Top 5 Windows Security Tips to Protect Your PC From Malware

Most Windows infections are not sophisticated. They arrive through an unpatched hole, a reused password, a convincing email or an unprotected disk. Fixing those four things, plus having a backup for when everything else fails, prevents the large majority of everyday incidents. These are the five habits I would set up first on any Windows 10 or 11 PC, with the exact places to click and commands to check them. None of them needs paid software.

1. Keep Windows and your apps patched

Attackers reuse known vulnerabilities for years, because plenty of machines never install the fix. Microsoft releases security updates on the second Tuesday of every month (“Patch Tuesday”), plus out-of-band fixes for urgent problems.

1. Open Settings > Windows Update (Windows 10: Settings > Update & Security > Windows Update) and click Check for updates. Install everything and restart.
2. Turn on Get the latest updates as soon as they’re available on Windows 11 if you want features early; otherwise the default schedule is fine. Do not disable the update service.
3. Keep third-party software patched too: browser, PDF reader, Java, Office, and drivers. Browsers update themselves; for other programs, winget upgrade in a terminal lists updates for the packages it recognises and winget upgrade --all installs them. It skips some programs (pinned or unrecognised ones), so also let each app’s own updater run.
4. Remove software you no longer use. Every installed program is one more thing to patch.

Also check that your Windows version is still supported. Once a release reaches end of service, it stops getting regular security fixes (Microsoft sometimes offers paid or enrolment-based Extended Security Updates, but do not count on them). The Microsoft lifecycle page in the sources lists the dates.

2. Use strong, unique passwords and turn on multi-factor authentication

Password reuse is a major risk factor in account takeovers: when one website is breached, attackers try the same email and password everywhere else (“credential stuffing”).

• Use a password manager (Bitwarden, 1Password, KeePassXC or the manager built into your browser) so that every account has a long, random and different password. You then only remember one strong master passphrase.
• Length beats complexity. Current NIST guidance recommends long passwords or passphrases, checking against lists of breached passwords, and not forcing periodic changes unless there is evidence of compromise. For a password that is your only protection, NIST’s minimum is 15 characters; longer is better for anything that matters, and random ones from a password manager can be 20 or more.
• Turn on multi-factor authentication (MFA) on your Microsoft account, email, banking and cloud storage. An authenticator app or a hardware security key is much stronger than SMS codes.
• Use Windows Hello (PIN, fingerprint or face) to sign in to the PC. A Windows Hello PIN is tied to that specific device, with its keys protected by the TPM chip when one is available, so unlike a password it is not useful to an attacker on another machine.
• Check whether your addresses appear in known breaches at Have I Been Pwned and change any password that does.

Windows does not offer a separate “two-factor authentication” switch for a local account. MFA applies to your Microsoft account (and work or school accounts), which protects the account itself.

3. Treat email, links and downloads with suspicion

Phishing works because it targets people, not software. Signs to check before clicking:

• Urgency or threats (“your account will be closed in 24 hours”), or an unexpected request for a password, a code or payment.
• A sender address that only looks right (micros0ft-support.com). Hover over links to see where they really go, or type the website address yourself.
• Unexpected attachments, especially .zip, .iso, .lnk, .js and Office files that ask you to “enable macros” or “enable editing”.
• Software from unofficial sites, “cracked” programs and fake download buttons. Download only from the vendor’s site or the Microsoft Store, and check the file’s publisher when Windows prompts you.

Keep SmartScreen on (Windows Security > App & browser control > Reputation-based protection), because it warns about unknown downloads and malicious sites. If you suspect an email, do not reply to it or click; go to the real website separately or phone the company. If you did enter a password on a fake page, change it immediately from a clean device and check the account’s recovery settings.

4. Use the built-in Microsoft Defender and firewall, and check that they are on

Windows already ships with Microsoft Defender Antivirus and Windows Defender Firewall. For most home users they are effective enough that a second antivirus is unnecessary, and running two real-time scanners tends to cause conflicts.

1. Open Windows Security from the Start menu. It should show no red warnings under Virus & threat protection and Firewall & network protection.
2. Under Virus & threat protection > Manage settings, keep Real-time protection, Cloud-delivered protection and Tamper Protection on. Tamper Protection stops malware from switching Defender off.
3. Consider turning on Ransomware protection > Controlled folder access, which blocks unknown programs from changing files in Documents, Pictures and Desktop. It may prompt you to allow some legitimate apps.
4. Confirm the firewall profiles (Domain, Private, Public) are all on. From an administrator PowerShell you can check with Get-NetFirewallProfile | Format-Table Name, Enabled and Get-MpComputerStatus | Select AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated.
5. Do a full scan occasionally, and use Microsoft Defender Offline scan if you suspect a persistent infection.

Also use a standard (non-administrator) account for daily work. Malware that runs under a standard account is limited, and User Account Control will prompt before anything that needs administrator rights runs. (UAC does not stop malware from damaging your own files, which is why backups matter.) For laptops, turn on BitLocker or device encryption, so a lost or stolen device does not expose your files.

5. Back up your data (and test the restore)

Backups are your protection when everything else fails: ransomware, a failed disk, a lost laptop, or an accidental deletion. A simple rule is 3-2-1: keep three copies of important data, on two different kinds of storage, with one copy stored off-site (a cloud service or another location). Ideally that copy is also offline or immutable, so ransomware cannot alter it.

• Cloud sync (OneDrive, Google Drive) protects against a broken disk, but by itself it can sync ransomware-encrypted files. Keep file version history turned on so you can roll back.
• External drive: use File History or a backup tool, and disconnect the drive when it is not backing up, so ransomware cannot reach it.
• Test a restore now and then by opening a file from the backup. A backup you have never restored from is only an assumption.
• Keep your BitLocker recovery key and a list of important accounts somewhere safe outside the PC. If you ever lose the key, see how to regenerate a lost BitLocker recovery key.

Quick checklist

Check	Where to look
Windows fully updated	Settings > Windows Update
Apps updated	winget upgrade
Unique passwords and MFA	Password manager, Microsoft account security page
Defender, Tamper Protection, firewall on	Windows Security
Daily account is a standard user	Settings > Accounts > Family & other users (named “Other users” in some Windows 11 versions)
Disk encrypted	Settings > Privacy & security > Device encryption, or BitLocker
Backup exists and restores	File History, OneDrive, external drive

Common questions

Do I need to buy antivirus for Windows?

For most home users, no. Microsoft Defender consistently scores well in independent tests. Paid suites can add extras such as a VPN or identity monitoring, but they are not required for basic protection.

Is it safe to use public Wi-Fi?

HTTPS protects most web traffic, so it is much safer than it used to be. Still, set the network to Public in Windows, avoid sensitive tasks if you can, and use a VPN you trust if you must.

What should I do if I think my PC is infected?

Disconnect it from the network, run a full Microsoft Defender scan and an offline scan, change important passwords from a different device, and restore from a clean backup if it persists. On a work PC, tell your IT team first.

Sources

• Microsoft Learn: Windows security documentation
• Microsoft Learn: Windows 11 overview
• Microsoft Learn: Windows Hello for Business overview
• Microsoft Learn: Tamper protection
• Microsoft Learn: Controlled folder access
• NIST SP 800-63B: Digital Identity Guidelines, Authentication
• CISA: #StopRansomware Guide (includes backup advice)
• Microsoft Lifecycle: Windows 11 Home and Pro