I counted once, out of curiosity, roughly how many things I do in a single workday that run entirely through my browser. Email. Client portal. Video calls. Document editing. Invoicing. Research. Honestly nearly the whole job happens in one application, and I’d never really thought about how much exposure that represents until a coworker got their session hijacked through an extension that turned out to be tracking way more than it should have.
That was the push I needed to actually go through my browser settings properly instead of just assuming they were fine. Here’s what I found, and what I changed.
Start with the boring stuff — updates
Nobody wants to hear “just update your software” as advice, I get it, it’s not exciting. But outdated browser versions carry known security flaws, publicly documented ones, that get patched constantly. Most browsers update themselves automatically these days, which is great, except sometimes an update gets stuck or delayed without you noticing. Worth a manual check every so often. Takes ten seconds.
Extensions deserve more suspicion than most people give them
This is the one that got my coworker. Every extension you install gets some level of access to your browsing data, and a lot of them ask for way more than they actually need to function. A note-taking extension that wants access to every website you visit? That’s a red flag, not a normal permission request.
I went through mine and honestly didn’t recognize a couple of them. No idea when I’d installed them or why. Removed anything I wasn’t actively using, and now I actually look at what an extension is requesting before I install something new, instead of just clicking accept like I used to.
Third-party cookies are tracking you more than you think
These little files follow you across different websites, building up a profile of what you look at and click on, without anything close to clear consent. Most browsers let you turn off third-party cookies in the privacy settings, and doing that alone cuts down a huge amount of the tracking happening in the background while you work.
Keep work and personal separate — actually separate
Most browsers support multiple profiles now. I didn’t use this feature for years because it felt like an unnecessary extra step, but running a dedicated profile for work logins keeps your cookies, saved passwords, and browsing history cleanly divided from your personal stuff. Less cross-contamination. Less risk that something in your personal browsing ends up affecting your work accounts, or the other way around.
Public Wi-Fi is riskier than it feels
Coffee shops, airports, hotel lobbies these networks are often unsecured, meaning traffic on them can potentially be intercepted by someone else on the same network. A VPN encrypts your traffic so that even if someone’s watching that network, what they see is scrambled and useless.
I used to skip this for “quick” browsing, just checking email real fast, five minutes, no big deal. Except five minutes is plenty of time for something to go wrong, and there’s no real way to know if it did until it’s already too late.
Passwords, and the reuse problem
Reusing the same password across different accounts means one breach anywhere becomes a breach everywhere. A password manager fixes this by generating a unique, genuinely strong password for every single account, so you’re not relying on memory or convenience to protect yourself.
Two-factor authentication is the other half of this. Even if a password does get compromised somehow, a second verification step blocks most unauthorized access attempts cold. Takes a few minutes to set up per account. Closes off one of the most common ways accounts actually get broken into.
Even your search engine leaks something
Popular search engines log queries and, depending on your account settings, tie them back to your identity. I didn’t think this mattered much until I realized how much research I do for client work runs through search, and how much of that I’d rather not have permanently associated with my name somewhere. Switching to a privacy-focused option, at least for anything sensitive, cuts that down.
Check your permissions every so often
Websites ask for location, camera, microphone access constantly, and a lot of those permissions get granted once during setup and then completely forgotten about. I did a permissions audit recently and found sites I hadn’t visited in over a year still holding onto microphone access. No good reason for that. Worth checking every few months, honestly, just to close gaps that build up quietly without you noticing.
None of this took more than an hour total to set up properly, and it’s the kind of thing that pays off in a way you never see directly nothing bad happens, and you don’t get a notification congratulating you for it. You just don’t end up like my coworker did.
