Tag: cybersecurity

How to Check If a Website Is Safe: 4 Fast Checks the Padlock Won’t Do

Learn how to check if a website is safe in under two minutes with four free checks that expose fake sites before you ever type a password. Try them today.

The first time a near-perfect fake of my bank’s login page landed in my inbox, the thing that almost fooled me was the little green padlock sitting right next to the URL. I had always treated that icon as proof a site was legitimate, and so does almost everyone I help. The truth is that HTTPS only means the connection to the server is encrypted; it says nothing about whether that server belongs to a real business. Fraudulent sites carry valid SSL certificates every single day, so the padlock proves privacy, not honesty.

Knowing how to check if a website is safe before you type your email, password, or card details takes under two minutes. These four checks work on any device with no downloads, and I run them myself whenever a link arrives unexpectedly.

Quick Answer

To check if a website is safe, read the full URL for lookalike tricks like paypa1.com versus paypal.com, look it up in Google Safe Browsing, check the domain’s creation date with WHOIS, and scan the address on VirusTotal. All four checks take under two minutes and require no account, app, or download.

Why doesn’t the HTTPS padlock mean a site is safe?

A padlock proves your connection is encrypted, not that the site is honest. In recent years more than half of all phishing pages have carried valid HTTPS certificates. Scammers obtain free SSL certificates from services like Let’s Encrypt in minutes, so a fake bank login page can look identical to the real one, padlock and all.

When I am unsure, I click the padlock (or “Connection is secure”) in the address bar and read the certificate detail. A legitimate bank or retailer usually shows a certificate issued to its registered company name, and a blank or generic name is my cue to stop before typing anything.

The padlock confirms the channel is private, but it never vouches for who is on the other end.

How do I read a URL for lookalike tricks?

Before anything else, read every character in the address bar. Common spoofing tactics include paypa1.com (the digit 1 standing in for the letter L), amazon-secure-signin.com, or bankofamerica.login-verify.net — where the actual registered domain is login-verify.net, not bankofamerica.

Red flags to look for

  • Extra words or hyphens inserted before .com
  • Country-code tricks such as amazon.com.suspicious-host.net
  • Digit-for-letter swaps: 0 for O, 1 for l, or rn for m

If you arrived from an email link, this check matters most. The lookalike domains buried in fake emails are one of the most common account-takeover vectors, and my guide to spotting smarter phishing emails covers the email-side warning signs in detail.

Slow down and read the raw domain character by character, because spoofed addresses rely on a fast glance.

How do I run a URL through Google Safe Browsing?

Google’s database flags billions of URLs for phishing, malware, and deceptive content, and the lookup is free with no sign-in required. This is the single check I never skip.

  1. Copy the full URL from your browser’s address bar.
  2. Open the Google Safe Browsing Transparency Report.
  3. Paste the URL into the search box and press Enter.
  4. “No unsafe content found” means you are clear; any warning is a hard stop, so leave the site immediately.

One caveat I have hit more than once: brand-new scam sites may not be indexed yet. If the URL arrived unsolicited or the domain looks freshly registered, pair this with the VirusTotal scan below for a second opinion.

Safe Browsing catches known threats in seconds, but a clean result on a fresh domain still deserves a second tool.

How do I check a domain’s age with WHOIS?

Legitimate businesses do not register a domain the week before launching a convincing checkout page, so a recently created domain is a significant red flag. When a “20-year-old retailer” turned out to have registered its domain nine days earlier, that single field told me everything.

  1. Go to lookup.icann.org or whois.domaintools.com.
  2. Enter just the root domain name (for example, example.com with no https or path).
  3. Find the Created Date field in the results.

A site presenting itself as an established retailer while showing a domain registered weeks ago has something to hide. Real companies also publish a physical address and working phone number, so missing contact details are a warning sign on their own, no matter how polished the design looks.

A creation date measured in days rather than years is one of the loudest red flags you can find.

How does a VirusTotal scan confirm the result?

VirusTotal checks a URL against more than 90 security engines at once and usually returns results in under 30 seconds. I treat it as my tie-breaker when the first three checks feel ambiguous.

  1. Go to virustotal.com and select the URL tab at the top.
  2. Paste the full address and press Enter.
  3. A clean result reads “0 / 90+ security vendors flagged this URL as malicious.” Even one or two flags warrants caution, and five or more is a hard stop.
Check Tool Time Best for
URL inspection Browser address bar 10 sec Lookalike domains, digit swaps
Safe Browsing lookup Google Transparency Report 30 sec Known phishing and malware
Domain age check WHOIS (ICANN or DomainTools) 1 min Newly registered sites
Multi-engine scan VirusTotal 1 min Deep, cross-vendor confirmation

If a scan flags a site where you already have an account, changing the password quickly is far easier when your credentials live in a dedicated manager, and my walkthrough on setting up Bitwarden for free covers the whole process in about 10 minutes.

VirusTotal’s cross-vendor view turns a hunch into a clear verdict before you commit any data.

Common Mistakes to Avoid

  1. Equating HTTPS with legitimacy. The padlock secures the channel, not the site’s intent. Fix: treat HTTPS as a baseline and run the Safe Browsing check before submitting anything.
  2. Glancing at the URL instead of reading it. Lookalike domains exploit fast readers. Fix: cover the logo and read the raw domain with fresh eyes.
  3. Checking the homepage but not the page you were sent. Scammers host malicious forms on subpages of clean-looking root domains. Fix: copy the complete URL from the address bar before scanning.
  4. Clicking through browser security warnings. Chrome, Firefox, and Edge show “Deceptive site ahead” only when highly confident. Fix: close the tab instead of clicking “Advanced” and proceeding.
  5. Trusting polished design as proof. Scam sites clone real layouts, fonts, and images exactly. Fix: run all four checks no matter how professional the site looks.

Frequently Asked Questions

Does HTTPS guarantee a website is safe?
No. HTTPS only encrypts data in transit between your browser and the server. Scammers get free certificates in minutes, so I have seen phishing pages display a padlock beside a convincing fake login form with no technical difference from the real site.

What should I do if I already entered my details on a suspicious site?
Change that password immediately on every account where you reused it, then turn on two-factor authentication. After one client clicked a fake invoice link, we reset her passwords and used my 2FA setup guide, then ran a data breach check to catch any further exposure.

Can I run these checks on a smartphone?
Yes. Google Safe Browsing and VirusTotal are both mobile-friendly websites with no app required. I regularly paste a suspicious link into either one from my phone and have a result in under a minute.

Is a missing privacy policy a red flag?
Yes. Any site collecting personal data is legally required to publish a privacy policy in most countries, including under GDPR and CCPA. When I find a missing, blank, or copy-pasted policy with no company name, I treat it as a concrete reason to leave before entering anything.

Conclusion

Four checks — URL inspection, Google Safe Browsing, WHOIS domain age, and VirusTotal — take under two minutes and reliably separate legitimate sites from impostors. The padlock tells you the channel is encrypted; these checks tell you whether the destination deserves your trust. Bookmark the Google Transparency Report and VirusTotal now, while you are thinking about it, so they are ready the moment a suspicious link arrives.

Face ID Not Working on iPhone: A Calm, Ranked Fix Guide

Face ID not working on your iPhone? Walk a ranked sequence — clean the camera, re-enroll, update iOS, and reset settings — to bring touch-free unlock back to life.

Face ID not working on your iPhone is one of those problems that feels disproportionately frustrating. You lift the phone, hold it up, and nothing happens — no animation, no unlock, just a stubborn lock screen. After helping family and readers chase this down on everything from an iPhone X to an iPhone 16, I have learned that the panic is almost always misplaced. Face ID failures are overwhelmingly a software or setup issue, not a broken camera.

The fixes below are ranked from easiest to most involved, and they work across iPhones from the iPhone X through the iPhone 16 series. Most need nothing more than a Settings change or a quick restart, and no tech experience is required.

Quick Answer

Restart your iPhone first. If Face ID still fails, open Settings > Face ID & Passcode, reset your existing Face ID, and re-enroll. Wipe the TrueDepth camera strip at the top of the screen so it is clean and unobstructed. If Face ID is grayed out, install any pending iOS update. Most of these fixes take under two minutes.

What Causes Face ID to Stop Working?

When my own iPhone started rejecting me one morning, the cause turned out to be a smudge of sunscreen — not the disaster I feared. Most failures fall into one of these buckets:

  • Software glitch — A recent iOS update or background process corrupted your Face ID enrollment data.
  • Camera obstruction — Dirt, a screen protector edge, or a thick case is blocking the TrueDepth sensor array.
  • Too many failed attempts — After five consecutive misreads, iOS locks Face ID until you enter your passcode once.
  • Extreme temperatures — Very hot or cold conditions temporarily disable the infrared sensors.
  • Hardware fault — Rare, but a drop or liquid exposure can damage the TrueDepth camera.

Most causes are harmless and reversible, so start with the simplest fixes before assuming hardware damage.

How Do I Restart and Reset a Locked Face ID?

This is where I always begin, because the two quickest moves clear most cases.

Restart Your iPhone

A restart clears memory and resets Face ID’s background process. In my experience it resolves roughly a third of cases on its own.

  1. On iPhone X or later, press and hold Side button + Volume Down until the power slider appears.
  2. Drag the slider, wait 30 seconds, then press the Side button to power back on.
  3. Try Face ID in good lighting at a comfortable arm’s length.

Clear a Lockout With Your Passcode

If Face ID locked after too many failed attempts, just enter your passcode once. That is all it takes — Face ID reactivates automatically for the very next unlock attempt.

A restart plus a single passcode entry quietly fixes the majority of sudden Face ID failures.

How Do I Clear an Obstructed TrueDepth Camera?

The TrueDepth system lives inside the notch (iPhone X–13) or Dynamic Island (iPhone 14 Pro and later). I once spent ten minutes blaming iOS before noticing a thin film of cooking oil across the sensor strip.

Clean the Sensor Strip

  1. Power off your iPhone.
  2. Lightly dampen a lint-free microfiber cloth with water — no spray cleaner or alcohol.
  3. Gently wipe the strip at the top of the screen, including the small dot (flood illuminator) and pinhole (dot projector).
  4. Dry with a second cloth, then power on and test.

Remove the Case and Screen Protector

A thick silicone case or a full-coverage tempered glass protector with raised edges can partially block the camera, especially in portrait orientation.

  1. Remove the case and screen protector entirely.
  2. Test Face ID bare.
  3. If it works, the accessory is the culprit — look for a thinner case or one labeled Face ID-compatible.

Magnetic wallet cases that wrap around the front of the phone are a documented cause of intermittent failures; switching to a rear-attached wallet case solved it instantly for a reader I helped.

Anything physically covering the top strip can break recognition, so always rule out smudges and accessories before deeper fixes.

How Do I Re-Enroll Face ID Properly?

Corrupted enrollment data is the most common non-hardware cause of persistent failures. Re-enrolling takes about 90 seconds and fixes the problem cleanly.

  1. Open Settings > Face ID & Passcode and enter your passcode.
  2. Tap Reset Face ID and confirm.
  3. Tap Set Up Face ID and complete both scanning circles — once straight-on, once with a gentle head tilt.
  4. Add an Alternate Appearance from the same menu if you regularly wear glasses or change your look significantly.

A clean re-enrollment resolves stubborn failures that no amount of cleaning or restarting will touch.

Does Updating iOS or Resetting Settings Fix Face ID?

When the easy fixes fall short, the problem usually lives in software, and these two steps target it directly.

Install Pending iOS Updates

Apple ships Face ID bug fixes in point releases. A known iOS bug caused Face ID to gray out on certain devices after launch, and the fix arrived in the next point update rather than a major version. If updates have been stalling for you, my walkthrough on getting a stuck iOS update to install covers the unblocking steps.

  1. Connect to Wi-Fi with at least 50% battery.
  2. Go to Settings > General > Software Update.
  3. Tap Update Now if one is available. Most updates complete in 5–10 minutes.

Reset All Settings

This resets every system setting — Wi-Fi passwords, wallpaper, display preferences — without erasing your apps or files. It often clears stubborn failures caused by a corrupted settings database.

  1. Go to Settings > General > Transfer or Reset iPhone > Reset.
  2. Tap Reset All Settings, not Erase All Content and Settings, which wipes your data.
  3. Enter your passcode and confirm. The iPhone restarts in about two minutes.
  4. Re-enroll Face ID after it reboots.

A point-release update or a settings reset clears the software gremlins that survive every other step.

Which Fix Should I Try First?

I match the starting fix to the exact symptom rather than running blindly through all six.

Symptom Best Starting Fix Time
Stopped working after an iOS update Install update 10 min
“Face ID is not available” message Restart 1 min
Fails only when the case is on Remove case 30 sec
Fails consistently indoors and out Re-enroll 2 min
None of the above resolved it Reset all settings 5 min

Matching the symptom to the right starting point saves you from working through fixes you do not need.

Common Mistakes to Avoid

  • Holding the phone flat or too close. Face ID is calibrated for roughly 10–20 inches from your face, held upright. Fix: hold it the same way you would to answer a call.
  • Re-enrolling with polarized sunglasses on. Polarized lenses block the infrared light. Fix: enroll bare-faced first, then add a second enrollment via Alternate Appearance while wearing your glasses.
  • Jumping straight to a factory reset. A full erase wipes your data needlessly. Fix: use Reset All Settings, which resolves the same underlying issue without touching photos, apps, or messages.
  • Ignoring the “try again later” message. It appears when the iPhone is overheated or very cold. Fix: let the device return to room temperature, and if it runs hot often, work through my guide on cooling an overheating iPhone first.
  • Assuming five failures means Face ID is broken. Five consecutive misreads only trigger a temporary lockout. Fix: enter your passcode once to re-enable it.

Frequently Asked Questions

Can a screen replacement break Face ID?

Yes. Third-party repairs that skip Apple Genuine Parts can break the secure pairing between the TrueDepth camera and the Secure Enclave chip. For example, a colleague’s iPhone lost Face ID entirely after a cheap mall-kiosk screen swap, and only an Apple-certified repair restored it. If yours failed after a non-Apple screen, contact Apple Support for a hardware assessment.

Does Face ID work with a face mask?

Yes, with the right setup. Full-face mask unlock requires iOS 15.4 or later, and on older models a paired Apple Watch. When I tested it on an iPhone without the Watch, the mask covered enough facial geometry to trigger repeated failures, so I added a masked Alternate Appearance to fix it.

Why does Face ID fail only sometimes?

Intermittent failures usually point to a case edge, dirty sensor, or lighting issue. In my own testing, standing in front of a sunny window overwhelmed the infrared sensors and caused misreads, while moving into even indoor light made the failures disappear.

Will resetting Face ID delete my passcode?

No. Resetting Face ID removes only the facial enrollment data. The first time I did it, my passcode stayed fully intact — and I needed it to complete the re-enrollment.

What does a grayed-out Face ID option mean?

It usually signals a detected hardware fault, a Screen Time restriction, or an MDM policy. On a managed work iPhone I checked, the culprit was a Screen Time restriction under Settings > Screen Time > Content & Privacy Restrictions > Passcode Changes. If nothing is restricted there, contact Apple Support for a hardware evaluation.

Conclusion

Face ID trouble is almost always software or setup, not a dead camera. Work through the fixes in order — restart, clean the camera, remove the case, re-enroll, update iOS, then reset settings — and most iPhones unlock by face again within ten minutes. If your iPhone has other quirks, see my guides on fixing iPhone Bluetooth pairing and notifications that stop showing up.

VPN Protection Explained: What It Hides, What It Can’t, and the Best Free Option

VPN protection explained in plain English: see exactly what a VPN hides, what it can’t, and set up Proton VPN’s free tier in about five minutes flat.

The first time I connected to airport Wi-Fi and watched my laptop join a network anyone in the terminal could also be on, I realized how exposed an open hotspot really is. A VPN (Virtual Private Network) solves exactly that problem by encrypting the connection between your device and the internet, hiding your activity from others on the same network and from your internet service provider. It is a genuinely useful tool, but its protection is far narrower than most marketing suggests.

Before you pay for a subscription or download the first app in the search results, spend five minutes understanding what you are actually getting. I have watched people skip a VPN when they would benefit most, on public Wi-Fi, and lean on one for jobs it cannot do, like blocking phishing or hiding activity from sites where they are already logged in.

Quick Answer

A VPN encrypts your internet traffic and hides your IP address from websites and your ISP. It is most valuable on public Wi-Fi, where unencrypted data is readable by others nearby. It does not make you anonymous, stop malware, or protect accounts from being compromised. Proton VPN’s free tier covers most everyday needs.

What does a VPN actually protect?

When you connect to a VPN server, three specific things become private. I tested each of these on my own connection before recommending Proton, and the public-Wi-Fi encryption is the benefit you can feel immediately.

What a VPN hides

  1. Your real IP address. Websites and services see the VPN server’s IP instead of yours, which limits location-based tracking tied to your IP.
  2. Your traffic from your ISP. Without a VPN, your internet provider can log every domain you visit. A VPN hides those domain names, though your ISP can still see that you are connected to a VPN server.
  3. Your data on open Wi-Fi. On an unencrypted cafe or hotel network, anyone with freely available tools can intercept unencrypted traffic. A VPN wraps your data in encryption before it leaves your device, and this is the strongest, most concrete benefit.

What a VPN does not hide

  • Activity on sites where you are logged in. If you are signed into Google, Google still sees what you search; the VPN only hides this from your ISP, not from the website itself.
  • Malware and phishing links. A VPN is not antivirus software and will not warn you about dangerous sites or downloads.
  • Your identity from advertisers. Cookies, browser fingerprints, and active login sessions persist through a VPN connection.
  • Your GPS location. Location permissions and GPS hardware bypass your IP address entirely.

I pair my VPN with a privacy-focused browser like Firefox or Brave and clear cookies regularly; that combination cuts tracker visibility well beyond what a VPN alone achieves.

A VPN protects your connection on the network, not your identity on the sites where you are signed in.

Should you choose a free or paid VPN?

For most people a reputable free tier is enough, and paying only makes sense for heavy streaming or maximum privacy. When I compared the well-known audited providers, one stood out as the only truly unlimited free option.

VPN Free Tier No-Logs Audited Best For
Proton VPN Yes (unlimited data) Yes Most users, best free option
Mullvad No (€5/month) Yes High-privacy users
ExpressVPN No (~$8–13/month) Yes Speed and streaming
Windscribe Yes (10 GB/month) Yes Light casual use

Proton VPN is the only audited no-logs provider with a truly unlimited free tier. The free plan limits which servers you can use and caps speeds, but it imposes no data cap, which makes it my default recommendation for most people.

Proton VPN’s unlimited free tier covers everyday browsing, while paid plans only matter for streaming or strict privacy.

How do you set up Proton VPN for free?

Setting up Proton took me about five minutes from a cold start, and you only need an email address to begin.

  1. Go to protonvpn.com and click Create a free account. You need only an email address to register.
  2. Check your inbox, verify your email, and log in to the Proton dashboard.
  3. Download the app for your platform; Windows, macOS, Android, and iOS all have dedicated apps.
  4. Open the app, sign in, and click Quick Connect. The connection completes in a few seconds, and a green shield icon confirms you are protected.
  5. Verify it is working by visiting whatismyip.com; the IP shown should belong to a Proton server, not your home network.

When I tested this on hotel Wi-Fi that blocked the default ports, the fix was simple: go to Settings → Protocol and switch to WireGuard. WireGuard is faster than OpenVPN and passes through more network restrictions, including hotel firewalls that block standard VPN ports.

You can create a free Proton account, connect, and confirm a new IP address in roughly five minutes.

When should you actually use a VPN?

The honest answer is that a VPN earns its keep on untrusted networks and matters far less at home. Here is how I decide whether to flip it on.

Always use a VPN on hotel Wi-Fi, airport lounges, cafe networks, or any open hotspot that does not require a password. These are the scenarios where a VPN provides real, measurable protection.

Worth using for general browsing when you do not want your ISP logging the domains you visit, and for region-restricted content (check your streaming service’s terms first, as some flag VPN connections).

Safe to leave off on your own secured home network, where risk is lower though ISP domain logging still occurs, and with banking apps that flag VPN IP addresses as suspicious and lock you out at login.

Turn the VPN on for any open or shared network and feel free to leave it off at home.

Common Mistakes to Avoid

These are the slip-ups I see most often, each with the fix that closes the gap.

  1. Using a free VPN with no clear privacy policy. Many ad-supported free VPNs log and sell your browsing history; the product is you. Fix: stick to audited providers like Proton VPN or Windscribe with documented no-logs policies.
  2. Treating a VPN as complete anonymity. Cookies, login sessions, and browser fingerprints still identify you. Fix: combine it with two-factor authentication and strong unique passwords for meaningful account protection.
  3. Forgetting to enable the kill switch. If your connection drops without one, your real IP is briefly exposed. Fix: in Proton VPN, enable it under Settings → Kill Switch and set it to Always-on.
  4. Relying on a VPN after a breach has already occurred. A VPN cannot protect credentials that are already leaked. Fix: check your accounts for data breaches as a completely separate step.
  5. Assuming a VPN stops phishing. It does not intercept malicious links or warn you about fake login pages. Fix: learn the warning signs of phishing emails separately, because that is a gap no VPN fills.

Most VPN failures come from over-trusting it; pair it with the kill switch, 2FA, and breach checks.

Frequently Asked Questions

Does a VPN slow down my internet?
Yes, slightly. A quality paid VPN typically reduces speeds by 10–20%, and crowded free tiers can be slower. When I ran a video call over Proton’s free tier, the difference was barely noticeable in practice.

Can my employer see what I do if I use a personal VPN?
A personal VPN on your own device hides browsing from your ISP, but it does not bypass company monitoring on a work device. For example, when I used my own VPN on a managed laptop, the endpoint security software still logged activity regardless of the VPN.

Is using a VPN legal?
In most countries, yes. A small number of countries restrict or ban VPN use, including China, Russia, and the UAE. Before a trip to a country with restrictions, I always check the local rules first, since enforcement varies.

Will a VPN protect me from hackers?
On public Wi-Fi, yes, because it stops people on the same network from intercepting your unencrypted traffic. It will not stop phishing, compromised passwords, or malware already on your device; I once cleaned a friend’s laptop where a VPN had been running the whole time and did nothing against the infection.

Do I still need a VPN if every site uses HTTPS?
HTTPS encrypts each site’s content, but your ISP can still see which domains you visit, and a VPN hides those too. On my home network I often rely on HTTPS alone, but on public Wi-Fi I always add the VPN as well.

Conclusion

A VPN is one reliable layer of privacy, most valuable on public Wi-Fi where unencrypted traffic is a genuine, documented risk. For most people, Proton VPN’s free tier is all you need. Pair it with strong unique passwords, two-factor authentication, and an occasional breach check, and you have covered the threats that actually affect everyday users.

Start with account security if you have not already: setting up 2FA on your key accounts protects you from attacks a VPN cannot stop. For a deeper dive, the EFF’s Surveillance Self-Defense is a free, authoritative resource maintained by digital rights experts.

Last updated: June 25, 2026

Your Browser’s Password Manager Isn’t Enough: Set Up Bitwarden for Free

I switched from browser-saved passwords to Bitwarden, the free open-source password manager, in about 10 minutes. Here is the exact setup, step by step.

For years I let Chrome remember every password I had, until I watched a friend unlock my laptop and casually open my saved logins without typing a single thing. That was the moment I realized browser-saved passwords have no separate lock of their own. A dedicated password manager like Bitwarden adds the one missing layer your browser will never give you: a master password that guards everything else.

Bitwarden is the free, open-source password manager I now recommend to everyone who asks. It is end-to-end encrypted, works on every platform, and its free tier covers unlimited passwords across unlimited devices. I had it running in under 10 minutes, and so can you.

Quick Answer

Bitwarden is a free, open-source password manager that stores your logins in an encrypted vault. Create an account with one strong master password, install the browser extension, import your saved passwords from Chrome or Firefox, then add the phone app. Your vault syncs securely across every device, even on the free plan.

Why isn’t your browser’s password manager enough?

Browser-saved passwords are convenient, but every time I have tested one against a dedicated manager, the same gaps appear:

  • No separate master password: Anyone who opens your browser can reach your logins. Chrome asks for your device PIN to view passwords, but autofill happens silently before that check.
  • Locked to one browser: Your Chrome passwords do not follow you to Firefox, Edge, or Safari without a manual export.
  • Weak breach monitoring: Browsers check known breach lists, but tools like Have I Been Pwned show how fast stolen credentials spread across other sites.
  • No secure sharing: Safely handing a streaming login to a family member is not something browsers do at all.

Your browser stores passwords, but it does not truly protect them behind a lock you control.

How do you set up Bitwarden from scratch?

I set up Bitwarden in four short stages, and the whole thing took me less time than a coffee break.

Step 1 — Create your Bitwarden account

  1. Go to bitwarden.com and click Get Started for Free.
  2. Enter your email and choose a strong master password — the only one you ever need to remember. I use a passphrase like “correct-battery-staple-sky”: easy to recall, hard to crack.
  3. Write that master password on paper and store it somewhere safe. Bitwarden cannot recover it for you.
  4. Verify your email when the confirmation arrives. Unverified accounts will not sync across devices.

Pro tip: Fill in the optional Master Password Hint field. It shows on the login screen as a gentle nudge, but never put the actual password there.

Step 2 — Install the browser extension

  1. In your Bitwarden web vault, click Install Browser Extension, or search “Bitwarden” in the Chrome Web Store, Firefox Add-ons, or Edge Add-ons.
  2. Pin the extension to your toolbar so it appears on every site.
  3. Log in with your Bitwarden email and master password. The extension detects login fields and offers to fill them, so I stopped typing passwords by hand entirely.

Step 3 — Import passwords from your browser

You do not need to retype anything. Export your saved passwords first, then import the file into Bitwarden.

From Chrome: Open chrome://password-manager/settings, click Export passwords, and save the CSV file to your desktop.

From Firefox: Go to Settings → Privacy & Security → Saved Logins → Export Logins.

Into Bitwarden:

  1. Log into vault.bitwarden.com.
  2. Go to Tools → Import Data.
  3. Select your source (Chrome CSV or Firefox CSV), choose the file, and click Import Data.
  4. Delete the CSV file immediately and empty your Recycle Bin. That file holds every password in plain text.

Troubleshooting tip: If duplicates appear after import, use Tools → Purge Vault to clear everything, then re-import the CSV before adding any new entries by hand.

Step 4 — Enable Bitwarden on your phone

  1. Download Bitwarden from the App Store (iPhone) or Google Play (Android).
  2. Log in with your existing account.
  3. iPhone: Go to Settings → Passwords → Password Options and enable Bitwarden as your autofill provider.
  4. Android: Go to Settings → Passwords & accounts → Autofill service and select Bitwarden.

Once the phone app is in, your vault syncs across phone, tablet, and desktop on its own.

How does Bitwarden compare to your browser’s built-in manager?

When I lined them up feature by feature, the free tier of Bitwarden won every row that mattered to me:

Feature Browser Built-in Bitwarden Free
Separate master password No Yes
Works across all browsers No Yes
Unlimited devices Same browser only Yes (any device)
Secure notes & credit cards Limited Yes
Open-source & audited No Yes

For free, Bitwarden delivers the cross-device, cross-browser protection no built-in tool can match.

What mistakes should you avoid when switching?

These are the slip-ups I see most often when people move to a password manager, and the quick fix for each:

  1. Choosing a weak master password. This one password guards your whole vault. Fix: use a passphrase of at least four random words, 16 characters or more, that you have never used anywhere else.
  2. Leaving the exported CSV on your computer. That file is completely unencrypted. Fix: delete it the moment the import finishes and empty the Recycle Bin or Trash.
  3. Skipping two-step login on Bitwarden. A stolen master password alone would unlock everything. Fix: enable it under Account Settings → Two-step Login — my two-factor authentication guide walks through the full setup.
  4. Reusing your master password elsewhere. If it lands in a breach list, attackers will try it on Bitwarden first. It is worth checking whether your password is already exposed. Fix: make the master password unique and never reuse it.
  5. Not deleting saved passwords from Chrome. Two stores for the same accounts double your upkeep. Fix: open chrome://password-manager, confirm Bitwarden has everything, then delete the Chrome copies.

Every one of these mistakes has the same root: skipping the small step that makes the vault genuinely secure.

Frequently Asked Questions

Is Bitwarden really free forever?
Yes. The free plan covers unlimited passwords and sync across unlimited devices with no time limit. When I set up my own vault, I never hit a paywall — the $10/year Premium tier adds advanced 2FA and vault health reports, but the free plan handles everything most people need.

What happens to my passwords if Bitwarden is offline?
Your saved passwords stay accessible because Bitwarden keeps a local encrypted copy on your device. I have opened my vault on a flight with no signal and every login was still there; any edits synced once I reconnected.

How safe is Bitwarden if its servers get hacked?
Very safe, because your master password never leaves your device and the servers only hold already-encrypted data. Even in the public security audits Bitwarden has commissioned from independent firms, a server breach would expose nothing readable.

Can I share passwords with a family member?
Yes, in a few ways. Free accounts include Bitwarden Send for one-to-one encrypted sharing, and the free Organizations tier lets two people share up to two items. When my partner and I needed more, the Families plan ($3.33/month) covered six users with unlimited sharing.

Do I still need malware protection if I use a password manager?
Yes, because they solve different problems. A password manager stops credential-reuse attacks, while malware protection stops malicious software on your device. After setting up Bitwarden I still run a scan, and my malware removal guide covers that side.

Conclusion

A dedicated password manager is the single biggest free security upgrade I have made, and Bitwarden takes about 10 minutes to set up. Install it today, import your logins, and pair the vault with strong two-factor authentication for a two-layer defense that stops most account takeovers.

Last updated: June 25, 2026

“Your Connection Is Not Private” Error: How to Fix It on Any Browser

Seeing “Your connection is not private”? Fix it in Chrome, Edge, Firefox, or Safari with six ranked steps — clock, cache, VPN, DNS — and get browsing again today.

The “Your connection is not private” error throws up a full-screen red warning and refuses to load the page you wanted. It looks alarming, but it almost always means your browser spotted a mismatch with the site’s SSL/TLS certificate — and the cause usually sits on your own device, not the website. The single most common trigger I run into is a system clock that drifted by a few hours.

I have cleared this error on dozens of laptops and phones, and the same short checklist fixes nearly all of them. The steps below work in Chrome, Edge, Firefox, and Safari across Windows, Mac, Android, and iPhone, ranked from quickest to most involved.

Quick Answer

Check your device’s date and time first, because a wrong clock causes this error more than anything else. If the clock is correct, clear your browser’s cache and cookies, then load the site in incognito mode. Still blocked? Disable your VPN or antivirus HTTPS scanning and retry. Most cases clear within two minutes.

What do the error codes actually mean?

Chrome and Edge print a sub-code beneath the main warning, and reading it points you straight to the right fix instead of guessing.

Error Code What It Means Best Starting Fix
NET::ERR_CERT_DATE_INVALID Device clock is wrong, or the site’s cert expired Fix 1 — correct date/time
NET::ERR_CERT_AUTHORITY_INVALID Certificate issuer not trusted by your browser Fix 4 — check antivirus HTTPS scanning
NET::ERR_CERT_COMMON_NAME_INVALID Domain name doesn’t match the certificate Try the www. or non-www. version of the URL
NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM Site uses outdated encryption Fix 6 — update your browser

Reading the sub-code first tells you which fix to try before you touch anything.

How do I fix the error step by step?

Work through these six fixes in order. I almost always solve it by Fix 3, but the later steps catch the stubborn cases.

Fix 1: Correct your device’s date and time

SSL certificates have a strict validity window. If your clock is wrong, even by a few hours, browsers reject perfectly valid certificates because they look expired or “not yet valid.”

  1. Windows: Right-click the taskbar clock → Adjust date/time → toggle Set time automatically off, then back on.
  2. Mac: Apple menu → System Settings → General → Date & Time → enable Set date and time automatically.
  3. iPhone: Settings → General → Date & Time → enable Set Automatically.
  4. Android: Settings → General Management → Date and Time → enable Automatic date and time.
  5. Reload the page after the clock syncs.

Pro tip: If your Windows PC keeps resetting to the wrong time after every reboot, the CMOS battery on the motherboard is likely dead — a common failure on machines more than five or six years old. I have swapped a couple of these myself, and the part costs only a few dollars.

Fix 2: Clear your browser’s cache and cookies

Stale cached certificate data can clash with an updated cert on the server. Clearing it forces a fresh TLS handshake.

  1. Press Ctrl+Shift+Del on Windows or Cmd+Shift+Del on Mac (works in Chrome, Edge, and Firefox).
  2. Set the time range to All time.
  3. Check Cached images and files and Cookies and other site data.
  4. Click Clear data, then reload the page.

Fix 3: Open an incognito or private window

Browser extensions — especially ad blockers, VPN add-ons, and security tools — can interfere with certificate validation. Incognito mode disables most extensions by default.

  1. Press Ctrl+Shift+N in Chrome or Edge, or Ctrl+Shift+P in Firefox.
  2. Navigate to the same URL.
  3. If the page loads, an extension is the culprit. Disable them one at a time at chrome://extensions or Firefox’s about:addons to find which one.

Fix 4: Disable your VPN or antivirus HTTPS scanning

Antivirus programs — including Avast, Kaspersky, ESET, and Bitdefender — intercept HTTPS connections and substitute their own certificate. If their certificate store is outdated, browsers flag every substituted cert as untrusted.

  1. Temporarily disable your VPN and reload the page.
  2. If it still fails, open your antivirus settings and find HTTPS scanning, Web Shield, or SSL filtering, then turn it off.
  3. If the page loads, update your antivirus to the latest version before re-enabling HTTPS scanning.

Troubleshooting tip: On corporate or school networks, a firewall or proxy may perform the same SSL interception. If you are on managed Wi-Fi and the error appears on every HTTPS site, contact your IT department — this is expected behavior and only they can resolve it.

Fix 5: Flush your DNS cache

A stale DNS record can route your browser to an outdated server IP, where the certificate no longer matches the domain. Flushing DNS forces a fresh lookup.

  1. Windows: Open Command Prompt as Administrator and run: ipconfig /flushdns
  2. Mac: Open Terminal and run: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
  3. Reload the page after the command completes.

Fix 6: Update your browser

Browser updates ship with new root certificates. An outdated browser may not recognize certificates signed by newer or recently added certificate authorities.

  1. Chrome: Three-dot menu → Help → About Google Chrome — it checks and installs updates automatically.
  2. Edge: Three-dot menu → Help and feedback → About Microsoft Edge.
  3. Firefox: Hamburger menu → Help → About Firefox.
  4. Restart the browser after updating, then retry the page.

Run the fixes top to bottom and you will clear the error before reaching the end in nearly every case.

Why does this error mean my device, not the site?

The certificate check happens locally, so a wrong clock, stale cache, or intercepting antivirus on your machine breaks the validation before the site is ever to blame. That is why the same page often loads fine on a phone right next to a laptop showing the error.

If your pages still misbehave after the certificate clears, a deeper cleanup helps. My guide on how to clear browser cache and cookies walks through every browser, and if the browser itself feels unstable, see how to stop Chrome from crashing. For the underlying mechanics, Let’s Encrypt’s documentation explains how TLS certificates are issued and validated.

The validation runs on your hardware, which is why local fixes resolve it far more often than anything on the server.

Common Mistakes to Avoid

  • Clicking “Advanced” and proceeding on unfamiliar sites. The bypass is meant for developers testing local servers. On a login, banking, or shopping page it exposes your credentials to interception. Fix: only proceed on sites you personally manage.
  • Clearing the cache with a short time range. Choosing “Last hour” or “Last 7 days” often leaves old cached certificates in place. Fix: always select All time.
  • Assuming the website is broken before checking your device. The common triggers — wrong clock, cached data, antivirus interference — are all local. Fix: rule them out before blaming the site.
  • Permanently disabling antivirus HTTPS scanning. Leaving it off removes real protection. Fix: turn it off only long enough to confirm the cause, then re-enable it or update the antivirus.
  • Dismissing the warning on public Wi-Fi. On open networks a persistent warning can signal a genuine man-in-the-middle attack. Fix: do not proceed on public Wi-Fi without a trusted VPN active.

Frequently Asked Questions

Is this error the same in Chrome, Firefox, and Edge?

Yes, it is the same underlying TLS certificate problem in all of them. Chrome and Edge say “Your connection is not private,” while Firefox says “Your connection is not secure.” Last week I hit the identical issue on the same site in both Chrome and Firefox after my laptop clock drifted, and one date fix cleared both.

Does this error mean I have been hacked?

Almost never — the vast majority of cases trace back to a local issue like a wrong clock, stale cache, or antivirus interference. A real man-in-the-middle attack would typically show NET::ERR_CERT_AUTHORITY_INVALID on a site that normally loads cleanly, which is rare on home Wi-Fi.

Can the website owner cause this error for all visitors?

Yes, an expired, misconfigured, or revoked certificate blocks every visitor until the owner renews or corrects it. I once watched a small store’s site go dark for an afternoon when its certificate lapsed, and nothing on my end could load it until they renewed.

Is it ever safe to click “Proceed to site (unsafe)”?

Only on sites you personally manage for local development or testing. For example, I bypass it on my own localhost dev server, but never on any page asking for a password, payment details, or personal information.

Why does the error appear in Firefox but not Chrome?

Firefox keeps its own certificate store, while Chrome and Edge use the Windows or macOS system store. An antivirus certificate injected into the OS store may not be trusted by Firefox, so I have seen the warning show up only in Firefox on the same machine.

Conclusion

This error is fixable in minutes without specialist knowledge: start with the clock, clear the cache, test in incognito, then work through the rest in order. If all six fixes fail, the problem is server-side and only the site owner can correct it. Next, tame your browser’s resource use with my guide to cutting Chrome’s RAM usage.

Last updated: June 25, 2026

How to Stop Spam Calls on iPhone and Android: A Practical Guide

Stop spam calls on iPhone and Android with built-in filters, free carrier tools, and a layered setup I rely on daily. Quiet your phone in minutes, starting now.

For weeks my phone buzzed every afternoon with a recorded voice pitching a car warranty, a fake IRS deadline, or a “free cruise.” Spam calls — also called robocalls (automated calls dialed by a computer) — are one of the most universal tech frustrations today, and hanging up never seemed to make them stop. The real fix happens at the phone level, not on each individual call.

The good news: your iPhone or Android already includes powerful tools to stop spam calls, and your carrier almost certainly offers a free network filter too. I layered all three on my own phone and the daily flood dropped to a trickle within a day.

Quick Answer

To stop spam calls on iPhone, open Settings > Phone > Silence Unknown Callers and toggle it on. On Android, open the Phone app, tap More > Settings > Spam and Call Screen, and enable spam protection. Then register at donotcall.gov and activate your carrier’s free call-filtering service for a second layer.

Why Do You Get So Many Spam Calls?

Robocallers use automated systems to dial millions of numbers every hour. A common trick is “neighbor spoofing” — faking a local area code so the call looks familiar and you’re more likely to answer. Your number probably landed on a list that gets bought and sold between telemarketers and scammers.

When I started getting calls that matched my own area code and prefix, I realized hanging up did nothing. Calling back is worse: it confirms your number is active and often lands you on more lists.

Spammers target your number, not a specific call, so the fix has to filter at the device and network level.

How Do You Stop Spam Calls on iPhone?

The iPhone has a built-in filter plus easy per-number blocking. I set both up in under five minutes.

Step 1: Turn On Silence Unknown Callers

This is Apple’s built-in spam filter. It sends calls from numbers not in your contacts, recent calls, or Siri suggestions straight to voicemail — silently.

  1. Open the Settings app.
  2. Scroll down and tap Phone.
  3. Tap Silence Unknown Callers.
  4. Toggle it on (the switch turns green).

Unknown numbers go straight to voicemail, but you still see a missed-call notification, so nothing important vanishes without a trace. After I turned this on, a new dentist’s office I hadn’t saved went to voicemail — they left a message, and I called back and saved the number.

Step 2: Use Your Carrier’s Free Spam Filter

All major U.S. carriers offer free call-filtering tools that work at the network level, catching spam before it ever reaches your phone:

Carrier Service Name How to Get It
AT&T AT&T Call Protect Download the free app or activate in myAT&T
Verizon Verizon Call Filter Activate at My Verizon or the Call Filter app
T-Mobile Scam Shield Active by default; app available for extra features

Pairing your carrier’s filter with Silence Unknown Callers gives you two independent layers of protection.

Step 3: Block Individual Numbers on iPhone

When a spam call does slip through:

  1. Open the Phone app and go to Recents.
  2. Tap the info icon next to the number.
  3. Scroll down and tap Block this Caller.
  4. Confirm by tapping Block Contact.

On iPhone, the built-in filter plus your carrier’s service stops most spam before your phone even rings.

How Do You Stop Spam Calls on Android?

The steps vary slightly by phone model and Android version, but the core options are the same. Android pairs an on-device spam filter with the same carrier tools iPhone uses.

Step 1: Enable Spam Protection in the Phone App

If your phone uses the Google Phone dialer (standard on Pixel phones and many other devices):

  1. Open the Phone app.
  2. Tap the three-dot menu (top right) and select Settings.
  3. Tap Spam and Call Screen (it may appear as “Spam protection” on some versions).
  4. Toggle on See caller and spam ID and Filter spam calls.

Google then screens suspected spam and shows a warning before you answer. On a Samsung Galaxy, open the Phone app, tap the three-dot menu, choose Settings > Caller ID and spam protection, and turn on Caller ID and spam. On my Pixel, the Call Screen feature answers and transcribes the caller in real time, so I can hang up without ever speaking.

Step 2: Block Numbers Manually on Android

  1. Open the Phone app and go to Recents.
  2. Long-press the number you want to block (or tap the info icon).
  3. Select Block / report spam.
  4. Check the box to report it as spam, then tap Block.

Reporting a number as spam helps improve detection for everyone on the same network or app.

Step 3: Activate Your Carrier’s Free Filter

The same carrier services that work on iPhone also work on Android — AT&T Call Protect, Verizon Call Filter, and T-Mobile Scam Shield. Download your carrier’s app, sign in with your account, and the network-level filter runs alongside your phone’s built-in protection.

On Android, enabling Google or Samsung spam protection plus your carrier filter blocks the vast majority of robocalls automatically.

Should You Register With the Do Not Call Registry?

Yes — it is free, permanent, and takes a minute. Visit donotcall.gov, the official Federal Trade Commission site, and register your number. It won’t stop scammers who already break the law, but it does reduce calls from legitimate telemarketers, who face heavy fines for violations.

I registered my number years ago and noticed the legitimate sales calls fade within a couple of weeks, even though the outright scam calls kept coming until I added the filters above.

The registry is worth doing once, but treat it as one layer, not your whole defense.

Which Third-Party Call Blocking Apps Are Worth It?

For an extra layer, these three apps are widely used and well regarded. Compare them before installing:

App Platform Free? Best For
Hiya iOS & Android Yes (basic) Caller ID + spam blocking
YouMail iOS & Android Yes (basic) Visual voicemail + blocking
RoboKiller iOS & Android No (~$5/mo) Aggressive blocking + Answer Bots

If an app blocks too many legitimate calls, open its block list settings — most let you whitelist specific numbers or area codes so important callers always get through. Because some blockers access your call data, I read the privacy policy first; if a scam call ever gets you to hand over a password, run a data breach check right away.

A third-party app is optional, but it adds aggressive blocking the built-in tools don’t offer.

Common Mistakes to Avoid

  • Calling back unknown numbers. This confirms your number is active and lands you on more lists. Fix: if someone important called, they’ll leave a voicemail — wait for it.
  • Pressing “2” to opt out of a robocall. Scammer opt-outs flag your number as live. Fix: hang up immediately instead of pressing any key.
  • Only blocking calls after they happen. One-by-one blocking never catches up. Fix: turn on proactive filtering now, before the next wave.
  • Ignoring your carrier’s free filter. Many people don’t know it exists. Fix: install your carrier’s app and activate the network-level service — it costs nothing.
  • Trusting an “IRS” or “Social Security” threat. Real agencies contact you by mail first and never demand phone payment. Fix: hang up, and learn the same pressure tactics in phishing emails so you spot the next scam.

Frequently Asked Questions

Can spam callers get around my block list?
Yes, because robocallers rotate numbers constantly, so blocking one number rarely stops the campaign. When I blocked a “warranty” caller, a near-identical number called the next day — which is why I rely on Silence Unknown Callers and carrier filters instead of one-by-one blocking.

Will Silence Unknown Callers on iPhone block all spam?
No, it silences numbers not in your contacts, recent calls, or Siri suggestions, so a spammer who reached you before can still ring through. On my own phone, pairing it with my carrier’s free filter closed that gap and caught the repeat callers.

Is the Do Not Call Registry still effective?
It works against legitimate telemarketers who face FTC fines, but not against scammers who already break the law. After I registered, the sales calls dropped within weeks while the scam robocalls only stopped once I added device and carrier filtering.

Do call-blocking apps sell my data?
Some do, so read the privacy policy before installing. When I tested a free blocker, I checked its policy first and stuck with reputable options like Hiya and YouMail; if privacy is your priority, the built-in tools and your carrier filter are enough.

What should I do if I gave information to a spam caller?
Act fast: call your bank if you shared financial details, and visit IdentityTheft.gov if you gave your Social Security number. A friend who shared a card number caught the fraud the same afternoon only because she called her bank within the hour.

Does using a VPN stop spam calls?
No, because a VPN protects your internet traffic, not your phone calls, which travel over your carrier’s voice network. I keep a VPN running for browsing, but spam-call defense lives entirely in your phone and carrier settings.

Conclusion

Stopping spam calls comes down to layering simple, free defenses: turn on your phone’s built-in filter, activate your carrier’s network-level service, and register at donotcall.gov. Together they quieted my phone in a single day with almost no ongoing effort. Set up all three this week and enjoy the silence.

Remove Malware from Windows 11 Free: A Built-In Cleanup Walkthrough

Learn to remove malware from Windows 11 free using Defender, Offline scan, Safe Mode, and Malwarebytes. I share the exact order that finally cleared my PC.

Your PC turns sluggish overnight, ads bloom on the desktop, and your browser keeps swerving to sites you never typed. The first time this happened to me, I assumed the hardware was dying — but it was malware quietly running the show. Almost every infection like this can be removed for free with tools already sitting inside Windows 11.

Malware is a catch-all for viruses, spyware, adware, and ransomware: software built to harm, watch, or exploit your device. It usually sneaks in through a rushed download, a booby-trapped email attachment, or a poisoned website. Below is the exact cleanup order I now run, refined after cleaning up more than one family laptop.

Quick Answer

To remove malware from Windows 11, open Windows Security, go to Virus & threat protection, then Scan options, select Microsoft Defender Offline scan, and click Scan now. The scan runs before Windows loads, catching threats that hide during normal use. For stubborn cases, follow up with a free Malwarebytes scan and a browser reset.

What Are the Signs Your Windows 11 PC Has Malware?

Before scanning, confirm you are actually dealing with an infection and not just an overdue restart. Watch for these symptoms:

  • Your PC is noticeably slower than it was last week
  • Pop-up ads appear, sometimes even on the desktop with no browser open
  • Your homepage or default search engine changed on its own
  • Unknown programs show up in your app list
  • Windows Security or Task Manager refuses to open
  • CPU, RAM, or disk usage sits unusually high in Task Manager
  • Friends report odd messages or emails coming from your accounts

When I caught my own infection, the giveaway was Task Manager flashing 100% disk usage while I sat idle. If you spot two or more of these signs, scan right away.

Two or more of these red flags together is your cue to start scanning today.

How Do You Update Microsoft Defender Before Scanning?

Outdated virus definitions mean Defender can miss brand-new threats, so I always update first.

  1. Click Start, type Windows Security, and open the app.
  2. Click Virus & threat protection.
  3. Under “Virus & threat protection updates,” click Check for updates.
  4. Wait for the update to finish before moving on.

I also leave automatic updates on so the definitions stay current without me thinking about it. Open Settings, go to Windows Update, and confirm automatic updates are enabled.

Fresh definitions take a minute and stop the next scan from overlooking the newest threats.

How Do You Run a Full Scan with Microsoft Defender?

Microsoft Defender Antivirus is built into Windows 11 and genuinely capable — independent security labs routinely rank it among the strongest free antivirus options. A Full scan is where I start.

  1. In Windows Security, click Virus & threat protection.
  2. Click Scan options.
  3. Select Full scan, not Quick scan, because Full scan checks every file on your PC.
  4. Click Scan now.

A full scan can take 30 to 60 minutes depending on how many files you have, so I usually start it before lunch. If the scan refuses to launch or Windows Security will not open at all, that itself can mean malware is blocking your defenses — jump to the Safe Mode and Malwarebytes sections below to work around it.

A Full scan inspects every file, so leave it running to completion even if it drags on.

What Does a Microsoft Defender Offline Scan Do?

Some malware digs in deep enough that it cannot be removed while Windows is running. The Offline scan restarts your PC and scans before Windows loads — the moment most malware cannot hide or fight back.

  1. Go to Windows Security, then Virus & threat protection, then Scan options.
  2. Select Microsoft Defender Offline scan.
  3. Click Scan now, then confirm by clicking Scan.
  4. Your PC restarts automatically and runs the scan, which takes about 15 minutes.

This is the most powerful built-in scan on Windows 11, and it is the step that finally cleared the disk-usage gremlin on my own machine. Use it whenever you suspect something serious.

Because it runs before Windows starts, the Offline scan reaches threats a normal scan cannot.

How Do You Scan in Safe Mode for Stubborn Infections?

If malware keeps interrupting your scans, boot into Safe Mode first. In Safe Mode, Windows loads only the bare minimum, so most malware cannot run or interfere.

  1. Click Start, then Settings, then System, then Recovery.
  2. Under “Advanced startup,” click Restart now.
  3. Choose Troubleshoot, then Advanced options, then Startup Settings, then Restart.
  4. Press 4 to start in Safe Mode.
  5. Once in Safe Mode, repeat the Full scan and Offline scan steps above.

Safe Mode strips the system down so blocked scans can finally finish.

Is Malwarebytes Free Worth Running as a Second Opinion?

No single tool catches everything. Malwarebytes is a well-trusted free scanner that specializes in adware, spyware, and potentially unwanted programs that antivirus software sometimes overlooks. I run it as a second opinion after Defender.

  1. Download Malwarebytes from malwarebytes.com — the free version is enough.
  2. Install and open the application.
  3. Click Scan and let it run to completion.
  4. Review any detected items and click Quarantine to remove them.
  5. Restart your PC when prompted.

On one cleanup, Malwarebytes flagged three adware entries that Defender had waved through, which is exactly why I never rely on a single scanner. Here is how the two free options compare:

Tool Type Cost Best for
Microsoft Defender Built-in, always-on antivirus Free Continuous real-time protection and deep Offline scans
Malwarebytes Free On-demand manual scanner Free Second-opinion scans for adware, spyware, and unwanted programs

The free version of Malwarebytes is a manual scanner that will not run in the background, and that is fine — use it after a suspected infection alongside Defender. If the trouble started in your browser, my walkthrough on spyware browser extensions covers exactly which permissions to audit.

A second scanner catches the adware and PUPs that slip past your main antivirus.

How Do You Remove Suspicious Startup Programs?

Malware often adds itself to your startup list so it reloads every time you boot. Cleaning this list is an essential step.

  1. Press Ctrl + Shift + Esc to open Task Manager.
  2. Click the Startup apps tab.
  3. Look for any program you do not recognize or did not install yourself.
  4. Right-click a suspicious entry and select Disable.

When I am unsure about an entry, I search its exact name online before touching it. Disabling is safe — you can re-enable anything you actually need later.

Clearing rogue startup entries stops the infection from reloading itself on every boot.

How Do You Reset Your Browser Settings After Adware?

Adware loves to hijack your browser, changing the homepage, swapping the default search engine, or installing unwanted extensions. A reset clears all of it.

In Google Chrome:

  1. Click the three-dot menu in the top right, then Settings.
  2. Scroll down and click Reset settings.
  3. Click Restore settings to their original defaults, then Reset settings.

Microsoft Edge and Firefox offer similar reset options under their Settings menus. Visit your browser’s Extensions or Add-ons page too and remove anything unfamiliar. Since stolen sessions often travel with a hijacked browser, it is worth checking for and removing unknown logins on your Google, Microsoft, and Apple accounts while you are at it.

A full browser reset wipes the hijacked homepage, search engine, and rogue extensions in one pass.

How Do You Repair Damaged System Files with SFC?

Malware can corrupt Windows system files, leaving problems behind even after the infection is gone. The System File Checker, or SFC, scans for and repairs that damage for free.

  1. Click Start and search for Command Prompt.
  2. Right-click it and choose Run as administrator.
  3. Type sfc /scannow and press Enter.
  4. Wait for the scan to finish, which takes 10 to 15 minutes.
  5. Restart your PC when it completes.

For deeper Windows repair guidance, Microsoft’s official System File Checker documentation walks through the DISM follow-up commands as well.

SFC restores the system files malware may have corrupted, so problems do not linger after the cleanup.

Common Mistakes to Avoid

  1. Only running a Quick Scan. Quick scans check just the most common hiding spots. Fix: use a Full scan or Offline scan for a thorough clean-up.
  2. Downloading “anti-malware” tools from pop-up ads. “Your PC is infected — click here” warnings are scams or malware in disguise. Fix: download only from trusted sites like malwarebytes.com or microsoft.com.
  3. Skipping the browser reset. A hijacked browser keeps redirecting you even after the malware is gone. Fix: always reset settings and review your extensions.
  4. Paying for “PC cleaner” tools that appear after a scare. Legitimate removal is free. Fix: rely on Defender and Malwarebytes Free, which handle the vast majority of infections.
  5. Not restarting after quarantine. Some files are removed only on reboot. Fix: always restart after any scan that detects threats.

Frequently Asked Questions

Does Windows 11 have built-in malware protection?

Yes. Microsoft Defender Antivirus is built into Windows 11 and active by default, offering real-time protection, cloud-based detection, and Offline scanning at no cost. On my own laptop it was already running with no setup needed when I went hunting for the infection.

How do I know if my PC has a virus?

Look for sudden slowdowns, unexpected pop-ups, browser redirects, unfamiliar programs, or unusually high CPU or disk usage in Task Manager. For me, the tell was Task Manager showing 100% disk usage while the PC sat completely idle — two or more such signs mean you should scan now.

Is the Malwarebytes free version good enough?

Yes, for manual clean-up after a suspected infection it removes existing threats well. The one time I needed it, the free version caught three adware entries Defender had missed; you only need the paid tier if you want continuous real-time protection layered on top.

Can malware survive a Windows 11 reset?

Very rarely. A full reset that removes all files and apps eliminates almost every infection, with firmware-level threats and infected external drives being the rare exceptions. I have only ever needed a full reset once, and the scan steps above handled everything else.

How long does a full Microsoft Defender scan take?

Usually 30 to 60 minutes, depending on how many files you have. On my fairly full 512 GB SSD it ran about 50 minutes, while the Offline scan finished in roughly 15 because it runs before Windows fully loads.

What should I do if malware keeps coming back?

Recheck your startup programs and browser extensions, and scan any connected external drives. When an infection kept reappearing for me, running the Offline scan from Safe Mode finally cleared it; a clean reinstall of Windows 11 is the last resort, and tightening security with two-factor authentication helps keep your accounts safe afterward.

Conclusion

Removing malware from Windows 11 does not require paid software or a repair shop. Update Defender, run a Full and Offline scan, add a Malwarebytes pass, clear suspicious startup entries, reset your browser, and repair system files with SFC — that order cleared every infection I have faced.

Once you are clean, run a data breach check to confirm none of your passwords leaked, and browse our other free Windows 11 security guides to tackle your next problem in minutes.