Category: Security

My router used to be invisible to me. It was a box in a corner, with blinking lights, that I only noticed when the internet stopped working. I never thought of it as a computer, and I certainly never thought of it as something that needed attention. That was a mistake, because a router is exactly that: a small computer that sits between everything in your home and the internet.

The risk is easy to miss because a router does not show you its problems. If it is compromised, your internet may still work, your pages may still load, and nothing will obviously look wrong. Meanwhile, the device that decides where your traffic goes could be steering it, watching it, or letting someone else into your network. That quiet position is what makes it valuable to an attacker.

The risk in plain words

Your router is the front door for your home network. Every laptop, phone, television, camera, speaker, and smart plug connects through it. If an attacker controls the router, they can potentially see or redirect traffic, change the settings that protect your network, and reach devices inside your home that are not meant to be exposed to the internet. Many of those devices, especially cheap smart gadgets, are not very good at defending themselves.

Default settings make this worse. Many routers ship with a well-known admin username and password, and many people never change them. Firmware — the software that runs the router — also goes out of date, just like the software on a computer. An old, unpatched router facing the internet is an easy target for automated scanning, even if you have never done anything wrong with it.

How it actually works

A router has an admin interface, usually reached through a browser on your home network, and sometimes exposed more widely than intended. If the admin password is weak or still set to the default, an attacker who can reach that interface may be able to sign in and change the router’s settings, including the servers it uses to look up website addresses. That kind of change can send you to fake sites without any obvious warning.

Firmware flaws work the same way as flaws in any other software. When a vendor fixes a problem, routers that are not updated remain vulnerable. Because routers are often installed and forgotten, they can stay vulnerable for a long time. Smart home devices add another layer: a compromised camera or plug on the same network can become a stepping stone, which is why separating them matters.

What to actually do about it

First, sign into your router and change the admin password to a strong, unique one, stored in your password manager. Do not confuse this with your Wi-Fi password, although you should change that too, and make it strong. Turn off remote administration if you do not need it, so the admin interface is not reachable from the internet. If you are not sure how, check the router maker’s support pages for your model.

Second, update the firmware. Check for updates in the router’s settings, and turn on automatic updates if your router offers them. If your router is so old that it no longer receives updates, treat that as a reason to replace it, not as a minor detail. An unsupported router is a computer that will never be fixed again.

Third, set up a guest network for smart home and internet-connected gadgets. Put cameras, plugs, speakers, and other devices you do not fully trust on that separate network, and keep your main computers and phones on the main network. That separation limits what a compromised gadget can reach. It is not perfect, but it makes a single weak device much less dangerous.

Finally, give the router the same routine you give a computer: check for updates occasionally, reboot it when the maker recommends it, and review the connected devices list now and then for anything you do not recognize. I still keep my router in a corner, but I no longer treat it as furniture. It is a computer, it is my front door, and it deserves the same basic care as everything else on my network.

I run a WordPress site, and I used to treat its security as a one-time setup job. I would install a plugin, feel protected, and then forget about it for months. That approach failed in the usual quiet way: nothing dramatic happened, but updates piled up, old accounts stayed active, and plugins I no longer used were still sitting there, waiting to become a problem.

The risk is not that WordPress itself is uniquely unsafe. It is that a popular, internet-facing system is a tempting target, and a site with many moving parts gives an attacker many places to try. A single outdated plugin, a weak admin password, or an old user account with too much access can be enough. Security for a site like mine is therefore less about one clever tool, and more about a short list I actually repeat.

The risk in plain words

Most WordPress compromises I read about do not start with a sophisticated break-in. They start with something ordinary: a plugin that was not updated, a theme that was abandoned, or a login page that was left open to unlimited guesses. Automated tools scan for exactly those conditions, because they can try them against thousands of sites without much effort. Your site does not need to be famous to be scanned.

Users are part of the risk too. Every account is a door, and every door with administrator access is a powerful one. Old accounts for people who no longer help with the site, shared logins, and accounts with weak passwords all increase the chance that a stolen credential turns into a full takeover. I try to keep the number of doors small, and the keys to them strong.

How it actually works

An attacker who finds an outdated plugin can sometimes use its known flaw to upload files or change content. An attacker who guesses or steals an admin password can simply sign in and do the same thing through the normal interface. A firewall can block many automated attempts, and lockouts can slow down guessing, but neither helps if a trusted account is misused or an unused plugin is left unpatched. That is why the checklist covers several layers at once.

Hiding the login page and adding lockouts, for example, do not make a site invincible. They reduce noise and make automated guessing harder. Least-privilege access means that even if a lower-level account is compromised, the damage is limited. Backups mean that if something does go wrong, I can restore a clean copy instead of trying to untangle a compromised site by hand.

What to actually do about it

First, keep WordPress, themes, and plugins updated, and turn on automatic updates where it makes sense. Remove plugins and themes you do not use, rather than leaving them installed and inactive. An inactive plugin can still be a risk if its files remain on the server, so deletion is the cleaner choice. Check for updates regularly, and keep a backup before major changes.

Second, tighten users. Give each person only the role they actually need, use strong, unique passwords, and turn on two-factor authentication for administrator accounts. Remove or downgrade accounts that are no longer needed, and do not share a single admin login among several people. If someone needs temporary access, give it temporarily, and then take it back.

Third, protect the login and the front door. Use a hidden or changed login address if your setup supports it, limit failed login attempts, and use a reputable firewall plugin or service to block common attacks. Keep those tools updated too, because a security plugin that is itself outdated is not doing you any favors.

Finally, back up the site regularly, including both files and the database, and store a copy somewhere separate from the live server. Test a restore occasionally, so you know the backup actually works. Then run through this list on a schedule, not just after a scare. That is the checklist I actually run: updates and auto-updates, least-privilege users, a protected login with lockouts, a firewall, backups, and no unused plugins lying around.

Ransomware sounds like a crime story, and in a way it is. But for the person on the receiving end, it is simpler and more personal than that. One day your files are yours, and the next day they are locked, renamed, or gone, with a demand attached. The panic in that moment is the point. The attacker wants you to feel that paying is the only way to get your work, photos, and records back.

I think about ransomware differently now. It is not only a malware problem. It is a backups problem. If you have clean, recent copies of your important files somewhere the attacker cannot reach, the lock on your main system is a bad day instead of a disaster. If you do not, every other decision becomes harder, including whether to pay, which I would not recommend as a plan.

The risk in plain words

The risk is losing access to things you cannot easily recreate: years of photos, tax and business records, writing, schoolwork, and client files. Some attacks also copy files before locking them, and threaten to share them, which adds pressure even if you have backups. Backups do not solve every part of that, and I will not pretend they do. But they do solve the core question: can you keep going without the locked system?

Ransomware often arrives through familiar routes: a phishing message, a malicious attachment, a compromised remote access tool, or an unpatched service facing the internet. Once inside, it can spread to connected drives and shared folders. That is why a backup that is always connected can be damaged too. A backup only helps if it is separate from the system it is protecting.

How it actually works

After gaining access, ransomware encrypts files, which means it scrambles them so they cannot be read without a key held by the attacker. It may also delete local recovery copies and look for network drives. The demand that follows is designed to create urgency and secrecy. Paying does not guarantee a working key, does not guarantee that copied files will be deleted, and can mark you as someone willing to pay again.

The widely used 3-2-1 idea is a plain way to think about resilience: keep three copies of important data, on two different kinds of storage, with one copy offsite. The numbers matter less than the principle behind them. If one copy is locked, another should still be available. If your house or office has a fire or flood, an offsite copy should still exist. If a cloud account is compromised, a separate offline copy should still be there.

What to actually do about it

First, set up automatic backups for the things that matter, and include an offline copy. That could be an external drive you connect for backups and then disconnect, or a backup service that keeps versions separate from your main files. The key detail is that the offline copy is not constantly reachable from your everyday computer. A drive that is always plugged in is convenient, but it is also within reach of the same attack.

Second, test your restores. A backup you have never restored from is a hope, not a plan. Once in a while, pick a few files, restore them to a different folder, and check that they actually open. Check that your backup includes the folders you think it does, especially photos, documents, and anything stored outside the usual locations. I have seen people discover too late that a backup was running, but was backing up an empty folder.

Third, keep the basics current, because backups are the last line, not the only line. Use strong, unique passwords, turn on two-factor authentication, install updates promptly, and be careful with attachments and unexpected links. If you run a website or a server, keep its software updated and back it up separately from the live site, so you can rebuild it if needed.

Finally, decide your plan before you need it. Write down, in plain language, where your backups are, how to restore them, and who to contact if something happens. If an attack does occur, disconnect the affected system from the network, do not rush to pay, and get help from a trusted professional or support channel. The goal is not to be invincible. It is to make a locked computer a recoverable problem, not the end of your files.

I used to put off updates. A prompt would appear in the middle of work, I would click remind me later, and then I would forget about it for weeks. Nothing seemed to happen in the meantime, so delaying felt harmless. What I did not understand then was that an update is rarely just about a new feature. Most of the time, it is a fix for a hole that someone has already found.

That is the risk in plain words. Software has flaws, and when a flaw becomes known, attackers can build tools to exploit it quickly. If your computer, phone, or website is still running the old version after a fix is available, you are not facing a theoretical problem. You are running a version with a known weakness, in a world where the fix is public knowledge.

The risk in plain words

Most attacks do not use some brilliant new technique. They reuse known, already-patched holes, because that is efficient. Attackers scan for systems that have not been updated, and they try the same methods against many targets at once. You do not have to be important or interesting to be found. You only have to be unpatched and reachable.

This applies to more than your laptop. Your phone, your browser, your router, your plugins, and the apps you use every day all get updates for the same reason. A single outdated piece can be the way in, even if everything else is current. I learned to stop thinking of updates as optional polish, and start thinking of them as closing doors that I know are open.

How it actually works

When a vendor discovers or is told about a vulnerability, it usually releases a patch and describes the problem in general terms. That description helps defenders understand what to fix, but it also tells attackers where to look in the old version. From that point, the clock is running. Systems that update promptly close the hole. Systems that wait remain exposed, and automated scanning makes it easy to find them.

Patching discipline is therefore a race, but a manageable one. The attacker does not need to find a new flaw in your system. They only need to find an old flaw you have not fixed yet. That is why guidance from agencies and vendors, in general terms, keeps coming back to the same point: install updates promptly, especially for software that faces the internet, and do not leave known fixes sitting uninstalled.

What to actually do about it

First, turn on automatic updates wherever you reasonably can: your operating system, your browser, your phone, and your apps. Automatic updates remove the decision I used to get wrong, which was to delay and forget. For a personal site, that includes automatic updates for WordPress itself and for plugins and themes where the option is offered, with backups in place in case an update causes a problem.

Second, make a short, regular routine for the things that do not update themselves. Once a week, check for updates on your devices, your router, and any software you use for work. Install them, restart when asked, and do not leave a pending restart hanging for days. A patch that is downloaded but not applied because you never restarted has not protected you yet.

Third, reduce what needs patching. Remove apps, browser extensions, and plugins you no longer use. Every extra piece of software is another thing to keep current and another potential hole. If you have old, unsupported software that no longer receives updates, treat that as a decision point: replace it, isolate it, or stop using it for anything important.

Finally, keep a backup before major updates, so a bad update is an inconvenience instead of a crisis. Then update promptly, even when it is annoying. Updates are not the whole of security, but they are the foundation. If I had to pick one habit that does the most work for the least effort, it would be this: stop clicking remind me later, and let the fix do its job.

When I think of phishing, I still picture the old version first: a badly written message, a strange sender, and a promise that was obviously too good to be true. That version still exists, but it is no longer the main problem. The messages that worry me now look ordinary. They use the right logo, the right tone, and a reason that makes sense in the moment, and they arrive when I am busy enough not to look closely.

The risk is simple to state and hard to feel in the moment. Phishing is not really about tricking you into believing a lie. It is about getting you to take one quick action — click, sign in, download, or reply — before you have time to check. Once you enter a password on a fake page, or open a harmful attachment, the attacker does not need you to stay fooled for long. A few seconds is enough.

The risk in plain words

Modern lures borrow credibility. A message may pretend to be a delivery notice, a password reset, a shared document, a payroll update, or a security warning. The details are chosen to fit your life, not to look exotic. Sometimes the sender name looks right at a glance, even if the actual address is different. Sometimes the link looks close to a real address, with a swapped letter, an extra word, or a different ending that you would only notice if you stopped and read it character by character.

Urgency is the other ingredient. The message says an account will be closed, a package will be returned, or a payment will fail unless you act now. That pressure is not an accident. It is designed to push you past the pause you would normally take to verify. I have learned to treat urgency itself as a warning sign, not as proof that something is real. Real services can wait while you check through another channel.

How it actually works

A typical attack starts with a look-alike domain or a compromised account. The fake page copies the real sign-in screen closely enough that it feels familiar. When you type your username and password there, the attacker captures them, and sometimes passes them through to the real site so you do not even realize anything went wrong. If you also enter a code, a more advanced version can capture that too, which is why two-factor authentication helps but is not a complete answer on its own.

Other versions do not need a fake login at all. An attachment or a link can install harmful software, or a reply can start a conversation that slowly asks for more access. A message from a colleague whose account was compromised can be especially convincing, because the sender is real even though the request is not. The thread, the signature, and the history all look legitimate, which is why checking the request itself matters more than checking how polished the message looks.

What to actually do about it

First, slow down on any message that asks you to sign in, pay, or share sensitive information. Do not click the link in the message to verify the message. Instead, go to the service the way you normally would — type the address yourself, use a bookmark, or open the app — and check there. If there really is a problem with an account or a delivery, it will usually show up in the real account as well.

Second, verify through a second channel when the request is unusual, urgent, or involves money or access. That means calling a known number, messaging a colleague through a different app, or walking over and asking in person. Do not reply to the suspicious message to ask if it is real, and do not use a phone number or link supplied in that same message. A second channel breaks the attacker’s control over the conversation.

Third, look at the actual sender address and the actual link destination before you act, but do not rely on that alone. Hover over a link on a computer, or press and hold it on a phone, to see where it really goes. Watch for look-alike spellings and extra words in the domain. Report the message using your email service’s report feature, delete it, and if you did enter a password, change it right away and check for any unfamiliar sign-ins or changes.

Finally, make the habit boring and repeatable. I do not try to memorize every new scam. I follow one rule: unexpected requests for credentials, payments, or access get verified outside the message. That rule has saved me more than any tip about typos, because the new phishing does not depend on typos. It depends on speed, familiarity, and trust.

I put off two-factor authentication for longer than I like to admit. It sounded like extra work every time I signed in, and I was sure my passwords were good enough. Then I watched a friend lose access to an email account after a password leak, and the recovery took days of forms, waiting, and worry. The account was not recovered because the password was weak. It was recovered slowly because there was no second check standing between a stolen password and full access.

That is the risk in plain words. A password, however good, is one secret. Once it is leaked, guessed, or phished, it can be used by anyone, from anywhere, until you notice and change it. Two-factor authentication adds a second, separate check. It does not make your password unimportant. It means a stolen password on its own is usually not enough.

The risk in plain words

Most of the accounts we care about are gateways to other accounts. Email can reset passwords. A cloud account can hold photos, documents, and backups. A payment account can move money. If someone gets into just one of those with a password alone, they can often work outward from there, changing recovery details and locking you out. That chain reaction is what makes a single compromised password so costly.

People also underestimate how often passwords are exposed without any obvious warning. A breach at a service you barely use can expose a password you reused somewhere important. A convincing fake login page can capture the exact password you just typed. In both cases, you may do nothing wrong in the moment and still end up with a secret that is no longer secret. A second factor is designed for exactly that situation.

How it actually works

Two-factor authentication asks for two different kinds of proof. The first is something you know, which is your password. The second is usually something you have, such as your phone running an authenticator app, or a physical security key. When you sign in, you enter your password, then you approve the sign-in or enter a short code that changes regularly. An attacker who only has your password does not have that second piece, and a code that expires quickly is much harder to reuse later.

Not all second factors are equal, and this is where the practical choice matters. An app-based code is generally stronger than a code sent by text message, because text messages can be intercepted or redirected in some attacks, and they depend on your phone number staying under your control. App codes are generated on your device and do not travel through the same channel. A hardware security key is stronger still for the accounts that support it, because it is tied to the real site you are signing into and is much harder to trick with a fake page.

Backup codes are the part people skip, and then regret. When you set up two-factor authentication, most services offer a set of one-time backup codes. Those codes are your way back in if you lose your phone or replace it. They should be printed or written down and kept somewhere safe at home, not stored in the same email account they protect, and not photographed and left in your camera roll. Without them, recovery can be slow and uncertain.

What to actually do about it

Start with email, then your password manager, then banking and payment accounts, then cloud storage and social accounts. That order matters because email protects the rest. For each one, choose app-based authentication where it is offered, and use a text-message code only where an app is not available. Fifteen minutes per account is a fair estimate at first, and most of that time is finding the setting, not doing anything complicated.

Next, save your backup codes the same day you turn the setting on. Do not tell yourself you will do it later. Print them or write them down, put them somewhere you can find them in a stressful moment, and tell yourself plainly where they are. If you change phones, move your authenticator accounts before you wipe the old phone, or use the backup codes to sign in and set the new phone up properly.

Finally, be honest about the small friction. Yes, signing in takes a few extra seconds. That is the point. A good security control should be slightly annoying to an attacker and only mildly annoying to you. I would rather spend those seconds than spend days proving I am me to a support team. Turn it on for the important accounts first, get used to it, and then work through the rest. Your future self, locked out of nothing, will be grateful.

I used to treat passwords the way most people do: pick something I could remember, add a number and an exclamation mark to satisfy a website, and then reuse a variation of it everywhere. It felt like I was following the rules. In practice, I was doing the one thing that makes a password weak, which is making it predictable and repeated.

The risk is not that someone sits down and guesses your password by hand. The risk is that a password you used on one site shows up somewhere else, or that an automated tool tries common patterns at scale. Once a password is known, it does not stay in one place. Attackers try it against email, banking, shopping, and social accounts, because they know how often people reuse the same secret. Your email account matters most here, because it can reset almost everything else.

The risk in plain words

Think of a password as a key. If you use the same key for your house, your car, and your office, losing one copy puts everything at risk. A long, unique key for each lock is not paranoia. It is the basic idea behind keeping accounts separate. Short passwords are also a problem because there are simply fewer possibilities to try, and common words, names, and dates are the first things any guessing tool will try.

Complexity rules made this worse for years. When a site demanded an uppercase letter, a number, and a symbol, most of us did the same thing: we took a familiar word, capitalized the first letter, and added a number at the end. That pattern is easy for a person to remember and easy for software to guess. Length and uniqueness beat that kind of complexity theater every time. A longer passphrase made of words you can picture is both harder to guess and easier to remember than a short jumble you will forget.

How it actually works

When a service is breached, the passwords stored there can leak. The next step is predictable: the leaked passwords are tried against other services. This is why a password that was fine on its own becomes dangerous once it is reused. It is also why changing a password after a breach matters less if you only change one character or add a new number to the same old base.

Guessing also works against weak and common passwords. Tools can run through dictionaries, names, dates, and common substitutions far faster than a person can. A password like a pet name plus a birth year looks personal, but it is built from exactly the kind of information people reuse and sometimes share. Length slows this down a lot, because each extra character multiplies the possibilities. Uniqueness stops the spill from spreading, because a password that only works in one place is useless everywhere else.

What to actually do about it

First, use a password manager. I know that sounds like adding a new single point of failure, and it is worth saying plainly: you are trusting one tool with a lot. But the alternative most people live with is worse, which is a handful of reused passwords in their heads. A manager lets you give every account a long, random, unique password without having to memorize any of them. You only need to remember one strong master password, and you should protect that one carefully.

Second, make that master password long. A passphrase of several unrelated words works well. Do not reuse it anywhere else, and do not share it. Turn on two-factor authentication for the manager itself and for your email account first, because those two protect the rest.

Third, fix the important accounts first. Start with email, then banking and payment accounts, then the accounts that hold your photos, documents, and work. Give each one a unique password from the manager, and do not worry about changing every password on the same day. Work through the list over a week. When you get a notice that a service was breached, change that password, check whether you reused it anywhere, and change those too.

Finally, stop trying to be clever with small variations. Adding a different number for each site is not uniqueness, and a password you can guess from another one is not really separate. Let the manager generate the passwords, let it fill them in, and keep your own memory for the one master passphrase. That is the password rule that actually matters: long, unique, and managed, instead of short, repeated, and improvised.