I Thought I Was Safe Online. Then My Accounts Got Hijacked — Here's What Actually Works

Two-factor authentication (2FA) adds a second check — usually a code from your phone — so a stolen password alone isn't enough to break in.

1. 1
   Install an authenticator app — Use Authy (backs up your codes to the cloud) or Aegis (open-source for Android). Do NOT use SMS 2FA if you can avoid it — SIM swap attacks bypass it.
2. 2
   Enable 2FA on your email first — Start with Gmail, Outlook, or iCloud. Your email is the master key to everything else — password resets go there.
3. 3
   Move to banking and social media — Add 2FA to your bank, PayPal, Facebook, Instagram, Twitter, and any work accounts. Most services have it under 'Security' or 'Password & sign-in'.
4. 4
   Print backup codes and store them safely — When you enable 2FA, you get 8–10 backup codes. Print them and put them in a physical safe or a locked drawer. Don't store them digitally.
5. 5
   Consider a hardware security key for critical accounts — A YubiKey or Google Titan key is the gold standard. No codes to intercept — you just tap the key. Use it for your email and password manager.

Hackers can hijack your phone number (SIM swap) or install malware via sideloaded apps. These steps seal those holes.

1. 1
   Set a SIM PIN — On iPhone: Settings > Cellular > SIM PIN. On Android: Settings > Security > SIM lock. Choose a 4–8 digit number different from your phone unlock code.
2. 2
   Turn off automatic Wi-Fi connection — Go to Wi-Fi settings and disable 'Auto-Join Hotspot' and 'Ask to Join Networks'. Hackers set up fake open Wi-Fi networks that capture your traffic.
3. 3
   Disable sideloading on Android — In Settings > Security, turn off 'Install unknown apps'. On iPhone, this is off by default — don't install profiles or apps from outside the App Store.
4. 4
   Update your phone's OS monthly — Set your phone to auto-update overnight. Security patches fix known vulnerabilities that hackers actively exploit.

A VPN encrypts your internet traffic so hackers on the same Wi-Fi can't snoop on your data. But most people use them wrong.

1. 1
   Pick a no-log VPN provider — Choose Mullvad (€5/month, anonymous signup) or ProtonVPN (free tier, no data caps). Avoid free VPNs — they often sell your data or inject ads.
2. 2
   Enable the VPN before connecting to public Wi-Fi — Set the VPN app to auto-connect on untrusted networks. At cafes, airports, or hotels, your traffic is visible to anyone on the same network without a VPN.
3. 3
   Use the 'kill switch' feature — Turn on the kill switch in the VPN settings. If the VPN drops, the kill switch blocks all internet traffic until the VPN reconnects — preventing data leaks.
4. 4
   Don't use a VPN for everything — For banking or streaming, a VPN can cause issues (banks flag foreign IPs). Use split tunneling to route only sensitive traffic through the VPN.

Your router is the front door to your entire digital life. A misconfigured router lets hackers scan your devices and steal files.

1. 1
   Change the default admin password — Log into your router (usually 192.168.0.1 or 192.168.1.1). Change the admin username and password to something unique — not 'admin/admin'.
2. 2
   Enable WPA3 encryption (or WPA2 if WPA3 isn't available) — In wireless settings, set security mode to WPA3 or WPA2-AES. Avoid WEP or WPA — they're easily cracked.
3. 3
   Disable WPS and UPnP — Wi-Fi Protected Setup (WPS) and Universal Plug and Play (UPnP) are convenience features that attackers exploit. Turn them off.
4. 4
   Set up a guest network for visitors — Create a separate Wi-Fi network for guests, smart TVs, and IoT devices. This isolates them from your main computers and phones.
5. 5
   Update your router's firmware — Check the manufacturer's site for updates. Many modern routers auto-update — enable that. If your router is more than 5 years old, consider replacing it.

Phishing is the #1 way hackers get in. Learn to spot fake emails without relying on your gut.

1. 1
   Check the sender's email address, not just the name — Hover over the sender name. If it says 'PayPal' but the address is 'paypa1-security@randomdomain.xyz', it's fake. Look for misspellings and odd domains.
2. 2
   Don't click links in emails — type the URL yourself — If an email says 'Your account is locked, click here', open a new tab and type 'paypal.com' directly. Legitimate services never ask you to click from an email.
3. 3
   Look for urgency and threats — Phishing emails use fear: 'Your account will be closed in 24 hours!' or 'Suspicious login detected — verify now.' Real companies send calm, non-urgent messages.
4. 4
   Inspect URLs before clicking — On desktop, hover over a link to see the actual URL. On mobile, press and hold the link. If the URL looks weird (e.g., 'amazon-security-check.com'), don't tap.

Browser extensions can block trackers, stop malicious downloads, and prevent websites from fingerprinting you.

1. 1
   Install uBlock Origin — This ad blocker also blocks known malware domains and cryptominers. It's lightweight and open-source. Available for Chrome, Firefox, and Edge.
2. 2
   Add Privacy Badger from EFF — Privacy Badger learns to block invisible trackers. It's made by the Electronic Frontier Foundation and doesn't sell your data.
3. 3
   Enable HTTPS Everywhere (or use the built-in setting) — Many browsers now force HTTPS automatically, but if yours doesn't, install the HTTPS Everywhere extension. It encrypts your connection to sites that still support HTTP.
4. 4
   Review and remove unused extensions — Go to your browser's extension manager. Remove any extension you don't recognize or haven't used in 6 months. Each extension is a potential attack surface.

If you run a website, Cloudflare acts as a shield between your server and attackers, blocking DDoS, SQL injection, and bot traffic.

1. 1
   Sign up for a free Cloudflare account and add your domain — Go to cloudflare.com and add your domain (e.g., yoursite.com). Cloudflare will scan your DNS records and import them automatically.
2. 2
   Update your domain's nameservers — Your domain registrar (e.g., Namecheap, GoDaddy) will give you a place to change nameservers. Replace them with the ones Cloudflare provides. Propagation takes up to 24 hours.
3. 3
   Enable the WAF (Web Application Firewall) — In the Cloudflare dashboard, go to Security > WAF. Turn on the 'Cloudflare Managed Ruleset' to block common attacks like SQL injection and cross-site scripting.
4. 4
   Turn on 'Under Attack' mode during spikes — If your site is getting hammered with traffic, enable 'I'm Under Attack' mode in the Firewall settings. It shows a JavaScript challenge to visitors, blocking most bots.
5. 5
   Set up SSL/TLS to Full (Strict) — Go to SSL/TLS > Overview and choose 'Full (Strict)'. This encrypts traffic between visitors and Cloudflare, and between Cloudflare and your server.