Not everything online is true: people can post false or misleading things, and misinformation can spread, and anyone can publish online, so it is useful to check who is behind a page. A website can look credible but still be misleading, and judging a site by its looks alone can fool people. When you check a source, do not rely only on what its creators say about themselves, and look at what other trusted sources say about them. Shocking content designed to make you angry or scared is often made for clicks, not because it is true, and headlines are often written to cause a strong feeling, because that gets clicks. A good first step with a surprising post is to stop and notice how it makes you feel before sharing it.
Professional fact-checkers use a strategy called lateral reading to judge whether a source can be trusted. Lateral reading means leaving an unfamiliar site and opening new tabs to see what trusted sources say about it, and it starts with opening a new tab to search for the website's title, its publisher or the article's author. In lateral reading, other websites such as search engines are tools to judge how reliable a source is, not sources to cite. When a company sells a product, it is not the best judge of that product's benefits, so check who has an interest in the claim. A Stanford study found that 80 percent of undergraduates and 50 percent of doctoral historians who relied on their gut and website appearances were fooled by a misleading website. The SIFT method has four moves: Stop, Investigate the source, Find better coverage, and Trace claims back to the original. It also helps to check what a claim looks like on other trusted sites to see if they agree.
Phishing is a form of social engineering: attackers use people's trust, rather than computer flaws, to get information. The internet gives a false sense of security because there is no physical interaction, so people may share more than they would face to face. Information can be used for social engineering: someone could use details about your hobbies and friends to pretend to be a trusted friend. Attackers use news events and times of year, such as holidays or disasters, to make their messages look timely. Texting scams are called smishing and voice-call scams are called vishing, and both are kinds of phishing. Caller ID can be spoofed, so a call that seems to come from a trusted number may not.
Poor spelling used to be a clue to a scam, but scams are getting smarter and some even fool experts, so do not rely on spelling alone. A message that pushes you to act right away, with warnings about what happens if you do not, is a common sign of phishing. A real bank will never ask you to confirm your account details by email or a phone call it started. Scammers try to quickly gain trust and pressure you into acting without thinking, and if a message is suspicious, stop and break contact. If a suspicious message could be real, look up the company's real contact details yourself instead of using the ones in the message. Even people you know can send a bad attachment: viruses can spoof a sender's address. Reporting scam messages helps reduce how many you receive and protects other people.
As of November 2026, password guidance from NIST says services should not force complexity rules or regular password changes, and that a password should be changed if there is evidence it has been compromised. It says a password used by itself should be at least 15 characters long, and that websites should accept long passwords of at least 64 characters, with spaces, so that a passphrase works. Guidance from the NCSC says the old advice to fill passwords with random symbols is not helpful, because people cannot remember so many complex passwords, and swapping letters for numbers, like o for 0, does not make a password much stronger because criminals know the trick. As of November 2026, passkeys let you sign in with your device's fingerprint, face check or passcode instead of a password, and guidance from the NCSC recommends them wherever offered. A password manager is a program that makes, stores and fills in your passwords, so you only remember one strong one.
Here is how an extra step works, and why email comes first. Two-step verification asks for a second proof that it is really you, such as a code sent to your phone, in addition to your password. It can stop a criminal who has your password from getting into your account, and the second step can be a code sent by text, a code made by an authenticator app, or your fingerprint or face. A criminal who gets into your email could read private information, send messages pretending to be you, and reset your other passwords. Your email password is especially important, because an email account can be used to reset the passwords of your other accounts. Start by turning on two-step verification for your email, because email can reset your other accounts.
Privacy online has a technical side. Cookies track you only until you delete them, but fingerprinting uses more permanent identifiers such as hardware specifications and browser settings, and browser fingerprinting identifies a device by characteristics like screen resolution and installed fonts, so it keeps working even if you delete cookies. Stronger privacy can cost convenience: stronger tracking protection often makes some websites work less well. Websites ask you about cookies because of a data privacy law, the European GDPR, which became a model for many other laws. A privacy policy should say how your information will be used and whether it is shared with other organizations. Data brokers are companies that collect and sell personal information about people, including information bought from apps, loyalty programs and retailers. When a site asks you to accept cookies, you can choose to accept only the necessary ones.
Think about what stays behind. Posted information can survive removal: saved or cached copies may still exist on other people's machines. As of November 2026, companies and schools sometimes look up applicants online, so what you post can matter later, and most people are judged on authenticity, not perfection. Think before you post: if you feel upset or angry, wait, because people do not always make good decisions when stressed. Security questions are safer when you answer them with something only you would know, because facts on social media are easy to guess. You can manage your digital footprint by limiting or deleting data browsers hold, deleting old accounts, and using private browsing. A self-audit means looking over your profiles from time to time and removing posts that no longer fit your values.
Several plain habits protect a device and its connection. A padlock or https at the start of a web address shows that a site's connection is secure, and HTTPS encrypts the data passing between your browser and a website, so attackers on the network cannot read it. A website's certificate ties its encryption key to its domain name, and a certificate authority checks that the web address belongs to that organization. A valid certificate makes you more confident you are on the right site, but you are trusting the certificate authority to have checked it. A software update patches security flaws, and attackers may target known flaws for months or even years after an update is available. Public Wi-Fi is open to anyone, so be careful what you do on it.
When something goes wrong, there are clear next steps. If someone shares an embarrassing or inappropriate image claiming it is you, tell a trusted adult; it should be reported to the site. If an online message is mean to you, do not answer it, and tell a trusted adult. If you gave your password to a scammer, change it on every account that uses the same password. If bank or card details were shared with a scammer, the bank should be contacted straight away because it can help. If something online makes you feel sad, scared or confused, tell a trusted grown-up. If something online upsets a friend, help them and speak up to a grown-up you trust. Telling a grown-up about something that worried you online is the right thing to do, and you should not be in trouble for telling.
Words to know
- lateral: opening new tabs
- SIFT: four-move method
- fingerprinting: device tracking
- certificate: web address proof
