Blog

<h2>The Cyber Threats I Find Hiding in Places Nobody Checks</h2><p>Most of the online safety advice I give people is about the obvious stuff, the emails, the texts, the checkout pages. But some of the biggest risks I find when I actually sit down and audit someone's setup aren't in their inbox at all. They're sitting quietly in places nobody thinks to check, a router nobody's logged into in years, a smart device nobody remembers connecting, a browser extension installed for a five minute task and never removed. None of these announce themselves the way a scam text does. They just sit there, working exactly as intended, until they're not. Here are the five places I check first, and why each one matters more than it looks.</p><p><br></p><h2>The Router Sitting There With Firmware From Two Years Ago</h2><p><br></p><p>Your router is the single device every other device in your home connects through, and it's also the one nearly everyone forgets exists once it's plugged in and working. Manufacturers regularly release firmware updates that patch genuine security holes, but unlike your phone or laptop, a router rarely nags you to install them. I make a point of logging into mine every few months through its admin page and checking for a firmware update, and I've been surprised more than once by how long it had been sitting on an outdated version. I also check that the admin password isn't still the default one printed on the sticker underneath the router, because that single unchanged password is one of the more common ways an outside device ends up quietly attached to a home network without anyone noticing.</p><p><br></p><figure id="figure-sovx9bqd5cmtiv777h"><img id="sovx9bqd5cmtiv777h" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Woman reading online safety advice on her laptop, The Cyber Threats I Find Hiding in Places Nobody Checks" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Cyber Threats I Find Hiding in Places Nobody Checks" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>The Smart Devices I Forgot I Even Set Up</h2><p><br></p><p>I did an audit of my own home network recently and found a smart plug I'd set up over a year ago for a lamp that had since been given away, still connected, still receiving whatever updates its manufacturer bothered to push, if any. Every smart device on your network, a doorbell camera, a speaker, a thermostat, a plug, is a small computer with its own software, and cheaper ones often stop receiving security updates well before you'd think to replace them. I now do a proper walk through of my router's connected devices list every so often and ask myself honestly whether I still know what each one is and whether I still use it. Anything I don't recognise or don't need gets removed from the network entirely, not just switched off.</p><p><br></p><h2>The Browser Extensions I Installed Once and Never Looked At Again</h2><p><br></p><p>I'm as guilty of this as anyone. A browser extension gets installed for one specific task, a PDF converter, a coupon finder, a screenshot tool, and then it just stays there indefinitely, quietly running with whatever permissions it asked for when you installed it. Extensions can read and sometimes modify every page you visit depending on what you granted them, and ownership of a popular extension can change hands without most users ever noticing, sometimes to less scrupulous hands than the original developer. I go through my browser's extensions list every few months now and remove anything I can't immediately explain the purpose of. If I genuinely need it again later, reinstalling takes thirty seconds, which is a small price for not carrying around software I've stopped paying attention to. I run the same VPN, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a>, across the devices where I do this kind of cleanup, mainly because it makes me stop and think about what's actually connecting to what on my network in the first place.</p><p><br></p><h2>The Old Accounts I Never Actually Closed</h2><p><br></p><p>Every account you've ever created and stopped using is still sitting somewhere with your email address, and quite possibly an old password, attached to it. I used to think an account I'd abandoned couldn't really hurt me since I wasn't using it anymore, but that's backwards, an inactive account you've forgotten still gets caught up in data breaches the same as an active one, and if you reused a password anywhere, that breach becomes a problem for accounts you do still care about. I've started keeping a running list in my password manager of services I've genuinely finished with, and closing them properly rather than just walking away, which is also part of what actually pushed me toward using <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">a proper password manager </a>instead of trying to remember which passwords I'd recycled where.</p><p><br></p><h2>The One Network I Finally Split In Two</h2><p><br></p><p>This is the change that made the biggest practical difference for me. Most home routers let you set up a separate guest network, and for a long time I never bothered, reasoning that everyone connecting was someone I trusted anyway. The problem isn't trust, it's that every device on the same network can, in principle, see and interact with every other device on it, which means a smart device with weak security sitting on the same network as your laptop and your banking app isn't actually isolated from either. I set up a separate guest network specifically for smart home devices and visitors, keeping my own laptop and phone on the main one, and it took about ten minutes to configure. It's the kind of change that costs nothing and quietly closes off a path I'd genuinely never thought about before.</p><p><br></p><p>None of these five things are dramatic on their own, and none of them will show up as a scam warning or a suspicious email. That's exactly why they're worth checking. An outdated router, a forgotten smart plug, a browser extension nobody's looked at in years, an old account still sitting there with your details attached, and one network doing the job of two, that's the audit I'd actually recommend running through your own home once, and then again every few months after. It's also worth knowing what a <a href="https://kellssecurity.com/blog/the-vpn-myths-i-keep-having-to-correct" data-mce-href="https://kellssecurity.com/blog/the-vpn-myths-i-keep-having-to-correct">VPN </a>does and doesn't cover here, since I still correct people who assume it handles gaps that only a firmware update or a proper account clear-out actually closes. If you want a second source alongside mine, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on securing your home network and devices, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to work through your wider setup properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Cyber Threats I Find Hiding in Places Nobody Checks

<h2>The Five Online Shopping Habits I Tell Every Beginner to Start With</h2><p>When someone new to online shopping asks me where to start, I don't lead with the longer scam-spotting checklist I've built up over years of doing this. I give them five habits instead, each one taking about five minutes to set up once, and together they quietly protect almost everything else you do online afterwards. These are the habits I'd want in place before I bought a single thing online, and they're still the ones I lean on every time I shop, years later.</p><p><br></p><h2>Using a Credit Card Instead of a Debit Card</h2><p><br></p><p>This is the first thing I tell anyone starting out, and it's the one habit that costs nothing and pays off the most when something actually goes wrong. In the UK, a credit card purchase between £100 and £30,000 gives you Section 75 protection, meaning your card provider is jointly liable with the retailer if the goods never arrive, arrive faulty, or the company goes bust before delivering. A debit card doesn't carry that same legal protection, only a weaker voluntary chargeback scheme that banks aren't obliged to honour in the same way. I keep one credit card specifically for online purchases for this reason alone, and I'd genuinely rather pay it off in full each month than shop with a debit card for anything over a token amount.</p><p><br></p><h2>Checking for the Padlock and "https" Before Typing Anything</h2><p><br></p><p>This one takes about two seconds and I do it out of habit now without even thinking. Before I type a single character into a payment or login form, I glance at the address bar for the small padlock icon and confirm the address starts with "https" rather than just "http". That extra "s" means the connection between your device and the site is encrypted, so anything you type can't be easily intercepted by someone else on the same network. I want to be clear that this doesn't prove a site is legitimate, plenty of convincing scam sites now have a padlock too, but the absence of one is a hard stop for me regardless of how good the deal looks. It's a two-second check that costs nothing and occasionally saves you from something much more costly.</p><p><br></p><h2>Saving Every Confirmation Email Until the Item Actually Arrives</h2><p><br></p><p>I used to delete order confirmation emails the moment I got them, treating my inbox like something to keep tidy rather than something to keep evidence in. I don't do that anymore. I keep every confirmation, dispatch notice, and delivery update until whatever I ordered has actually turned up and I've checked it's what I paid for. If something goes wrong, a missing parcel, a faulty item, a charge that doesn't match what I agreed to, that email trail is exactly what you need to raise a dispute with the retailer or your card provider, and trying to reconstruct it from memory after the fact is far harder than just not deleting it in the first place. I've started a folder specifically for this, and it takes seconds to file each email as it comes in.</p><p><br></p><h2>Reading the Return Policy Before Adding Anything to the Basket</h2><p><br></p><p>I used to only look at a return policy after something had gone wrong, which is exactly the wrong order to do it in. Now I check it before I buy, not after, because by the time you're trying to return something, you've already lost most of your leverage to walk away. A legitimate shop makes its returns and refund terms easy to find and genuinely worded, with a clear timeframe and a real process. A shop that buries this information, states it vaguely, or doesn't mention it at all is telling you something about how it plans to treat you after it's already got your money. I treat an unclear or missing returns policy as close to a hard stop on a purchase from anywhere I haven't used before, the same way I'd treat a missing padlock.</p><p><br></p><figure id="figure-25vjphy6cmtiu3utp"><img id="25vjphy6cmtiu3utp" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, Five Online Shopping Habits for Every Beginner" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Five Online Shopping Habits for Every Beginner" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Starting Small With Any Shop I Haven't Used Before</h2><p><br></p><p>This is the habit that's saved me the most money over time, and it's simpler than it sounds. The first time I buy from a shop I don't already know and trust, I keep the order small and low-risk rather than going straight in with a big purchase, even if the larger item is what I actually want. If the smaller order arrives as described, on time, and matches what was promised, that's a real data point about whether the shop is legitimate, not just a guess based on how professional the website looks. If it doesn't arrive, or arrives wrong, I've lost a small amount rather than a large one, and I've learned something important before it cost me much more. This habit pairs directly with the <a href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop" data-mce-href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop">deeper checks I run </a>on a new shop before trusting it with anything sizeable, which is a topic I've gone into properly elsewhere, but starting small is the version of that vetting process anyone can do without any extra research at all.</p><p><br></p><p>None of these five habits take long to build, and none of them require you to become an expert in spotting scams before you feel safe buying anything online. A credit card for real purchases, a two-second padlock check, a habit of keeping your confirmation emails, reading the returns policy before you buy rather than after, and starting small with anywhere new, that's the foundation I'd want anyone to have in place before everything else. Once those habits are automatic, spotting something that looks <a href="https://kellssecurity.com/blog/the-signs-i-look-for-before-trusting-any-too-good-to-be-true-online-deal" data-mce-href="https://kellssecurity.com/blog/the-signs-i-look-for-before-trusting-any-too-good-to-be-true-online-deal">too good to be true </a>gets a lot easier too, because you're already in the habit of pausing rather than clicking straight through. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>to keep my own browsing a little harder to profile while I'm comparing shops and deals, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd actually recommend if you want to build on these basics properly, while <a href="https://www.takefive-stopfraud.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.takefive-stopfraud.org.uk/">Take Five to Stop Fraud </a>has its own guidance on safe online payments if you want a second source alongside mine.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Five Online Shopping Habits for Every Beginner

<h2>The Signs I Look For Before Trusting Any "Too Good to Be True" Online Deal</h2><p>Seasonal sales bring out the best discounts of the year, and they also bring out the most convincing fake ones. I've learned to enjoy a genuine bargain without falling for the ones built specifically to look like one, and it comes down to checking a handful of specific things before I <a href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop" data-mce-href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop">trust a deal </a>enough to enter my card details. These are the five signals I actually look for, in the order I check them.</p><h2>A Discount That's Too Big for the Brand to Actually Offer</h2><p>Every retailer has a rough ceiling on how deep a genuine discount goes, and most established brands rarely go far past forty or fifty percent off even during their biggest sale events. When I see a well known brand offering seventy or eighty percent off across an entire range, that's usually the first sign something's off, because that kind of margin genuinely doesn't make sense for a legitimate business to sustain. Scam sites lean on this specifically because an outrageous discount is what gets a listing shared and clicked in the first place. I check what a brand's actual typical sale range looks like before assuming a huge number means a huge bargain, and I'm far more sceptical of a "found it cheap somewhere random" listing than one from a retailer's own verified site or app. If a search for the exact product name turns up dozens of near-identical ads all claiming the same implausible discount from different unfamiliar sellers, that pattern alone tells me more than any single listing could on its own.</p><h2>A Countdown Timer That Resets Every Time I Refresh</h2><p>Urgency is one of the oldest tricks in the book, and countdown timers are its most obvious modern form. A genuine flash sale does end, and the timer reflects that honestly. A fake one is often coded to simply reset itself whenever the page reloads, which is easy to test and immediately telling if you catch it. I've refreshed a page specifically to check this more than once, and finding the same "6 minutes left" message twice in a row is close to a guarantee that the urgency is manufactured rather than real. Genuine time pressure from a real retailer doesn't need to be checked this way because it doesn't behave inconsistently when you look at it twice.</p><h2>A Checkout Page on a Domain That Doesn't Match the Brand</h2><p>This is the check I never skip, no matter how convincing everything else looks. I glance at the actual URL in the address bar right before I enter any payment details, specifically checking that the domain matches the brand I think I'm buying from rather than some unrelated string of letters that redirected me there through an ad. Scam operations frequently run ads for a real, trusted brand name but land you on a completely different site once you click through, counting on most people not looking that closely at a small address bar while they're focused on the product photos. If the domain doesn't match, I close the tab immediately regardless of how good the deal looked, because nothing about the rest of the page matters if the checkout itself isn't legitimate.</p><figure id="figure-75ffnmy6vmtitd8b8"><img id="75ffnmy6vmtitd8b8" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, The Signs of a Too Good to Be True Online Deal" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, The Signs of a Too Good to Be True Online Deal" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Payment Options That Skip My Card Provider's Protection</h2><p>A legitimate online shop wants your business enough to offer standard, protected payment methods, because that's simply how normal ecommerce works. When a site pushes hard toward bank transfer, a payment app with no buyer protection, or an unfamiliar third-party processor as the only option, that's a direct signal the seller specifically wants to avoid the kind of dispute process that would let you get your money back. I treat "card payments aren't available right now" as close to a hard stop on a purchase I'm not already confident about, because that one detail removes almost all my recourse if the item never turns up or isn't what was advertised. A genuine retailer having a temporary card processing issue is rare enough that I'd rather wait or shop elsewhere than take the risk, and I'm particularly wary when a seller offers a small extra discount specifically for paying by bank transfer instead of card, since that incentive only makes sense if avoiding your protection is the actual goal.</p><h2>Reviews That Only Ever Mention the Price</h2><p>I've started reading reviews specifically for what they don't say rather than just their star rating. Genuine product reviews usually mention something concrete about the item itself, how it fits, how it performed, whether delivery matched what was promised, whereas a wall of five-star reviews that only ever say some version of "amazing price, so cheap" without any product detail reads very differently once you notice the pattern. That kind of review is easy to generate in bulk and cheap to post, and it tells you nothing about whether the product actually exists or works as described. A handful of specific, checkable details in the reviews reassures me far more than a large volume of vague praise ever does.</p><p>None of these checks take more than a few seconds once they're a habit, and together they catch almost every fake deal I come across during the <a href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery">busiest shopping periods </a>of the year. A discount that's realistic for the brand, a countdown that behaves honestly, a checkout domain that actually matches, payment options that keep your protection intact, and reviews with real detail in them, that's most of what separates a genuine bargain from a convincing fake one. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>to keep my browsing a little harder to profile while I'm comparing deals across different sites, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd actually recommend if you want to work through your wider online shopping safety properly, while <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>has its own guidance on shopping scams if you want a second source alongside mine.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Signs of a Too Good to Be True Online Deal

<h2>The VPN Myths I Keep Having to Correct</h2><p>VPNs get talked about more than almost any other privacy tool, and a lot of what gets repeated about them is either outdated or was never quite true in the first place. I hear the same handful of misconceptions from people who are otherwise pretty switched on about their online safety, usually because a VPN's marketing leans on whichever claim sounds most impressive rather than what's actually accurate. These are the five myths I correct most often, and what I'd tell you instead. For a side-by-side way of weighing providers up, see my guide on <a href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today">choosing the right VPN service</a>.</p><h2>A VPN Makes You Completely Anonymous Online</h2><p>This is the biggest one, and it's not really true. A VPN hides your IP address and encrypts your traffic between your device and the VPN server, which is genuinely useful, but it doesn't make you anonymous in any complete sense. Websites can still track you through cookies, browser fingerprinting, and account logins regardless of what a VPN is doing underneath. If you log into your usual email or social media account through a VPN, that service still knows exactly who you are, VPN or not, and any tracking scripts running on that page will still build up their usual picture of your visit. I think of a VPN as <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">hiding where your traffic is coming from </a>on the network level, not as an invisibility cloak for everything you do once you're connected to a site. Pairing it with basic browser privacy habits, blocking third-party cookies, being selective about what you stay logged into, gets you a lot closer to genuine privacy than the VPN alone ever will.</p><h2>Free VPNs Are Just as Good as Paid Ones</h2><p>I understand the appeal of not paying for something a paid alternative also offers, but the free VPN market has a genuine problem, and it's how these services make money if you're not the one paying. Some free providers log and sell browsing data to advertisers, which is close to the exact opposite of what someone downloads a VPN to avoid in the first place. Others limit bandwidth so heavily the service is barely usable, or inject their own ads into the pages you visit. I'm not saying every free VPN is doing something shady, but the incentive structure is worth being honest about before trusting one with your traffic, and a reputable paid provider with a clear, audited privacy policy is the safer default if you're using a VPN for anything that actually matters to you.</p><h2>A VPN Always Slows Your Connection Down Noticeably</h2><p>This used to be a much fairer criticism than it is now. Early VPN services genuinely did introduce a noticeable lag, largely because server networks were smaller and encryption overhead was heavier on older hardware. Modern VPN providers with large, well distributed server networks and current encryption protocols typically cost you a small, often unnoticeable percentage of your speed, especially if you're connecting to a nearby server rather than one on the other side of the world. I've had people avoid using a VPN entirely because of a slowdown they experienced years ago with a different provider, when the actual answer is usually to pick a closer server or switch providers rather than giving up on the idea altogether.</p><figure id="figure-o4ueklt2gqmtiss1dt"><img id="o4ueklt2gqmtiss1dt" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Traveller holding a passport while using a laptop, The VPN Myths I Keep Having to Correct" src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" alt="Traveller holding a passport while using a laptop, The VPN Myths I Keep Having to Correct" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>You Only Need a VPN for Something You Want to Hide</h2><p>This framing bothers me more than the others because it treats privacy as inherently suspicious, when actually the opposite is true. Using a VPN on <a href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke" data-mce-href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke">public wifi </a>at a cafe or airport isn't about hiding wrongdoing, it's about not broadcasting your banking session or email password to anyone else sharing that same unsecured network. I use one on public networks specifically because I don't know who else is on them or what they're capable of intercepting, and that's true whether I'm doing something mundane or something sensitive. Privacy and secrecy aren't the same thing, and treating every privacy tool as evidence of something to hide is exactly the framing that makes people skip basic protections they'd otherwise use without a second thought.</p><h2>Every VPN Provider's No-Logs Claim Means the Same Thing</h2><p>"No-logs" gets printed on nearly every VPN provider's homepage, but the term isn't standardised, and what one company means by it can be very different from what another does. Some providers genuinely keep no identifying records at all, and back that claim up with independent third-party audits you can actually read. Others technically don't log your browsing activity but still keep connection timestamps or bandwidth data that could be used to identify you under the right circumstances. I look specifically for a provider that's had its no-logs policy independently audited, rather than taking the claim on the strength of the marketing copy alone, because a policy nobody's verified is really just a promise. An audit doesn't guarantee a company will never change its practices later, but it's a meaningfully stronger signal than a claim with nothing behind it, and it's the first thing I check before recommending any provider.</p><p>None of these myths make VPNs less worth using, they just mean the reasoning behind using one is often slightly off. A VPN is a genuinely useful layer of protection, particularly on networks you don't control, but it's not invisibility, free options carry real trade-offs, modern speed costs are usually minor, using one isn't inherently suspicious, and not every no-logs claim has been checked by anyone but the company making it. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>because it's had its no-logs policy independently audited and I've never noticed a meaningful speed difference on the servers I connect to, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd actually recommend if you want to work through your setup properly, while the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on VPNs if you want a second source alongside mine.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The VPN Myths I Keep Having to Correct

<h2>The Online Safety Mistakes I See People Make Again and Again</h2><p>I've lost count of how many times I've heard some version of "I thought I was being careful" from someone who's just been caught out by a scam or a hack. Almost nobody who gets caught out is being reckless on purpose. It's usually one of a handful of small, forgivable habits repeating itself, the same few mistakes showing up again and again across completely different people. None of them are stupid mistakes. They're just the ones nobody ever sits you down and explains properly, so I want to walk through the five I see most often and what I'd actually do differently.</p><p><br></p><h2>Reusing the Same Password Everywhere</h2><p><br></p><p>This is the one I see most, and it's rarely one password for everything, it's more often one "good" password for the accounts someone thinks matter and a much weaker, reused one for everything else. The problem is that "everything else" usually includes some account you'd never think twice about, a forum you signed up to once, an old shopping site, a newsletter login, and any one of those getting breached hands over a password that might also unlock your email or your banking app. I don't try to remember dozens of unique passwords, because nobody can do that reliably and pretending otherwise is how the reused-password habit starts in the first place. A <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>generates and stores a different one for every single account, so the one that leaks in some random breach never opens a second door.</p><p><br></p><h2>Ignoring Software Updates Until They're Forced</h2><p><br></p><p>Everyone knows the "update available" notification, and almost everyone's instinct is to tap "remind me later" and get on with their day. I used to do exactly the same thing, right up until I actually understood what most updates are quietly fixing. A lot of them patch specific security holes that have already been found and are already being used against people who haven't updated yet, which means every day you put it off is a day that particular door stays open on your device. I've made peace with the ten minutes of mild inconvenience because the alternative is leaving a known gap unpatched for no real benefit. Turning on automatic updates where you can removes the decision entirely, which is honestly the easiest fix on this whole list.</p><p><br></p><h2>Trusting Caller ID and Screen Names</h2><p><br></p><p>I understand why people trust what's on their screen, it looks official, it says a real bank's name or a familiar area code, and there's no obvious reason to doubt it. The uncomfortable truth is that caller ID and sender names are trivially easy to fake, and scammers use exactly that trust deliberately, because a spoofed name does more of the persuading than anything they actually say. I've stopped treating a name on a screen as proof of anything at all. If a call or message claims to be my bank asking about my account, I hang up and call the number on the back of my card myself rather than continuing the conversation on their terms, and I'd genuinely encourage anyone to build that same habit before they need it.</p><p><br></p><figure id="figure-2i5x9cit3wmtiqp8ud"><img id="2i5x9cit3wmtiqp8ud" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Woman reading online safety advice on her laptop, The Online Safety Mistakes I See Again and Again" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Online Safety Mistakes I See Again and Again" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>Clicking Before Pausing When Something Feels Urgent</h2><p><br></p><p>Urgency is the ingredient almost every successful scam has in common, a suspended account, a missed delivery, a security alert, something that makes clicking through feel more important than checking first. I've caught myself <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">moving to click on pure instinct </a>more than once, and the only thing that's ever stopped me is a habit rather than any particular cleverness, a deliberate pause of a few seconds whenever something feels urgent enough that I want to act immediately. That feeling itself is the signal to slow down, not speed up, because genuine emergencies from real organisations essentially never depend on you clicking one specific link in the next five minutes. Waiting an extra minute to check costs nothing. Not waiting has cost people everything.</p><p><br></p><h2>Assuming a Locked Phone Means Nothing Else Matters</h2><p><br></p><p>A lot of people treat a phone's lock screen as the finish line for their security, once that's set, everything else feels like it's already covered. A locked screen stops someone picking your phone up and scrolling through it, but it does nothing at all against a phishing link you tap on yourself, an app permission you granted without reading it, or a password reused from some other account. I think of the lock screen as one layer among several rather than the whole wall, alongside <a href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication">two-factor authentication </a>on my important accounts and a password manager doing the parts my memory never could. Getting the lock screen set up is a good five minutes of effort. It's just not the whole job, however much it feels like it should be.</p><p><br></p><p>None of these five mistakes are about anyone being careless, they're just the habits that nobody ever properly walks you through, which is exactly why they keep repeating across so many different people. Unique passwords through a password manager, updates that actually get installed, healthy scepticism of anything a screen claims to be, a pause before clicking when something feels urgent, and treating your lock screen as one layer rather than the whole system, that's genuinely most of it. I use NordPass to handle the password side of this without relying on memory, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd actually recommend in one place if you want to work through it properly, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on the basics if you want a second source alongside mine.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Safety Mistakes I See Again and Again

<h2>The One Security Step I'd Tell a Complete Beginner to Start With</h2><p>People ask me this more than almost anything else, where do I actually start if I haven't done any of this before and the whole subject feels overwhelming. There's a long list of things worth doing eventually, but if someone's never touched any of it and I only get to recommend one thing, I always say the same thing, turn on two-factor authentication on your email account today. Not a password manager, not an antivirus product, not a VPN. Just that one thing, on that one account, before anything else.</p><p><br></p><h2>Why I Don't Start Beginners With a Password Manager</h2><p><br></p><p>It seems like the more obvious starting point, weak or reused passwords are such a common problem that fixing them feels like it should come first. But a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>is a bigger commitment for someone brand new to this, you're changing how you log into everything at once, learning a new piece of software, and moving dozens of accounts over in one go, and that's a lot to take on in one sitting if you're already feeling out of your depth. Two-factor authentication on a single account is a five minute job that doesn't ask you to change any habits yet, it just adds one extra step to a login you're already doing, and that smaller first win tends to be what actually gets people to keep going rather than giving up halfway through a bigger project. I've watched people abandon the whole idea of improving their security after getting overwhelmed trying to do everything on day one, and I'd rather see someone finish one small thing than start five big ones and finish none of them.</p><p><br></p><h2>What Two-Factor Actually Means, In Plain English</h2><p><br></p><p>I try to strip the jargon out of this completely when I'm explaining it to someone for the first time. Right now, getting into your account probably just means typing a password. Two-factor authentication adds a second check on top of that, usually a code that gets sent to your phone or generated by an app, so that a password alone isn't enough to get in anymore. Someone would need your password and your phone to break in, rather than just your password, and that second requirement is what stops the vast majority of account takeovers, because most of them rely on nothing more than a stolen or guessed password working on its own.</p><p><br></p><h2>The One Account I'd Tell You to Protect First</h2><p><br></p><p>Email gets my vote every time, and it's not close. Almost every other account you own, banking, shopping, social media, can be reset through your email address if someone forgets a password or wants to break in another way. That makes your email account the master key to everything else, and it's the one place where a compromise doesn't just cost you that one account, it potentially costs you all of them at once. If someone gets into your email, they don't need to guess your banking password, they just click "forgotten password" on your bank's login page and read the reset link straight out of your inbox. If you've got five minutes and one account to protect today, that's the one, and everything else can genuinely wait until another day.</p><p><br></p><h2>What Actually Happens When You Turn It On</h2><p><br></p><p>Most email providers walk you through this in their security settings, usually under a heading like "two-step verification" or "two-factor authentication." You'll be asked to add a phone number or set up an authenticator app, and from then on you'll see an extra prompt each time you log in from a new device. It feels like friction at first, an extra ten seconds you didn't have to spend before, but it becomes routine within a few days and you stop noticing it entirely. Most people I've walked through this tell me afterwards it took less time than they expected, and that the hardest part was simply deciding to start, not anything technical about the process itself. The one thing I always tell people to do at this stage is save the backup codes it offers you somewhere safe, because that's the part people skip and the part that causes real trouble later if you ever lose access to your phone.</p><p><br></p><figure id="figure-0eswsmaschmtiq3yh8"><img id="0eswsmaschmtiq3yh8" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Man working at a desk with online safety in mind, The One Security Step for a Complete Beginner" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, The One Security Step for a Complete Beginner" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>You Don't Need to Fix Everything Today</h2><p><br></p><p>This is the bit that seems to relieve people the most once I say it out loud. You don't need a password manager, an antivirus subscription, and a VPN all sorted by tomorrow, and trying to do all of it at once is usually why people give up before finishing any of it. Get email protected first, then move on to whatever feels most urgent whenever you're ready, next week, next month, it genuinely doesn't matter as long as it happens eventually. Security isn't a single afternoon of effort, it's a handful of small habits built up gradually, and the beginner who does one thing properly is in a far better position than the person who half-starts everything and finishes nothing. I've written before about <a href="https://kellssecurity.com/blog/the-order-id-actually-fix-my-digital-security-in" data-mce-href="https://kellssecurity.com/blog/the-order-id-actually-fix-my-digital-security-in">the fuller order I'd actually work through everything else in </a>once that first step is done, and about <a href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication">the different kinds of two-factor authentication </a>if you want to understand which option is strongest once you're past the beginner stage.</p><p><br></p><p>If you take nothing else from this, take this, two-factor authentication on your email account, today, before you close this tab. It's the single highest-value five minutes you can spend on your own security, and it doesn't require understanding anything else on this site first. Once that's done, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>walks through what I'd genuinely tackle next in whatever order makes sense for you, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own beginner-friendly guidance on two-factor authentication if you want a second explanation before you start.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The One Security Step for a Complete Beginner

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.