Recognize online traps, review account access and improve everyday security with practical defensive guidance.
Search this section ↗
76 topics in this section.
Use Google’s recovery route, then review sessions, recovery details and Gmail forwarding. Avoid recovery scams and keep a record of changes you did not make.
Check whether Google Authenticator codes are synced or stored only on the old phone, then transfer and test access before erasing the device.
Review WhatsApp Web and other linked devices from your main phone, remove access you do not recognize, and distinguish this from full account recovery.
Start from the vendor’s official route, inspect the exact file and distinguish a checksum match from publisher trust.
Review a photo’s location, turn it off for a share, and check the exported copy. Understand what removing GPS data cannot hide in the picture.
Preview a QR destination, look for replaced physical labels and verify payment or account requests through an independent route.
Remove unused extensions, inspect site permissions and distinguish unpinning an icon from stopping an extension.
Find Google’s backup-code controls, keep the recovery copy outside the lost phone and understand what happens when a code is used or a set is replaced.
Check the site’s grant and the operating system’s browser access, then test the intended device without opening permissions everywhere.
Use the original merchant order and official carrier route to check a parcel before paying an unexpected redelivery fee.
Check local autofill and Google Wallet separately, stop unwanted saving and use an appropriate separate browsing session.
Match the key identifier, keep the recovery record separate from the computer and avoid firmware changes until access is verified.
Check photo metadata, remove the location through supported controls and verify the exported file rather than assuming an app strips it.
Recognize ClickFix-style instructions, close the page and respond differently if you already executed the copied command.
Compare device, time and your actual activity, then sign out unfamiliar sessions and inspect recovery settings.
Identify the sending website, revoke its notification permission and distinguish a browser push from a real security finding.
Choose specific recipients, review viewer/editor rights and test the resulting access before sending the link.
Identify scheme, hostname, user-info and path locally, then verify the service independently instead of treating a parsed URL as safe.
Choose a short series of guides for the task you want to complete.
Recognize fake fixes, remove noisy permissions and review sessions.