Safe browsing habits for your team

Most security incidents don't start with sophisticated hacking. They start with someone clicking a bad link, downloading an infected file, or logging into a sensitive account on an unsecured network. The right habits make these much less likely.

Keep your browser up to date

Your browser is the window to the internet, and browser makers push security updates frequently. Running an outdated browser leaves you exposed to vulnerabilities that are often already being exploited.

Most browsers update automatically. To check:

• Chrome: More (the three dots, top right) → Help → About Google Chrome. If a Relaunch button appears, an update is waiting; if it isn't there, you're on the latest version
• Safari: Safari comes with the operating system, so you get new versions by installing macOS updates
• Edge: Settings and more (top right) → Help and feedback → About Microsoft Edge
• Firefox: open About Firefox from the menu to see which version you're on

Enable automatic updates if they aren't already on.

Look for HTTPS

When you visit a website, the address bar shows either http:// or https://. The "S" stands for secure — it means the connection between your browser and the website is encrypted.

Before entering any sensitive information (passwords, credit card numbers, personal data), make sure the URL starts with https://. Don't go looking for a padlock: Chrome retired that icon, and now shows a neutral symbol to the left of the address on an encrypted page and the words "Not secure" on one that isn't. Chrome also has a setting called Always use secure connections, which warns you before it loads a page that isn't encrypted.

Be aware: HTTPS does not mean the site is safe or legitimate — it just means the connection is encrypted. A phishing site can have HTTPS too. As Chrome's own help puts it, even on a secure site you should check the site name in the address bar to make sure you're in the right place. See How to recognize phishing attempts.

Be careful with downloads

Downloaded files are one of the most common ways malware gets onto devices. Before downloading anything:

• Make sure you initiated the download. If a pop-up says "Your device has a virus — click here to download the fix," don't click it.
• Download software only from official websites or trusted app stores.
• Be suspicious of email attachments you weren't expecting — even from known senders, if the email feels unusual.

Avoid sensitive accounts on public Wi-Fi

Public Wi-Fi (in cafes, hotels, airports, coworking spaces) can be insecure. Attackers can set up fake Wi-Fi networks or monitor traffic on genuinely open networks.

If you must use public Wi-Fi for sensitive work:

• Use your phone's mobile hotspot instead whenever possible
• Use a reputable VPN (virtual private network) to encrypt your traffic
• Avoid logging into banking, financial, or high-value accounts

At minimum: never log into anything sensitive on a network called something generic like "Free WiFi" with no password.

Use a separate, standard browser for everyday browsing

This is an optional but useful habit for teams: use one browser for work (where you're logged into company accounts) and keep it clean, and use a separate profile or browser for general browsing.

This limits the damage if a browser extension or website exploits a vulnerability — it won't have access to your work accounts.

Be skeptical of browser extensions

Browser extensions have significant access to everything you do in your browser. Only install extensions from reputable sources, and remove any you don't actively use.

Warning signs of a dangerous extension:

• Requests access to "all websites" when it doesn't need to
• You installed it from a website rather than the official browser store
• It appeared after installing another program

Lock your screen when you step away

This is basic but surprisingly important in shared offices and coworking spaces. Set your computer to ask for your password again shortly after it goes to sleep or the screen saver starts:

• Mac: Apple menu → System Settings → Lock Screen in the sidebar → set a short time next to "Require password after screen saver begins or display is turned off"
• Windows: press Windows logo key + L to lock it the moment you stand up, and shorten the screen and sleep timers so it locks itself if you forget

Common questions

Is a VPN worth using for my business?

A VPN encrypts your internet traffic and hides your IP address. It is most useful on public Wi-Fi. For general office or home use, a VPN adds a small layer of privacy but is not a substitute for strong passwords and 2FA. If your team frequently works from cafes or travels, a VPN is a worthwhile investment.

How do I know if I've downloaded malware?

Signs include: your computer runs significantly slower than usual, pop-up ads appear when you're not in a browser, your browser homepage changed without you doing it, or your security software flags something. See Malware & your website explained.

Should I use an ad blocker?

A content or ad blocker cuts down what your browser loads from third-party ad networks, which closes off one route attackers use to reach people who never clicked anything suspicious. Treat it like any other extension: install it from your browser's official extension store, and check with your IT contact before installing anything on a managed work device.

What about private browsing / incognito mode?

Private or incognito browsing doesn't hide your activity from the websites you visit, or from the organizations that manage your network — Chrome's own help names your school, employer and internet provider. It only stops that session's history and cookies being kept on the device, and anything you download stays on the device afterwards. It does not make you safer from malware or network-level attacks.

Related guides

• How to recognize phishing attempts
• Device & Wi-Fi security basics
• Malware & your website explained
• Two-factor authentication, explained
• SSL & HTTPS, explained
• I got a suspicious email — what now?

Learn more

• CISA: Malware, phishing and ransomware
• Google: Safe Browsing
• Google Chrome Help: Check if a site's connection is secure