impact Actually Feels Like Day to Day</h2><p><br></p><p>This is the part that gets ignored in most comparisons and is honestly one of the biggest reasons people abandon security software entirely. A product that scores brilliantly on detection but grinds a laptop to a crawl during a background scan doesn't stay installed for long, because people switch it off the first time it slows down something they're trying to do, and an antivirus that's been switched off protects nobody. I look specifically at the independent performance scores the same testing labs publish alongside detection results, covering things like how much a scan slows down everyday tasks, file copying, launching applications, browsing, rather than just trusting a vendor's claim of being "lightweight." A product that's genuinely fast and quiet in the background is one people actually keep running, which matters more than a marginally higher detection score on paper.</p><p><br></p><h2>The Extra Features That Actually Change My Recommendation</h2><p><br></p><p>Beyond the core scanning engine, the bundled extras are where products start to genuinely differ from each other, and where the right choice depends heavily on what you already have. Ransomware-specific protection, which watches for the exact behaviour pattern of files being encrypted in bulk rather than relying on signature detection alone, is one I now treat as close to essential rather than a nice extra. A bundled VPN is useful if you don't already run one, though I'd note <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">I already run a VPN on every device I own </a>separately, so for me it's not the deciding factor it might be for someone starting from scratch. <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender </a>is <a href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender" data-mce-href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender">the one I've ended up using on my own devices</a>, largely because the bundle covers ransomware protection, a genuinely light system footprint, and the extras I actually use without needing three separate subscriptions doing overlapping jobs.</p><figure id="figure-cb74p4obyemtdy00nb"><img id="cb74p4obyemtdy00nb" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, Best Antivirus Software UK: How I Actually Compare It" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Best Antivirus Software UK: How I Actually Compare It" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Free Versus Paid, and When Free Is Actually Enough</h2><p><br></p><p>I don't think everyone needs to pay for antivirus, and I'd rather say that honestly than pretend otherwise for the sake of a recommendation. Windows Defender, built into every current version of Windows, has genuinely closed the gap with paid products over the last few years and performs respectably in the same independent tests I mentioned earlier. For a well-maintained device with sensible browsing habits and updates installed promptly, it's a reasonable baseline on its own. Where I'd still recommend paying is for the extra layers, dedicated ransomware behaviour monitoring, better phishing and scam-site blocking, and the bundled extras that remove the need to manage several separate tools, especially for a household or a small business where one person can't realistically watch every device individually.</p><p><br></p><h2>What About Phones, Macs and Tablets?</h2><p>Most comparisons only talk about Windows laptops, but that's not where most people spend their time online any more. On an Android phone, Google Play Protect scans apps in the background, and a good security app adds scam-site and text filtering on top, which is worth having if you tap links from messages. iPhones work differently. Apple doesn't let apps scan each other, so iPhone "antivirus" apps are really web and scam filters rather than virus scanners, and keeping iOS updated does most of the heavy lifting. Macs have built-in protection too, but Mac malware does exist, and if you download a lot from outside the App Store a paid product is a reasonable extra layer. Most paid bundles now cover phones, tablets and computers on one subscription, which is usually better value than buying for each device separately.</p><h2>Antivirus Questions I Get Asked</h2><h3>Is Microsoft Defender good enough on its own?</h3><p>For a lot of people, yes. It performs respectably in independent testing and it's already built into Windows. I'd pay for something extra if you want stronger ransomware and scam-site protection, or you're looking after a whole household or a small business.</p><h3>Do I need antivirus on my phone?</h3><p>On Android, a security app is worth considering, mainly for blocking scam links and dodgy apps. On an iPhone, keeping the software updated and being careful with links matters far more than any app you can install.</p><h3>Can I run two antivirus programs at once?</h3><p>No, and you shouldn't try. Two products scanning the same files tend to clash, slow everything down and sometimes block each other. When you install a paid antivirus on Windows, Defender steps back automatically, which is how it should work.</p><h3>Is free antivirus safe?</h3><p>Free versions from well-known names that appear in independent test results are fine. What isn't safe is a pop-up telling you your device is infected and offering a free scan. That's a scam in itself, so close the page and don't download anything from it.</p><h3>Which antivirus do you actually use?</h3><p>Bitdefender, for the reasons above. I've written up <a href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender" data-mce-href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender">why I trust Bitdefender</a> in a separate post if you want the full picture.</p><p>None of this is complicated once you know what to actually look for, and it's a lot less work than reading ten separate reviews trying to guess which one is being honest. I'd rather someone picked a product that matches how they actually use their devices than the one that happened to top a list this month. If you want the fuller version of what I check before recommending anything to a client, I've put it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on the basics of keeping a device protected if you want a second source to weigh mine against.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Best Antivirus Software UK: How I Actually Compare It

<h2>How I Decide Whether to Trust a New Online Shop Before I Buy</h2><p>I buy from stores I've never heard of more often than I used to, mostly because social media ads and search results keep putting them in front of me. Some of them are genuinely good, small independent shops with better prices or products I can't find anywhere else. Some of them are set up to take a payment and disappear. The problem is that on the surface, both types can look almost identical, same polished template, same stock photography, same convincing product descriptions. Over the years I've settled into a fairly consistent process for deciding which is which before I hand over any card details, and it's saved me from a bad purchase more than once.</p><p><br></p><h2>Why New Stores Get More Scrutiny From Me Than Familiar Ones</h2><p><br></p><p>I don't run the same checks on a retailer I've used for years that I run on one I found through an ad this morning. That's not inconsistency, it's proportionate. A store with a track record has already demonstrated it ships what it sells and handles returns properly, so the risk of a first purchase there is genuinely lower. A brand new store, especially one I found through a paid ad rather than a search or a recommendation, hasn't demonstrated anything yet. It might be completely legitimate, plenty of good small businesses start exactly this way, but I treat the first purchase as a trust-building exercise rather than something I do on autopilot, and that changes how carefully I look at everything else on this list.</p><p><br></p><h2>The Company Details I Check First</h2><p><br></p><p>Before I add anything to a cart on a site I don't recognise, I look for the basics that a genuine business almost always has and a scam site often skips or fakes. A proper contact page with a real address, not just a contact form, is one of the first things I check. A company registration number, particularly for anything based in the UK, is another, since that's traceable if something goes wrong. I also check how long the site has actually existed, since a domain registered a few weeks ago selling what looks like an established brand's products is a pattern I've learned to take seriously. None of these checks take more than a couple of minutes, and none of them are foolproof on their own, but a site that fails several of them at once tells me enough to walk away before I've spent anything.</p><p><br></p><h2>What the Reviews Actually Tell Me, and What They Don't</h2><p><br></p><p>Reviews on the store's own website are close to useless as a trust signal, since nothing stops a site from only publishing the good ones or fabricating them entirely. What I actually look for is evidence from somewhere the store doesn't control, an independent review platform, a mention on a forum, someone discussing the brand on social media outside of the store's own posts. A complete absence of any independent trace for a store that claims to be established is itself a signal worth paying attention to. I also read a handful of the negative reviews specifically, not to be put off by every complaint, every retailer gets some, but because the pattern of complaints tells me something the star rating alone doesn't. Slow delivery and an unhelpful returns process is a normal retailer having an off month. Multiple people saying they paid and never received anything is a different category of problem entirely, and it's the one I actually walk away from.</p><figure id="figure-v5oy0jwblfmtdf4say"><img id="v5oy0jwblfmtdf4say" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, How I Decide Whether to Trust a New Online Shop" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, How I Decide Whether to Trust a New Online Shop" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>How I Pay Differently Depending on How Much I Trust the Site</h2><p><br></p><p>This is the part of my process that's changed the most over time. For a store I trust completely, an established retailer with years of history, how I pay barely matters. For a new or unverified store, it matters a lot, because the payment method is often the only real protection I have if something goes wrong. I use a credit card rather than a debit card for anything from a store I'm not fully confident in, since the legal protections on a credit card purchase are genuinely stronger if the goods never turn up. I avoid direct bank transfers entirely for anything from a business I haven't verified, since that removes almost every avenue for getting money back if things go wrong. None of this is about assuming the worst of every new store, it's about making sure that if I'm wrong about one, I'm not left with no way to recover the money. If I'm buying from anywhere I haven't fully verified while I'm out on public wifi, I'll run it through <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>first, since that's exactly the kind of unsecured connection where card details are most exposed in transit.</p><p><br></p><h2>What I Do When Something Still Feels Off</h2><p><br></p><p>Sometimes a store passes every individual check and I still hesitate, and I've learned to trust that hesitation rather than talk myself out of it because the checklist came back clean. When that happens, I'll usually do one more thing before buying, search the store's name alongside words like "scam" or "reviews" specifically, which surfaces complaints that don't always show up in a normal search. If I still can't find anything reassuring, I either wait, buy a small test item first rather than a large order, or find the same product from a retailer I already trust, even if it costs slightly more. I've stopped treating a good price as a reason to skip these checks. If anything, a price that's noticeably better than everywhere else selling the same thing is usually the reason to slow down and run through this process properly rather than the reason to buy quickly before it disappears.</p><p><br></p><p>None of these checks are complicated, and together they take less time than most people spend comparing prices across a few different sites anyway. What they've given me is a way to say yes to genuinely good new stores without also saying yes to the ones designed to take a payment and vanish, which is really the whole point. If you want the fuller version of what I check before buying from somewhere new, including <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">the checkout-specific red flags I look for </a>once I've already decided a store is worth trusting, I've put it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>has its own guidance on spotting fake online shops if you want a second source to weigh mine against.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Decide Whether to Trust a New Online Shop

<h2>The Online Safety Tips I Actually Think Matter, and the Ones I Don't</h2>
<p>Every few weeks someone sends me one of those lists, forty tips for staying safe online, and asks what I think of it. My honest answer is always some version of the same thing. A handful of the items genuinely matter. Most of it is filler added to hit a word count. And a few items are advice I actively disagree with, the kind that sounds responsible but doesn't actually protect anyone in practice. I've written enough of these posts myself and heard from enough people who tried to follow lists like that to have a fairly settled view on which tips earn their place and which ones I've quietly stopped repeating.</p>
<p>&nbsp;</p>
<h2>Why I Stopped Treating Every Tip the Same</h2>
<p>&nbsp;</p>
<p>The problem with most safety lists is that every item gets presented with equal weight. Use a strong password sits next to clear your browser history weekly as if the two carry the same importance, when one of those genuinely determines whether your accounts get compromised and the other does almost nothing measurable. When everything looks equally urgent, people either try to do all of it and burn out, or they read the whole list and do none of it because it feels like too much. I'd rather tell someone three things that actually matter than forty things where thirty-seven of them are noise dressed up as diligence. That's not the same argument as which order to do things in, it's a separate question: which of these are actually worth your time at all.</p>
<p>&nbsp;</p>
<h2>The Few I Think Genuinely Matter</h2>
<p>&nbsp;</p>
<p>If I'm being honest about what actually moves the needle, it's a short list. A password manager sits at the top, not close to anything else. I've written before about <a href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the short version is that it's the one change that fixes the single biggest weakness most people have without them ever noticing, reused or weak passwords sitting across dozens of accounts. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>specifically because it removes every excuse people have for putting it off. Two-factor authentication comes right after it, because a strong password still fails if it ever leaks somewhere you didn't expect, and 2FA is what catches that. Keeping your software updated rounds out the list, mostly because it closes doors that are already publicly known to be open. Everything else I'd call genuinely important is really just a variation on these three: they're the tips that survive contact with real accounts and real attackers, not just contact with a checklist.</p>
<p>&nbsp;</p>
<h2>The Ones I've Quietly Stopped Recommending</h2>
<p>&nbsp;</p>
<p>There's a second category I used to repeat and don't anymore, because I never saw it change an outcome for anyone. Changing your passwords every ninety days on a fixed schedule is one of them. It sounds disciplined, but in practice it just pushes people toward small predictable variations of the same password, which is worse than leaving a genuinely strong one alone once it's actually strong. Treating incognito or private browsing mode as a meaningful safety measure is another. It hides your history from the next person using your device, that's genuinely useful for that one purpose, but it does nothing against the actual threats people usually mean when they ask about staying safe, phishing, scams, account compromise. I've also gone quiet on blanket advice to avoid all public wifi entirely, memorising which networks are supposedly safe and which aren't. If you're already covering that risk properly elsewhere, treating every coffee shop network as a crisis is energy spent on a problem you've already solved, and it tends to make people paranoid about the wrong layer of the picture. None of these are dangerous pieces of advice exactly, they're just advice that costs someone's attention without buying them much in return, and attention is the one resource every list like this quietly assumes is unlimited. I'd rather someone spent that attention on the three things that actually work.</p>
<p>&nbsp;</p>
<h2>Where I Think the Real Risk Actually Sits</h2>
<p>&nbsp;</p>
<p>If I'm ranking what actually causes people harm, it's rarely a technical gap. It's a moment of being rushed, distracted, or caught off guard by something that looks convincing enough not to question. That's true of most scams I hear about, and it's exactly why I put more weight on <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the checks I use to catch AI-driven scams </a>than on most of the technical tips people ask me about. A voice that sounds right, a message that references something real, a sense of urgency, that's what actually gets people, far more often than a weak password or an unpatched app. The technical tips matter, I'm not walking that back, but they protect you from a different category of problem than the one that catches most people off guard.</p>
<figure id="figure-w40hszbtbimtdeieiy"><img id="w40hszbtbimtdeieiy" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Online Safety Tips I Think Matter, and Ones I Don't" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Online Safety Tips I Think Matter, and Ones I Don't" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false"></figure>
<p>&nbsp;</p>
<h2>What I'd Actually Tell Someone Starting Today</h2>
<p>&nbsp;</p>
<p>If someone asked me right now, today, for the version of this that actually matters, I'd give them three things and stop there. Get a password manager and let it generate and store everything properly. Turn on two-factor authentication, starting with email. And slow down for ten seconds before clicking anything that's trying to make you feel rushed, because that pause is worth more than most of the tips further down any list you'll find. Everything else on the usual lists is worth doing eventually, in its own time, but it's not what determines whether you're actually protected, and I'd rather be honest about that than hand someone forty items and let them assume each one carries equal weight. I've put the fuller version of what I think is worth prioritising into a <a href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener">NCSC </a>has its own guidance on the basics if you want to weigh my list against theirs.</p>
<p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener">Pinterest</a> too.</p>

The Online Safety Tips I Think Matter, and Ones I Don't

<h2>The Order I'd Actually Fix My Digital Security In, If I Started From Scratch</h2><p>A friend asked me recently where she should even begin with her online security. She'd read a few lists, felt overwhelmed by all of them at once, and ended up doing nothing at all for another six months. That's the real cost of a long checklist with no order to it. It's not that the advice is wrong, it's that when everything looks equally urgent, nothing actually gets done. So instead of giving her another list, I gave her an order, the same order I'd use if I were starting completely from scratch today.</p><p><br></p><h2>Why the Order Actually Matters Here</h2><p><br></p><p>Most security advice gets handed out as a flat list, turn on 2FA, use strong passwords, update your software, review your privacy settings, as if each item carries the same weight and can be tackled in any sequence. In practice, doing them out of order either wastes effort or leaves gaps that undo the whole point. Turning on two-factor authentication before sorting out weak, reused passwords protects the login step but does nothing for the password itself sitting exposed in a dozen other places. Reviewing privacy settings on social media before locking down your actual accounts is tidying the curtains while the front door's still open. The order isn't a small detail, it's most of what makes the difference between an afternoon that actually protects you and an afternoon that just feels productive.</p><p><br></p><h2>Start With a Password Manager, Not Individual Passwords</h2><p><br></p><p>This is where I'd always begin, and it's not close. Every other step on this list either depends on it or works better because of it. I've written before about <a href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the short version is that trying to fix passwords one at a time, changing the obvious weak ones while leaving the rest, never actually gets finished. A password manager lets you fix all of them properly in one sitting, generating a long, unique password for every account and remembering it so you never have to. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>for this specifically because setting it up takes minutes, not a weekend, which matters when the whole point is removing excuses to put it off. Nothing else on this list is worth doing until this one's in place, because everything after it either builds on strong unique passwords or gets undermined by their absence.</p><p><br></p><h2>Then Two-Factor Authentication, Starting With Email</h2><p><br></p><p>Once passwords are sorted, this is next, and I'd resist the urge to switch it on everywhere at once. I'd start with email specifically, because a compromised email account is usually the fastest route into everything else you own, password resets, other logins, personal documents sitting in old messages. I've been through the excuses people make here myself, I used to make most of them, telling myself it would take too long or that my password was already strong enough on its own, and none of them held up once I actually sat down and did it. From email, I'd work outward to banking, then anywhere financial details are stored, then anything else that matters, rather than trying to do all of it in one sitting and losing momentum halfway through. Most services only ask for that second step occasionally rather than on every single login, so the ongoing cost turns out to be almost nothing once it's set up, even though it feels like it'll be a constant hassle beforehand. Twenty minutes on the accounts that matter most beats an afternoon that never gets finished because it felt too big to start.</p><p><br></p><h2>After That, the Software Updates I Used to Click Away</h2><p><br></p><p>This is the step I used to skip for the longest, mostly because update prompts always seem to land at the worst possible moment, usually right as I'm trying to actually use the device for something. What changed my mind wasn't a lecture about security patches, it was realising how many serious breaches trace back to a vulnerability that had already been fixed months earlier, publicly documented and everything, just never installed on the device that got hit. The people writing the fix had already done their part. I turn on automatic updates wherever the option exists now, for my operating system, my browser, and anything handling passwords or payments specifically, rather than relying on myself to remember to check manually. It's the least interesting step on this list and also one of the most effective, precisely because it closes doors that are already publicly known to be open rather than guarding against something theoretical that might happen eventually.</p><figure id="figure-49fyj025h8lmtddbtg6"><img id="49fyj025h8lmtddbtg6" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, Fixing Digital Security From Scratch, in Order" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, Fixing Digital Security From Scratch, in Order" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Only Then Do I Worry About the Smaller Stuff</h2><p><br></p><p>Everything past this point matters, but it matters less urgently than the first three, which is exactly why it goes last rather than first. This is where I'd review old accounts I've forgotten I even have, since an account I haven't logged into in three years is still a live target if it still holds my details. It's also where I'd go through privacy settings on social media properly rather than skimming past them, since I've written before about <a href="https://kellssecurity.com/blog/why-i-stopped-oversharing-on-social-media" data-mce-href="https://kellssecurity.com/blog/why-i-stopped-oversharing-on-social-media">why I stopped oversharing </a>there in the first place. None of this is wasted effort, but doing it before the first three steps is solving a smaller problem while a bigger one sits untouched.</p><p><br></p><p>I'd rather someone did the first two properly and never got to the rest than tried to do everything at once and burned out after an hour. If you want the fuller version of what I'd actually walk through account by account, I've put it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on the basics if you want a second source to check any of this against before you start.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Fixing Digital Security From Scratch, in Order

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.