The core defenses every home computer needs
A home computer needs four layers of protection: a firewall, antivirus software, regular updates, and careful habits. Your operating system (Windows, macOS, or Linux) includes a built-in firewall that blocks unwanted incoming connections—leave it on. Antivirus software scans files and programs for known threats and quarantines anything suspicious. Windows Defender comes free with Windows 10 and 11; macOS has XProtect built in. Both work well for most home users. Updates patch security holes that hackers exploit, and they arrive constantly because new vulnerabilities are discovered regularly. Your habits—not clicking suspicious links, not opening attachments from unknown senders, using strong passwords—stop the majority of attacks before they reach your computer.
These four layers work together. A firewall stops many attacks at the door. Antivirus catches what gets through. Updates close the holes attackers use. Your judgment stops the rest. None of them alone is enough.
Key Takeaways
- Keep your operating system and all software updated automatically—most security breaches exploit known vulnerabilities that patches have already fixed.
- Use a strong, unique password for every online account, and consider a password manager like Bitwarden or 1Password to store them securely.
- Enable two-factor authentication on accounts that matter (email, banking, social media), which requires a second verification step even if your password is stolen.
- Run antivirus scans monthly and check your firewall status in your system settings—Windows Defender and macOS XProtect are sufficient for most home users.
- Back up your important files to an external drive or cloud storage monthly, so ransomware or hardware failure cannot erase them permanently.
Turning on automatic updates and why they matter
Updates are the single most important defense because they close security holes before attackers can use them. Windows and macOS both offer automatic updates—turn them on and leave them on. On Windows 10 or 11, go to Settings > Update & Security > Windows Update and select "Automatic (recommended)". On macOS, go to System Settings > General > Software Update and check "Automatically keep my Mac up to date". Your computer will read and install updates in the background, usually overnight.
Updates sometimes require a restart, which is why they often happen when you shut down your computer. This is normal and necessary. A computer that has not been restarted in weeks is a computer that is missing security patches. If you see an update notification, restart within a few days rather than postponing indefinitely.
Software beyond your operating system also needs updates. Your web browser (Chrome, Firefox, Safari, Edge), your email client, and any other programs you use regularly should update automatically. Check their settings to confirm. Older versions of software contain known vulnerabilities that antivirus alone cannot fix.
Setting up a strong password system
A strong password is at least 12 characters long, uses uppercase and lowercase letters, numbers, and symbols, and is unique to each account. "MyDog2024!" is weak because it uses a predictable pattern. "7#kR9$mL2@xQ" is strong but impossible to remember for ten different accounts. The solution is a password manager—software that generates and stores strong passwords for you.
Bitwarden and 1Password are the most common options. Both cost under $10 per month, though Bitwarden offers a free version with all essential features. You create one strong master password to unlock the manager, and it fills in your passwords for you on websites and apps. If one of your accounts is breached, the attacker gets only that password, not all of them, because each one is different. A password manager also makes it impossible to reuse passwords across sites, which is the most common way accounts get compromised.
If you cannot use a password manager yet, write down your passwords on paper and store the paper in a locked drawer—not in a text file on your computer. Change your most important passwords (email, banking, social media) every six months. For less critical accounts, annual changes are sufficient.
Enabling two-factor authentication on critical accounts
Two-factor authentication (2FA) requires a second verification step after you enter your password—usually a code from an app on your phone, a text message, or a physical security key. Even if someone steals your password, they cannot log in without that second factor. Enable 2FA on your email account first, because email is the master key to every other account—if someone accesses your email, they can reset your passwords everywhere else.
Most email providers (Gmail, Outlook, Yahoo) offer 2FA in their security settings. Google and Microsoft call it "two-step verification". Set it up to use an authenticator app like Google Authenticator or Authy rather than text messages, because text messages can be intercepted. After email, enable 2FA on your bank account, any investment accounts, and social media accounts that contain personal information.
2FA takes an extra 10 seconds each time you log in, but it stops the vast majority of account takeovers. The inconvenience is worth the protection.
Running antivirus scans and checking your firewall
Windows Defender (built into Windows 10 and 11) and macOS XProtect (built into macOS) run continuously in the background, scanning files as you read and open them. You do not need to buy additional antivirus software unless you have a specific reason to. Third-party options like Norton, McAfee, and Kaspersky exist, but they often slow your computer and offer little advantage over the built-in tools for home users.
Run a full system scan once a month to catch anything the background protection missed. On Windows, open Windows Defender, click "Virus & threat protection", then "Scan options" and select "Full scan". On macOS, open System Settings > Privacy & Security and scroll to the bottom to see XProtect status. A full scan takes 30 minutes to an hour depending on how much data you have.
Check that your firewall is on. On Windows, go to Settings > Privacy & Security > Windows Defender Firewall and confirm both "Domain network" and "Private network" show "On". On macOS, go to System Settings > Privacy & Security > Firewall and click the lock to unlock it, then confirm the firewall is enabled. Your firewall blocks incoming connections that you did not request, which stops many network-based attacks.
Backing up your files so you can recover from ransomware or hardware failure
Ransomware is malware that encrypts your files and demands payment to unlock them. The only defense that actually works is a backup that the ransomware cannot reach. Back up your important files—documents, photos, financial records—to an external hard drive or cloud storage at least monthly. An external drive should be disconnected from your computer most of the time, so ransomware cannot encrypt it. Cloud storage like OneDrive, Google Drive, or Dropbox keeps a copy online, but ransomware can sometimes encrypt cloud backups if they are synced in real time.
The safest approach is both: sync important folders to cloud storage for convenience, and back up to an external drive monthly for protection against ransomware. Label the external drive with the backup date so you know how old it is. If your computer fails or gets infected, you can restore from the most recent backup.
Windows includes a built-in backup tool called File History. Go to Settings > System > Storage > Advanced storage options > Backup options and select an external drive. macOS includes Time Machine. Go to System Settings > General > Time Machine and click "Add Backup Disk". Both tools run automatically once configured.
Recognizing and avoiding common attack methods
Phishing emails pretend to be from your bank, PayPal, or another trusted company and ask you to click a link or read an attachment. The link goes to a fake website that looks real but steals your login. The attachment contains malware. Never click a link in an unsolicited email—instead, go directly to the company's website by typing the address yourself or calling their phone number on your statement.
Suspicious downloads are another common entry point. Software, games, and documents from unknown websites often contain malware. read only from official sources: the Microsoft Store or Apple App Store for apps, the official website for software, and email from people you know for documents. If a website asks you to disable your antivirus to install something, that is a sign the software is malicious.
Public Wi-Fi networks (coffee shops, airports, libraries) are unencrypted, so anyone on the network can see your traffic. Do not log into banking or email accounts on public Wi-Fi. If you must, use a VPN (virtual private network) like Proton VPN or Mullvad to encrypt your connection. Most VPNs cost $5 to $10 per month.
Frequently Asked Questions
Do I need to buy antivirus software, or is Windows Defender enough?
Windows Defender is sufficient for most home users and is included free with Windows. It runs continuously, updates automatically, and catches the vast majority of threats. You do not need to buy additional antivirus software unless you have a specific reason—for example, if you frequently read files from untrusted sources or run older software that is no longer patched.
What should I do if I think my computer has a virus?
Run a full antivirus scan when ready (see the section on running scans). If the scan finds threats, let your antivirus quarantine them. If your computer is running very slowly, freezing, or showing pop-ups even after a scan, restart in Safe Mode (Windows: hold Shift while restarting; macOS: restart and hold Shift) and run another scan. If the problem persists, take your computer to a local repair shop or contact your computer manufacturer's support line.
Is it safe to use the same password for multiple accounts if it is strong?
No. If one website is breached and your password is exposed, attackers will try that password on every other site. A unique password for each account means a breach at one site does not compromise your other accounts. A password manager makes this practical by storing and filling in unique passwords for you.
How often should I restart my computer?
Restart at least once a week, and always within a few days of an update notification. Restarting clears temporary files, closes background processes that may have become unstable, and ensures updates are fully installed. A computer that runs for months without restarting accumulates security patches that have not taken effect yet.
Can I get a virus from visiting a website?
Modern browsers protect you from most malicious websites automatically, but it is still possible. Never read files from websites you do not trust, and be cautious about clicking ads or pop-ups. If a website asks you to install software or update your browser, go to the official source instead—for example, go to google.com to update Chrome, not through a pop-up on another site.