Safer web browsing
Keep the browser updated, use modern protections and judge what a site is asking you to do — not whether it displays a padlock.
Last reviewed: October 2026
Modern browsers do a great deal to protect users automatically, but they cannot decide whether a convincing website should be trusted with your password, payment details or confidential material.
Keep the browser updated
Install browser and operating-system security updates promptly and enable automatic updates where practical. Do not routinely delay updates in the hope that somebody else will discover problems first: known vulnerabilities are valuable to attackers and security fixes should normally be applied as soon as they are available.
If a device or browser is no longer receiving security updates, replace or upgrade it.
The padlock is not a trust mark
HTTPS protects the connection between your browser and the website. That is important, but a fraudulent website can use HTTPS too. A secure connection to a criminal’s site is still a secure connection to a criminal’s site.
Concentrate on the address and on what the site is asking you to do. For important services, use the official app, a saved bookmark or an address you know rather than following an unexpected login link.
Use the browser’s protections
Leave built-in phishing and malicious-site protection enabled. Be cautious about extensions: every extension adds software with access to some part of your browsing. Install only what you need, use reputable sources and periodically remove extensions you no longer use.
Avoid installing software or browser updates offered by random web pages. Get software from the operating system’s app store or the vendor’s official site.
Think before granting permission
Websites increasingly ask for access to your location, camera, microphone, notifications and clipboard. Grant access only when it is essential and review permissions occasionally.
Unexpected browser notifications are a common source of misleading security warnings and scam prompts. If a site you barely know wants permission to send notifications, the answer is usually no.
Separate particularly sensitive work
For higher-risk research, consider using a separate browser profile or dedicated device so that ordinary personal accounts, cookies and saved credentials are not unnecessarily mixed with sensitive work. This does not make browsing anonymous, but it can reduce accidental crossover.
If anonymity or protection from a sophisticated adversary genuinely matters, ordinary private/incognito browsing is not enough. Get advice appropriate to the assignment.
Remember what private browsing actually does
Private or incognito mode mainly limits what is retained on the device after the session. It does not make you invisible to websites, your network provider, an employer managing the device or other parties able to observe the connection.
Good browsing security is mostly unexciting: update promptly, minimise unnecessary extensions and permissions, and treat unexpected login or download requests with caution.