WatchmanHQ

Protect

Home defense: protect yourself for free

Last updated 2026-10-15 · Written with AI assistance, reviewed by a person

Most attacks on everyday people aren't personal. They're automated: bots trying leaked passwords, scam texts sent to millions of numbers, and scanners hunting for old routers around the clock. That's actually good news. It means a handful of free habits stop most of it.

You don't need to buy anything to follow this guide. It's in order of impact, so start at the top and stop whenever you run out of time. You can always come back.

We don't get paid for anything we mention here, and there are no affiliate links. Where we name a tool, it's one we'd use ourselves. We say what it's good at, plus where it falls short. Prices are what we found in October 2026; they change, so check before you buy.

If you only do four things

  1. Lock down your email with a strong, unique password and two-step sign-in. Your email can reset almost every other account you have.
  2. Use a password manager, so every account gets its own password.
  3. Turn on automatic updates on every computer, phone and your router.
  4. Back up what you can't replace, like photos and important documents.

Everything below builds on those four.

1. Your email is the master key

Almost every "Forgot your password?" link sends a reset to your email. Whoever controls your email can take over nearly everything else, so it comes first.

2. Passwords: one per account, and let a manager remember them

Reusing passwords is the most common way ordinary accounts get taken over. One website gets breached. Criminals then try that same email and password on every other site, automatically. The fix is a different password for every account, and the only practical way to do that is a password manager.

Our picks:

Password managerCostWhy
BitwardenFree. Premium $19.80 a year; Families $47.88 a year for six peopleThe best free option that works on every device and browser. Open source and independently audited. Our default recommendation.
Apple Passwords or Google Password ManagerFreeThe simplest choice if everything you own is Apple, or Android plus Chrome. Awkward if you mix the two.
1Password$47.88 a year; Families $71.88 a yearThe most polished and easiest for a whole family to actually use. Worth it if the family won't use anything clunkier.
KeePassXCFreeFor tinkerers who want the password file offline. You handle syncing and backups yourself.

Skip: a "free" password manager from a company you've never heard of, passwords in a spreadsheet or your phone's notes app, and letting a browser you don't sign into remember passwords on a shared computer.

Pick one and stick with it. Then:

3. Two-step sign-in

Two-step sign-in (also called two-factor authentication or MFA) means a stolen password isn't enough on its own. It's the single biggest upgrade most accounts can get.

MethodHow goodNotes
Passkey or security keyBestCan't be tricked out of you by a fake website.
Authenticator app (Google Authenticator, Microsoft Authenticator and others)Very goodFree. Save the backup or recovery codes.
Text message (SMS) codeBetter than nothingCan be stolen by moving your number to another phone.
NothingNot enoughTurn something on today.

Our picks:

4. Updates: the boring step that matters most

Most attacks use security holes that already have a fix. The fix is in the update you haven't installed yet. Updates are free security, so let them install themselves.

Windows

Mac

Phones and tablets

Browsers, apps and extensions

Your router

Routers need updates too, and they're the most forgotten device in the house. See section 6.

5. Your computers and phones

6. Your home network and router

Your router is the front door for every device in your home. It faces the internet day and night. Criminals scan for old, unpatched routers constantly. The FBI has warned that routers past their end of support are being taken over to hide criminal traffic.

The box from your provider, your own router, or do it yourself?

Your internet provider's boxYour own router or mesh systemDo it yourself (pfSense, OPNsense, OpenWrt)
CostOften a monthly rentalOne-time purchaseFree software, plus suitable hardware
UpdatesUsually pushed by the providerAutomatic on most current modelsYou do them
ControlLimitedGood: guest networks, parental controlsTotal
EffortLowestLowHigh: you become the IT department
Best forMost homes, if it's a current modelPatchy Wi-Fi, an old provider box, or wanting more controlPeople who enjoy it

Our honest take: the provider's box is fine for most homes, as long as it's a current model that updates itself. Buying your own makes sense if your Wi-Fi doesn't reach every room, your provider's box is old, or you want features it lacks. Choose a well-known brand that updates automatically and says publicly how long it supports each model. Build your own only if you'll enjoy maintaining it: a neglected do-it-yourself firewall is worse than a provider box that updates itself.

If you're buying, what we'd look at:

Avoid cheap routers from brands with no history of updates, and any router the maker no longer supports ("end of life" or "end of support"). If yours is past that point, replace it.

Ten minutes in your router's settings

Open your router's app or admin page (the address is usually on a sticker on the box) and:

  1. Change the admin password from the default to a long, unique one, and save it in your password manager.
  2. Update the firmware, and turn on automatic updates if there's an option.
  3. Use WPA3 for Wi-Fi security, or "WPA2/WPA3" if older devices need it. Never WEP or an open network.
  4. Set a long Wi-Fi password. A passphrase is fine; you type it once per device.
  5. Turn off WPS, the push-button or PIN pairing feature. It's a known weak spot.
  6. Turn off remote management (sometimes called remote administration or access from WAN), unless you use it through the maker's official app.
  7. Turn off UPnP, unless something stops working without it (some games consoles need it).
  8. Make a guest network for visitors, plus smart gadgets like TVs, cameras and plugs, so a cheap gadget can't reach your laptop.
  9. Rename your network to something that doesn't identify you, your family or your address.
  10. Switch on free protective DNS (next).

Free protective DNS

DNS is the internet's phone book: it turns a name like example.com into an address. A protective DNS service refuses to look up sites known to be malicious, which blocks them for every device in your home at once. Two good free options:

Put these in your router's DNS settings (often under Internet or WAN), so every device gets them. Check a few websites still load, then visit on.quad9.net if you chose Quad9: it should say Yes. Some provider boxes won't let you change DNS. If yours won't, you can set it on each computer instead, or it may be a reason to get your own router.

Like to tinker? A Pi-hole on a small computer like a Raspberry Pi can load our free block lists as well.

7. Back up what you can't replace

Ransomware, a dead hard drive, a spilled coffee or a stolen laptop: backups turn each of those from a disaster into an inconvenience.

8. Scams: the biggest threat is a convincing message

Most money stolen from ordinary people isn't hacked. It's talked out of them. Scams arrive by text, email, phone call, social media and pop-up. AI is making them more convincing every month.

The three warning signs

  1. Urgency: "Your account will be closed today." "Your grandson is in jail."
  2. An unusual way to pay: gift cards, cryptocurrency, wire transfers, a payment app to someone you don't know, or "move your money to a safe account". No real bank, government agency or tech company asks for these.
  3. Secrecy: "Don't tell anyone." "Stay on the line."

One of these means stop. Two or more means it's a scam.

What to do instead

Agree a family safe word

AI can now copy a voice from a short video clip. Agree on a code word for real emergencies. If "your daughter" calls in a panic asking for money, ask for the word, or hang up and call her on the number you already have.

Shopping and paying

Public Wi-Fi and VPNs

Nearly every website and app now encrypts its traffic, so coffee-shop Wi-Fi is far less risky than it used to be. Still, use your phone's hotspot for banking when you can, and make sure you join the real network (ask staff for its name). You don't need to pay for a VPN to be safe: a VPN mostly hides your traffic from the network you're on, and the VPN company sees it instead. If you travel a lot and want one anyway, two have been independently audited: Mullvad (€5 a month, no email address needed to sign up), plus Proton VPN (which has a genuinely free plan).

9. Protect your identity and credit (US)

All of this is free:

10. Family, and the people you look out for

11. Where a little money goes a long way

Everything above is free, and free is enough to be well protected. If you want to spend something, these are the best value, roughly in order:

BudgetWhat to buyWhy
$60 to $100, onceAn external drive for backupsTurns ransomware, theft or a dead laptop into an inconvenience. If you buy one thing, buy this.
About $58, onceTwo security keys (YubiKey Security Key NFC)Makes your email and password manager practically impossible to phish.
About $20 a yearBitwarden Premium, or NextDNS ProPremium adds security reports plus emergency access; NextDNS adds per-device control with a block log.
About $99 a yearBackblaze Personal BackupSet-and-forget cloud backup of a whole computer.
$150 to $400, onceA mesh router that updates itselfOnly if your provider's box is old or your Wi-Fi doesn't reach every room.
About $48 to $72 a year1Password (individual or family)If your family won't use anything less polished.

What we'd skip

12. If something goes wrong

Don't panic, and don't be embarrassed. This happens to careful, clever people every day. Our playbooks walk you through the most common problems one step at a time. The short version:

  1. Disconnect the affected device from the internet if you think it's infected.
  2. From a different device, change your email password first, then your bank, then anything else that shared the same password. Sign out of all other sessions.
  3. Money gone, or card details given away? Call your bank's fraud line (the number on the back of your card) straight away. Speed matters.
  4. Identity stolen? Go to IdentityTheft.gov for a step-by-step recovery plan, and freeze your credit.
  5. Report it. Scams and fraud go to the FTC at ReportFraud.ftc.gov; internet crime goes to the FBI at ic3.gov. Reports help catch the people behind it and warn others.
  6. Write down what happened, when, and who you've contacted.

Your maintenance calendar

Security isn't a one-off job. Think of it like servicing a car.

How oftenWhat to do
Every weekRestart your computer and phone, so updates finish.
Every monthCheck every device says it's up to date, including the router. Skim your bank and card statements.
Every three monthsRemove apps and extensions you don't use. Check Have I Been Pwned. Look at the list of devices connected to your router for anything you don't recognize.
Every six monthsRestore one file from your backup. Check your email's recovery phone and address. Run the security checkup.
Every yearCheck that every device still gets updates: computers, phones, router and smart gadgets. Change the family safe word if it's been shared.

The one-page checklist

This guide is written for people in the US, but nearly every step works anywhere. It's general advice, not professional advice for your situation: see our Terms. Share it freely with anyone you look out for.

Something here wrong or out of date? Email hello@watchmanhq.com.