ExpressVPN 10-Step Security Check

The ExpressVPN 10-Step Security Check is designed for use in portrait mode only on smaller screens, please rotate your device and refresh before continuing.

Your ExpressVPN 10-Step Security Check Results:
How did you do?

1. Physical security: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

It may sound silly, but “shoulder surfing,” or the act of looking over someone’s shoulder during login, is one of the easiest ways to steal a password. Always check for shoulder surfers before logging in to any device. When in doubt, use one hand to cover your screen while you enter the password with the other.

Nice! You’re already protecting yourself against “shoulder surfers” most of the time.

We recommend always checking for shoulder surfers before logging in to any device. When in doubt, use one hand to cover your screen while you enter the password with the other.

Great job! Sounds like you’re already aware of how easy it is for someone to steal your device’s password by looking over your shoulder. To take your physical security to the next level, try using a webcam cover or privacy screen for your laptop.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Cover the webcam on your laptop or desktop computer

ONE THING YOU CAN DO RIGHT NOW

2. VPN: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Heads up! Using a VPN is one of the easiest and most effective ways to increase your privacy and security in any situation. A VPN can keep you safe from Wi-Fi hacking on public networks and make you more anonymous on the web.

If you don’t use a VPN, you may be exposing your location and your activity to more people than you’d like. Using a VPN lets you reclaim your privacy by hiding your IP address and encrypting your internet traffic. There’s never been a better time to start.

Nice work. Using a VPN is essential to protecting yourself on unsecure public Wi-Fi networks. But a VPN doesn’t just protect against Wi-Fi hacking. Using a VPN also hides your IP address from sites and apps that want to track you and shields your traffic from other third parties that want to track what you’re doing online.

Awesome! As you probably already know, using a VPN is one of the easiest and most effective ways to increase your privacy and security, wherever you are.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Read up on the multiple benefits of VPN

ONE THING YOU CAN DO RIGHT NOW

Looking for maximum security? Try using Tor and VPN together

ONE THING YOU CAN DO RIGHT NOW

Learn how a VPN protects you on public Wi-Fi

3. Device updates: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

If you usually skip your software updates, you’re missing out on more than the latest functionality. Security updates are your first line of defense against the kind of major hacks you read about in the news. If you find it to be a hassle, try turning on “auto update,” and you won’t even have to think about it next time.

This is the bad result

Device updates often seem like a hassle, but they’re one of the most important elements of healthy cyber hygiene. If you find yourself skipping them, try turning on “auto update,” and you won’t even have to think about it next time.

You’re already updating your device regularly, which is what keeps it protected from the latest vulnerabilities. Keep up the good work!

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Check your update status on your other devices (Step by-step instructions: Mac / Windows)

ONE THING YOU CAN DO RIGHT NOW

Turn on “auto update” on your device (Step-by-step instructions: iOS / Android)

4. Two-factor authentication: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Two-factor authentication (2FA) is a clever way to prevent attackers from hijacking your accounts even if they have your password. By requiring a separate authentication code sent to your mobile device when you log in, 2FA means that no one can access your account without having your password and your device, which is much harder to do.

To get started, go into the settings menu of your favorite apps and look for an option called “Enable 2-factor authentication.”

This is the bad result

You’re no stranger to 2FA, but there’s still room for improvement. Take a look at your phone and see if there are any important apps you’ve missed (especially banking and email apps) and visit the settings menu to enable 2FA as soon as possible.

You’re a two-factor authentication pro! Your accounts are more secure than most. If you want to go the extra mile, you may want to explore other authentication options, like a hardware security key.

Hardware keys are physical devices that resemble a small USB stick, and they are currently the most secure 2FA method. They can even prevent phishing attacks! Look for one compatible with the FIDO U2F standard.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Learn why hardware keys are the most secure 2FA method

ONE THING YOU CAN DO RIGHT NOW

Download an authentication app like Authy or Google Authenticator

5. Web browsers: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Besides a spotty security record, Microsoft Edge just isn’t optimal for protecting your privacy. Unlike other browsers, Edge has no tracking protection feature to prevent sites from sharing your browsing information, even in private browsing mode. We’d recommend switching to a more privacy-conscious browser like Firefox.

There’s no sugarcoating it: if you’re still using Internet Explorer, it’s time to jump ship. The browser has long been notorious for security vulnerabilities, and now that Microsoft has no major updates planned for it, there’s no excuse for not switching to a modern browser like Firefox.

Whether you’re using one of the most popular web browsers or a more obscure one, you might be sacrificing your security and privacy. Instead of using a browser that makes it easier for big companies to track your activity and sell it to advertisers, try Firefox. It’s fast, customizable, and developed by a nonprofit organization (Mozilla) with a proven commitment to privacy.

Awesome! You’ve already chosen a web browser that values your privacy and security.

Nice! If you’re using the Tor Browser, you’re already ahead of the curve when it comes to private web browsing. Keep it up!

ONE THING YOU CAN DO RIGHT NOW

Need maximum security? Download the Tor Browser

ONE THING YOU CAN DO RIGHT NOW

Looking for maximum security? Try using Tor and VPN together

ONE THING YOU CAN DO RIGHT NOW

Download Firefox or Brave

6. Search engines: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Google is the easiest choice of search engine, but it can come at a cost to your privacy.

If that’s not a price you’re willing to pay, and you’re worried about Google collecting your data and sharing it with advertisers, consider searching with DuckDuckGo. It delivers solid search results with none of the tracking.

This is the bad result

Nice. You’ve already ditched Google as your primary search engine, which is the first step toward reclaiming your internet activity from advertisers and other third parties.

We recommend you check out DuckDuckGo, which is hands-down the best search engine for privacy. Unlike Google, Bing, and Yahoo, DuckDuckGo doesn’t store a single bit of your search history or personal information, so it can’t share it with anyone.

Awesome! You’re already searching with DuckDuckGo, which means advertisers and other third parties won’t see your search history.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Tell your friends about DuckDuckGo

ONE THING YOU CAN DO RIGHT NOW

Try searching with DuckDuckGo

7. Facebook: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Are all of your Facebook friends your “friends” in the sense that you’d trust them with your personal information? And do you really trust all of them not to lose their Facebook password to a scammer?

Take the time to check what information you’re sharing with just “your friends.”

Depending on when you joined Facebook, you could be sharing your personal information with everyone by default. That means anyone on the internet can search your name and find your email address, phone number, and more. Take a moment to review your privacy settings to get that under control!

Right on! Sounds like you’ve got your Facebook privacy settings under control.

Fed up with Facebook? Deleting your account is the single best step toward better privacy you can take.

Awesome! Your personal information is safe from the surveillance and manipulation machine known as Facebook.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Check your privacy settings on other social media with the links below

ONE THING YOU CAN DO RIGHT NOW

Do you use other social media? Double-check all your privacy settings using the links below

ONE THING YOU CAN DO RIGHT NOW

Review your Facebook privacy settings

8. Phishing: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Email providers like Gmail do a pretty good job of flagging spam that might contain phishing links. But these filters aren’t perfect, and it pays to keep your eyes open.

If you’re suspicious about an email’s origin, check the domain of the sender’s email address. And instead of clicking on links in the body of an email, navigate to the service through a trusted channel. For example, if you see an email link to a supposed Dropbox notification, avoid it and instead visit your Dropbox account from a bookmark or by typing www.dropbox.com into your browser.

Phishing is the attempt by scammers to steal your personal information or money (or both) by getting you to click a link in your email. Often they will try to disguise themselves as someone you know to make you let your guard down.

If you’re suspicious about an email’s origin, check the domain of the sender’s email address. And instead of clicking on links in the body of an email, navigate to the service through a trusted channel. For example, if you see an email link to a supposed Dropbox notification, avoid it and instead visit your Dropbox account from a bookmark or by typing www.dropbox.com into your browser.

This is the medium result

Nice! You’re aware of the techniques scammers can use to trick you into clicking on links in your email. Keep up the good work!

This is the excellent result

9. Messaging: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

Your choice of messaging app has an imperfect track record for privacy and transparency.

Telegram: Once popular with the privacy-minded, the app has been known to leak metadata and isn’t end-to-end encrypted by default.

Viber: Though encrypted by default, Viber has not been very transparent about its software or ownership.

In either case, consider switching to an app like Signal, which is widely trusted by the security community.

Your choice of messaging app presents real privacy and security concerns.

WhatsApp: Though it claims it can’t view your messages, WhatsApp still shares metadata with its parent, Facebook, a notorious data mishandler.

Facebook Messenger: Doesn’t have end-to-end encryption on by default, and the privacy-minded should be wary of any Facebook product.

Skype: Lacks many privacy features, including end-to-end encryption, and has surveillance capability built in to the software.

These and many other messaging platforms offer too few safeguards. We recommend a privacy-focused app like Signal.

By using iMessage, you’re already ahead of the secure messaging game. iMessage is end-to-end encrypted by default, and Apple has a relatively strong record for privacy.

Your messages are less secure, however, when they are automatically backed up on iCloud. For better security, you may want to check out Signal, the messaging app famously advocated by Edward Snowden.

You’re already doing a great job of encrypting your communications with a messaging app that respects your privacy. Keep it up!

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Tell your friends to switch to Signal, Wire, or Wickr!

ONE THING YOU CAN DO RIGHT NOW

Download Signal

10. Passwords: HIGH RISK WEAK OK STRONG KEVLAR

YOU ANSWERED:

This is the poor result

You may think you’re saving time and energy by reusing your passwords, but you’re actually setting yourself up for an even bigger hassle. If the password to one of your accounts is exposed in a data breach, your other accounts with the same password will soon follow.

Save yourself some stress right now and download a password manager like 1Password or LastPass. You’ll only have to remember one master password, and all your other passwords will be filled in automatically.

Nice. Sounds like you know the value of a strong password. But if you ever find yourself sacrificing the strength of your passwords just to remember them all, consider using a password manager like 1Password or LastPass.

Cool! You’re already using a password manager, which is a great way to create strong, unique passwords for all your accounts.

This is the excellent result

ONE THING YOU CAN DO RIGHT NOW

Check if any of your accounts have been compromised | Have I been pwned?

ONE THING YOU CAN DO RIGHT NOW

Try 1Password or LastPass

About the ExpressVPN 10-Step Security Check

Protecting your privacy and security online is essential—and shouldn’t have to be complicated. That’s been a driving principle for ExpressVPN since our founding in 2009. We developed the ExpressVPN 10-Step Security Check to show how we all can improve our security online with just a few simple actions.

If you’re eager to learn more about online privacy and VPNs, the best place to start is our “What is a VPN?” page.

Software Update

App security