Secure you email address well; with a password you don't use on any other site. Don't be too quick to change it, you have to remember it as well. They hack an insecure site, they might get your e-mail and password, and can then log in to your e-mail account and use the 'Forgot Password' function to get access to your other sites. They are likely there, among your e-mails. About password strength (think: e-mail): correct horse battery staple (don't use this as password). Put together longer words from a story in your life that you remember and mix a few strange/uncommon characters in, or at the beginning or end. Wikipedia: List of the most common passwords. Use a Password Manager to generate random passwords to each site. Secure this well, obviously, since it will be the 'key' to all your other sites. Me, I use Bitwarden EU, but I think iPhone/iCloud Passwords would be fine. Look out, so you don't create a US Bitwarden account if you are European (Look for EU vault in small at the bottom of the page if creating a Bitwarden account and when logging into the password vault). 2FA/MFA means two factor or multi factor authentication, meaning one thing more than your password. Most common are time based 6 digit PIN codes (TOTP = Time-based One-Time Password), which are calculated in authenticator apps like Bitwarden EU/US, Google Authenticator and others. A secure key (often as QR code) has to be exchanged between the site and your authenticator app for it to work. Other factors can be text messages to phone, e-mail confirmations or physical keys with complex codes in them. Many sites require you to store backup codes if the TOTP fail, I store them as a Hidden Key under the corresponding site in my password manager. TOTP ^ Yubikeys for securing accounts are recommendable. Your phone number can be used as well, if you're not afraid of loosing your phone or it getting hacked by someone ordering an new SIM card to get access to your number. Me, I don't secure too many sites with Yubikeys, only the ones most important to me, the rest are secured via my password manager. Get two; one for everyday/traveling and one secure/at relative. Modern sites also use Passkeys which you can store in your password manager. They are much more complicated and difficult to hack then email addresses and passwords. Yubikey 5 NFC | Yubikey 5C NFC (what is your need?) Passkeys ^ Phishing attempts; to steal your password(s) via e-mail/text message. Look closely at the link and feel if you trust it. If you click and it redirects you to another site, look at the address and feel if it's to be trusted. They lure you into entering your e-mail address and password on a fake site, collect it or log in to the real one in real-time, and then they get access to your stuff there. Don't fall for that, many enough have. Make a sketch of your accounts and make a design to secure them. Even if it takes weeks, it might be worth it. E-mail and phone cloud account goes first. Close accounts you no longer use and consider before creating new ones, at least use random passwords for them. Update 2026-09-17: Me, I also use the app Adblock Plus on my iPhone to deny loading of fishy ads, javascripts and more. I just noticed Adblock Plus require account creation, they did not have that before. I did manage to run it without. I also use the NoScript Security Suite add-on in Firefox (me I use Firefox ESR, which is more stable). Why not move on from ads to micro payments for content we like? Me, I could easily cough of 0.1 EUR/USD for an article that I like, instead of unconsciously seeing ads that trigger me or is part of a programming program. (Some more details in section 2026-09-03 below)