Start with the protections already on your machine

Most home computers are sold with a decent set of security tools already installed. The trouble is that these tools often sit half-configured, waiting for someone to switch them on properly. Before you spend money on extra software or sign up for another subscription, it is worth spending an hour with the settings you already have. In our experience, a well-configured Windows or macOS machine with sensible habits behind it is safer than a poorly set up machine with three overlapping security suites fighting each other.

This guide walks through the handful of settings that make the biggest difference for a typical household. None of them are technical, none require a paid product, and all of them can be checked in an afternoon.

Keep updates flowing, automatically

Software updates are the single most effective security measure available to a home user. When a vulnerability is discovered, manufacturers patch it, and criminals rush to exploit anyone who has not yet updated. The gap between a patch being released and an attack appearing is often measured in days, not months.

Turn on automatic updates for your operating system and leave them on. On Windows, check Settings > Windows Update and confirm that updates are set to install automatically, including optional driver updates. On macOS, go to System Settings > General > Software Update and enable automatic downloads and installation of security responses.

• Restart your computer when prompted. Updates usually only finish installing at restart, and leaving that for weeks defeats the point.
• Don't forget your browser, your router firmware, and any apps you use for banking or shopping. Browser updates in particular close holes that get exploited constantly.
• If you are on an older version of Windows that no longer receives security patches, treat replacing that machine as a priority rather than a nice-to-have.

Lock the screen and know who else has access

A computer that is left unlocked is a computer that anyone in the house, or anyone who walks past a window, can use. This matters more than most people think. An unlocked machine gives access to saved passwords, email, bank accounts, and files, even if the intruder only has a few minutes.

Set your screen to lock automatically after a short period of inactivity. Five to ten minutes is reasonable for a home machine; two or three is better if you share a house with visitors or children. Require a password, PIN, or biometric sign-in to unlock it, and make that credential different from the ones you use elsewhere.

• On Windows, check Settings > Accounts > Sign-in options for the screen saver and sign-in requirements.
• On macOS, use System Settings > Lock Screen to set the delay and require a password immediately after sleep.
• Set up separate user accounts for each person in the household. Everyone sharing one administrator account is a needless risk.
• Learn the quick lock shortcut: Windows key + L on Windows, Control + Command + Q on macOS.

Take browser warnings seriously

Modern browsers have become remarkably good at spotting dangerous websites, but they can only help if you read what they say. The full-page red warning that appears before a suspicious page loads is not a minor inconvenience to click past. It means the browser has matched the site against known phishing or malware lists, or found a certificate problem that suggests impersonation.

When you see that warning, close the tab. Do not click through, do not look for a "continue anyway" link, and do not paste the address into a different browser to see if it behaves differently. If you genuinely believe the site is legitimate, type the address in manually from a source you trust rather than following the link you were sent.

• Turn on your browser's built-in phishing and malware protection if it is offered as an option.
• Enable automatic updates for the browser itself, not just the operating system.
• Remove extensions you no longer use. Old extensions can linger for years with permissions you would never grant today.
• Be sceptical of pop-up windows claiming your computer is infected, especially ones with a phone number to call. That is a scam, not a warning.

Use the built-in firewall and check what is listening

Both Windows and macOS ship with a firewall that is on by default and does a decent job. Confirm it is enabled rather than assuming. On Windows, look under Settings > Privacy & security > Windows Security > Firewall & network protection. On macOS, check System Settings > Network > Firewall.

While you are there, glance at the list of apps allowed to communicate through the firewall. If you see something you do not recognise, look it up before removing it, but do not ignore it. Unfamiliar entries are occasionally leftovers from software you uninstalled years ago, and occasionally something worse.

If you work from home or handle sensitive documents, consider whether your router is doing its job too. Change the default administrator password, keep the firmware updated, and use WPA2 or WPA3 encryption on the wireless network. Your router is the front door of the whole house.

Back up before you need to

Security settings reduce the chance of a bad day. Backups decide how bad that day turns out to be. Ransomware, accidental deletion, and failing drives all end the same way if there is no copy of your files elsewhere.

Follow the simple rule of three: keep at least three copies of anything important, on two different types of media, with one of them stored off-site or in the cloud. An external drive that stays plugged in is not much protection against ransomware, so unplug it between backups or use a cloud service that keeps version history.

Test a restore at least once. A backup you have never tried to recover from is a hopeful guess, not a plan. Once these basics are in place, you can relax about the rest.