LaunchAdvisor’s analysis is specific and reassuring: just five steps, starting with a password manager and two-factor authentication, prevent an estimated 90% of breaches for freelancers and small business owners.
The Five Steps That Matter Most
LaunchAdvisor’s guide is specific about impact: five steps prevent 90% of breaches for freelancers, starting with a password manager and unique passwords, followed by two-factor authentication. SolidGigs’ checklist for high-earning freelancers specifically recommends enabling MFA on all platforms related to work, including email accounts, project management tools, and cloud storage — not just the obvious accounts.
A Community Checklist Worth Reading
A Reddit thread in r/cybersecurity_help titled “A security checklist to keep you safe” offers blunt, practical advice worth repeating directly: do not pirate anything, activate MFA on everything, be stingy with who you give your email and data to, and never download or execute anything from an untrusted source.
The Full 15-Step Security Checklist
- Install a reputable password manager
- Enable 2FA on email, banking, and password manager accounts
- Subscribe to a VPN with an audited no-log policy
- Set up automated, encrypted backup of all work files
- Update operating system and apps regularly
- Use unique passwords for every single account
- Verify payment and contract changes through a separate channel
- Enable a kill switch on your VPN
- Use encrypted cloud storage for sensitive client files
- Review app permissions on your devices periodically
- Keep router firmware updated
- Avoid public WiFi without a VPN active
- Disclose AI tool usage to clients where relevant
- Maintain a simple incident response plan for breaches
- Re-audit your security stack annually
Frequently Asked Questions
Which steps actually matter most if I’m starting from zero?
According to LaunchAdvisor, just five steps prevent 90% of breaches: a password manager, unique passwords, and two-factor authentication form the core.
Should I enable MFA on every single platform?
Yes, SolidGigs specifically recommends extending MFA beyond email to project management tools and cloud storage too.
How long does completing this checklist take?
Most steps can be completed within a single afternoon for someone starting from zero.
Should I revisit this checklist regularly?
Yes, an annual review ensures your security stack keeps pace with new tools and threats.
Verdict
If you only have time for five things, focus there first: password manager, unique passwords, and 2FA cover the highest-leverage 90% — the remaining 10 steps round out a genuinely complete defense. Find tools for every step →
Browser Security: The Overlooked Attack Surface
Most freelancers spend 70–80% of their working day in a browser — yet browser security is absent from most cybersecurity checklists. Three actions with the highest return on time invested:
- Audit your extensions monthly. Browser extensions have full access to everything you type and every page you visit. Remove any extension you haven’t used in 30 days. Keep only extensions from publishers you can verify. Malicious extensions have compromised freelancer accounts on Upwork, Fiverr, and banking platforms.
- Enable HTTPS-only mode. Chrome, Firefox, and Safari all offer an HTTPS-only mode that blocks unencrypted connections. Enable it in settings — it takes 30 seconds and prevents passive interception on networks where the site still offers HTTP.
- Use a separate browser profile for client work. Isolate cookies, sessions, and autofill data between client work and personal browsing. Chrome and Firefox both support multiple profiles. This prevents cross-contamination if one session is compromised and keeps client accounts isolated from your personal accounts.
Recognising Phishing: Patterns That Target Freelancers Specifically
Phishing attacks on freelancers increasingly impersonate platforms you use daily. The most effective attacks in 2025–2026 follow three patterns:
- Payment redirection fraud: An attacker emails you pretending to be a client, asking you to update your payment details “before the next invoice.” Always verify payment changes via a phone call to a number you have on file — not a number in the email.
- Platform security alerts: Fake emails from Upwork, PayPal, Stripe, or your bank claiming your account is suspended. The URL will differ by one character from the real domain. Check the sender domain — not the display name.
- Google Workspace / Microsoft 365 invites: Shared document links that lead to a login page harvesting your credentials. Legitimate document shares don’t ask you to re-enter your password. If in doubt, open Google Drive or OneDrive directly in a new tab — don’t click the link.
Device Encryption: Protect Data At Rest
If your laptop is stolen, device encryption is the last line of defence protecting client data. Both macOS and Windows have built-in encryption that most freelancers never activate:
- macOS: FileVault 2 encrypts your entire drive using AES-128. Enable it in System Settings → Privacy & Security → FileVault. Store the recovery key in your password manager, not in iCloud (where it could be accessed if your Apple ID is compromised).
- Windows: BitLocker encrypts the drive with AES-128 or AES-256. Available in Windows 10/11 Pro — search “Manage BitLocker” in Settings. Home edition users can use “Device Encryption” if hardware supports it, or VeraCrypt as a free alternative.
- External drives: If you store client deliverables on external drives, encrypt those too. VeraCrypt is free, cross-platform, and audited. An encrypted container for client files adds minimal friction and full protection if the drive is lost.
Antivirus: Do Freelancers Still Need It in 2026?
For macOS users: Apple’s built-in XProtect and Gatekeeper handle most malware automatically, and third-party antivirus can sometimes cause more problems than it solves. Malwarebytes Free is a reasonable addition for on-demand scanning without the performance overhead of real-time scanning.
For Windows users: Microsoft Defender (built-in, free, and significantly improved since 2020) now scores 99–100% detection rates in AV-TEST benchmarks — comparable to paid alternatives. Enable real-time protection and keep it updated. Add Malwarebytes Free for a second-opinion scanner on suspicious downloads. Paid third-party AV adds marginal value for most freelancers and is not a priority over the 15 steps listed above.
