How To Work More Securely From Your Home Office (2026 Guide)

When I first wrote this article back in early 2021, half of Manchester had been turned into a makeshift office almost overnight, kids were learning at the kitchen table, and working from home still felt temporary. Five years on, it is just work. Hybrid and home working are a permanent fixture, and that means securing your home office is no longer a lockdown stopgap. It is something every home worker and small business owner should get right and keep right.

So I have rewritten this guide from scratch for 2026. I have shifted the focus to where it matters most, towards protecting your data, your accounts and your devices, while keeping a tightened section on the physical hazards that genuinely still catch families out. I have also corrected some advice from the original that is now out of date, including the old line about free antivirus being poor, because the world has moved on. This is the honest, practical version I would give a friend setting up to work from their spare room in Sale or a back bedroom in Withington.

Start here: the four things that matter most

If you do nothing else from this article, do these four. They are the highest-impact, lowest-effort wins, and they are the same four the National Cyber Security Centre (NCSC) keeps coming back to for good reason (the NCSC also has dedicated home working guidance if you want the official version). Everything after this is detail and refinement, but these four are the foundation:

1. Turn on two-step verification, starting with your email.
2. Use strong, unique passwords (three random words) with a password manager.
3. Keep your devices and software updated, and get off Windows 10 if you have not already.
4. Back up your important data using the 3-2-1 rule.

Let me take each one properly, because the how matters as much as the what.

Turn on two-step verification

If a criminal gets hold of one of your passwords, through a data breach, a phishing email or a lucky guess, two-step verification (2SV) is what stops them actually getting in. It asks for a second proof of identity, usually a code from an app or a tap on your phone, on top of your password. The NCSC describes turning it on as one of the most effective ways to protect your accounts, and I completely agree.

Start with your email, and here is why: your email is the master key to your whole digital life. If someone controls your email, they can reset the password on almost everything else, from your banking to your cloud storage to your work systems. Lock that down first, then move on to banking, social media and anything holding client or company data. You will see it called 2SV, 2FA or MFA. They are all the same idea, and any of them is enormously better than none.

A quick word on which second factor to choose. A code from an authenticator app or a tap-to-approve prompt is a touch more secure than a code by text message, but a text code is still a huge improvement on nothing, so if SMS is all a service offers, switch it on anyway. The direction of travel is towards passkeys, which replace passwords entirely with a secure key on your device unlocked by your fingerprint, face or PIN. The NCSC now recommends passkeys as your first choice of login where a service offers them, because there is no password for anyone to steal or phish. Where passkeys are not available yet, a strong password plus 2SV is your standard.

Passkeys: the login criminals cannot phish

Passkeys deserve a proper look, because they are the biggest change to how we log in for twenty years and they make a real difference to home workers. A passkey replaces your password with a cryptographic key that stays on your device and is unlocked by your fingerprint, face or PIN. There is nothing to type, nothing to remember, and crucially nothing for a criminal to steal. Even if you are fooled by a convincing fake login page, there is no password to hand over and nothing to phish.

The NCSC says passkeys are at least as secure as, and generally more secure than, the strongest password paired with two-step verification, and it now recommends making them your default login wherever a service offers them. They are quicker too, and plenty of big names already support them, including Google, PayPal, eBay, Microsoft and Apple. Setting one up usually means opening your account's security settings, choosing "add a passkey" and confirming with your fingerprint or face. My honest steer for 2026: turn passkeys on where you can, especially for your email and anything financial, and keep a strong password plus two-step verification everywhere a passkey is not offered yet.

Strong passwords: three random words and a password manager

In the original 2021 version of this post I leaned on the old "make it complex" advice: capital letters, numbers, a special character. The thinking has moved on. When you force people to invent complicated passwords, they cope in predictable ways, and criminals know every one of those tricks. As the NCSC puts it, complexity requirements counter-intuitively end up producing more predictable passwords.

The better approach is three random words. Put three unrelated words together, something like coffee rocket marble, and you get a password that is long, genuinely hard to crack, and far easier to remember than a tangle of symbols. The strength comes from length, not punctuation. Just do not use words anyone could guess about you, and do not lean on predictable swaps like an "o" for a "0", because the criminals expect those too.

The real game-changer is a password manager. Nobody can remember a strong, unique password for every account, and reusing one password everywhere is exactly how a single breached website hands criminals the keys to your email and bank too. A password manager creates and stores a different strong password for every account, so you only have to remember one master password (make that one three random words). It also fills passwords in for you, which quietly protects you from phishing: if it does not recognise the website, it will not offer to log you in. The managers built into your browser or phone are perfectly safe on your own devices. Turn on 2SV for the password manager itself, and you have closed the loop.

Keep everything updated, and get off Windows 10

Updates are not just new features. A huge proportion of them are security patches, fixes for holes that criminals are actively trying to exploit. The NCSC's advice is simple: keep your operating system, browsers, apps and security software up to date, and turn on automatic updates wherever you can. The gap between a patch being released and people installing it is exactly the window attackers aim for.

One update matters more than any other right now. Windows 10 reached the end of its support life on 14 October 2025, so Microsoft no longer provides free security updates for it, and every new vulnerability found since then stays unpatched on a standard Windows 10 machine. It does not stop working overnight, but it gets quietly riskier every month. If you are still on Windows 10, here are your options:

Your situation	What to do
Your PC is eligible for Windows 11	Upgrade to Windows 11 (free for qualifying PCs). The right long-term move.
Not eligible or not ready yet	Enrol in Extended Security Updates (ESU), free for home users, running until 12 October 2027. Treat it as breathing space, not a destination.
Machine too old for Windows 11	Replace it. We can advise on a sensible, cost-effective upgrade.

If you are not sure which camp your laptop falls into, that is exactly the kind of thing we check for people every week. A quick look will tell you whether you can upgrade or whether ESU is the sensible stopgap. And do not forget the software you actually work in: your browser, Office and your router's firmware all need keeping current too, not just Windows itself.

Back up your data: the 3-2-1 rule

Ransomware, where criminals encrypt your files and demand payment, is one of the nastiest things I see in the workshop, and hardware simply fails sometimes too. Either way, a good backup is the difference between a bad afternoon and a genuine disaster, especially when it is client work or company data on the line.

The rule worth memorising is 3-2-1: keep at least three copies of your important data, on two different types of device, with one copy kept offline or off-site. So that might be the working copy on your laptop, a backup on an external drive, and a third copy in cloud storage. The crucial part is that offline copy. The NCSC specifically stresses keeping at least one backup disconnected, because ransomware can only encrypt what it can reach. And do not forget to test that you can actually restore: a backup you have never checked is just a hope.

One trap worth naming: sync is not the same as backup. Tools like OneDrive, Google Drive and Dropbox are brilliant, but if ransomware encrypts a file or you delete one by mistake, that change can sync straight to the cloud copy too. A real backup keeps older versions you can roll back to, so for most home setups an external SSD plus a reputable cloud backup covers you nicely. We explain the thinking in why backing up your data is critical, and if the worst has already happened we offer data recovery and can set up a proper backup for you.

Antivirus in 2026: free really is fine now

This is the part of the original article I most wanted to correct. In 2021 I told you free antivirus was usually well behind the rest of the industry. That advice is now out of date, and I would be doing you a disservice to leave it standing.

The free antivirus built into Windows, Microsoft Defender, has become genuinely excellent. It is included in Windows 10 and 11, switched on by default, and you do not have to pay extra for it. More to the point, it performs. The independent lab AV-TEST scored Microsoft Defender top marks for protection in round after round through to 2026, alongside the big paid names, and the NCSC's own guidance says the antivirus built into Windows, macOS and Android will meet the needs of many organisations.

So for most home users, the honest advice in 2026 is to keep Microsoft Defender switched on and updated, and you are well covered. Two caveats: never run two antivirus products at once, because the security benefit is minimal and they can conflict and make your machine unstable; and paid suites mainly add bundled extras like a VPN or identity monitoring, which is a value judgement about features, not a safety necessity. If your machine does start behaving oddly, slowing to a crawl, throwing pop-ups or redirecting your browser, our virus removal service can get it properly clean.

Your firewall: the shield you already own

Antivirus checks files for malware. A firewall does a different job: it controls which connections are allowed in and out of your computer, blocking uninvited traffic from the internet before it ever reaches you. If antivirus is checking visitors at the door, the firewall decides who even gets to knock.

The good news is that, just like antivirus, you almost certainly already have a capable firewall switched on. Windows includes Microsoft Defender Firewall, on by default, and macOS has its own built-in firewall too. Your home router has a firewall built in as well, quietly shielding everything on your network from the wider internet. For the vast majority of home workers, leaving these on and updated is all you need, and you do not have to buy a separate firewall product.

The main mistake to avoid is turning the firewall off because a game or an app told you to, then forgetting to switch it back on. If you ever want to understand the options, or you run a small business and want something with more control, we have a rundown of the best free firewalls for 2026. For most people, though, the built-in one is exactly the right answer.

Secure your home Wi-Fi and router

Your router is the front door to your entire home network, and for a home worker that network now carries work email, client files and company logins. It is worth five minutes to harden it:

• Change the router's admin password (the one for its settings, not the Wi-Fi password). Use three random words. New devices sold since 2024 can no longer ship with a guessable universal default, but older routers should be changed.
• Use WPA2 or WPA3 encryption for the Wi-Fi itself. Any router from the last several years supports this; check it is enabled rather than an older, broken standard.
• Keep the router's firmware updated, turning on automatic updates if it offers them.
• Put smart gadgets on a guest network. Smart speakers, video doorbells and robot vacuums are notorious weak points. The NCSC's smart-device guidance is worth a read; keep your work laptop on the main network and the gadgets on a separate guest one.

On VPNs, let me be straight. If your employer provides a VPN, use it whenever you access work systems and keep its software updated; follow the NCSC's corporate VPN guidance and your company's instructions. What I would push back on is the marketing for consumer "privacy" VPNs. For most people working on their own secured Wi-Fi, a consumer VPN is not the essential shield the adverts suggest, because modern websites already encrypt your connection. Where it genuinely earns its place is on Wi-Fi you do not control, like a cafe, hotel or airport, where you cannot be sure who else is on the network.

Spotting and reporting phishing

Working from home, you do not have a colleague to lean over and ask "does this look dodgy to you?", so it pays to know the signs yourself. Phishing is still the most common way criminals get a foothold: an email or text that pressures you to click a link, log in, pay an invoice or hand over a code, usually by manufacturing urgency. A few patterns to watch for in 2026:

• Quishing: QR codes in emails or on posters that lead to fake login pages.
• Vishing: phone calls from someone pretending to be your IT department or bank, talking you into installing software or reading out a code.
• Anything that rushes you, especially around money or login details. Slow down and verify through a channel you trust.
• Invoice and supplier scams: an email that looks like a regular supplier suddenly asking you to pay a new bank account. Always confirm changes by phone using a number you already have.

The honest reality is that modern phishing is well written and convincing, and the criminals now use AI to polish their spelling and mimic real companies, so the old advice about spotting typos is no longer enough. The reliable habit is this: never log in or pay through a link in a message. Go to the website or app yourself, the way you normally would, and check there. If something looks off, do not click, and report it. Forward suspicious emails to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service, and forward scam texts to 7726 (it spells "SPAM" on the keypad, and it is free on most UK networks). Tens of millions of reports have led to hundreds of thousands of malicious websites being taken down.

Securing your video calls

Video calls are the office now, and an unsecured meeting is its own small risk, whether that is an uninvited guest crashing a call (so-called meeting-bombing) or sensitive information being seen by the wrong eyes. The NCSC has dedicated guidance on using video conferencing securely, and it boils down to a few sensible habits:

• Protect the meeting. Require a password or passcode to join, and use the waiting room or lobby so you admit people deliberately rather than leaving the door open.
• Do not post meeting links publicly. Share them only with the people who need them, and keep the link or meeting ID off social media.
• Check who is on the call. Glance at the participant list and make sure everyone is known and expected, especially before discussing anything confidential.
• Lock the meeting once everyone has arrived, so nobody else can wander in.
• Mind what is on screen and behind you. Close confidential documents before you share your screen, and use background blur if your home is on view.
• Keep the app updated, like everything else, so you get the latest security fixes.

If you are still choosing a platform, our guide to the best software for remote work meetings walks through the main options and where each one fits.

Locking down the device itself

Two quick wins protect your data if a device is lost, stolen, or just left unattended with the kids about:

• Turn on device encryption. If your laptop is lost or stolen, encryption stops a thief simply pulling the files off the drive. Windows 11 includes Device Encryption (and BitLocker on Pro), and on many modern machines it switches on automatically when you sign in with a Microsoft account. Worth checking it is on, especially if you handle client data.
• Lock your screen when you step away. Pressing the Windows key and L whenever you leave the desk stops a child, housemate or visitor seeing, or accidentally sending, something they should not. In a home full of curious hands, this matters more than people think.

And a sensible principle to finish: keep work and personal separate where you can. Do not do company work in your personal email, do not reuse personal passwords on work accounts, and follow whatever security policy your employer has set. Mixing the two is how a personal breach becomes a work breach, and it is one of the easiest mistakes to avoid once you are aware of it.

Using a Mac at home? FileVault and Gatekeeper

Most of the advice in this guide applies whatever you use, but if you work on a Mac there are two Apple features worth knowing by name. The first is FileVault, Apple's full-disk encryption and the Mac equivalent of BitLocker. On modern Macs with Apple silicon your data is already encrypted at the hardware level, and turning FileVault on adds the layer that stops anyone reading your files without your login password. You will find it under System Settings, then Privacy and Security, then FileVault. One important note: keep your recovery key somewhere safe, because if you forget both your password and the key, the data is gone for good.

The second is Gatekeeper, which runs quietly in the background and checks that apps come from identified developers before it lets them run, helping keep malware off your machine. It is on by default, and the sensible habit is to install apps from the App Store or directly from the maker's official website rather than from random download sites. Macs are not immune to malware, so the same fundamentals still apply: keep macOS updated, use strong logins and back up your data. If your Mac is misbehaving, we offer Mac repair in Manchester too.

What to do if you think you have been hacked

Even with everything set up well, things can go wrong, and panic is the enemy. If you spot a login you do not recognise, a password that suddenly stops working, emails in your sent folder you did not write, or friends saying they have had odd messages from you, act quickly and calmly. The NCSC has a clear, step-by-step guide to recovering a hacked account, and the headline steps are: change the password for the affected account (and anywhere else you used it), check your email for sneaky forwarding rules criminals add to keep resetting your other passwords, turn on two-step verification and log out of every device, tell your contacts so they treat recent messages with suspicion, and check your bank and shopping accounts for anything you did not do. If it is your email that has been compromised, our guide on what to do when your email is hacked goes into more detail, and if you suspect malware is behind it we can help you clean it up properly.

Handling client and company data at home

If you are a sole trader, an accountant doing the books from the dining room, a tradesperson handling customer details, or anyone working from home with other people's personal information, then UK data protection law (UK GDPR) applies to you just as it would in an office. The good news, as the Information Commissioner's Office (ICO) points out, is that much of it is common sense you are probably already doing. A few practical points:

• Apply the same standards at home as at the office. The ICO has a dedicated working-from-home security checklist worth following.
• Protect and securely dispose of paperwork. Confidential letters and printouts should not sit in the recycling where they can be read or stolen; criminals fish out letterhead and documents for invoice fraud. A cheap cross-cut shredder is a sound investment, and the ICO covers shredding sensitive documents among its common-topics advice.
• Keep work documents out of family reach, both to protect confidentiality and to stop your six-year-old turning a client contract into a colouring page.

If you run a small business from home and would rather have all of this handled properly, our business computer support in Manchester can take it off your plate, from backups and encryption to staff devices.

Home office safety: button batteries and a quick sweep

The original version of this post spent a lot of time on physical child-safety, because it was written when kids were home all day. I have trimmed it right down, but there is one hazard I will not drop, because it is genuinely serious and hiding in plain sight in almost every home office.

Those little round, shiny batteries are in remote controls, key fobs, calculators, kitchen and luggage scales, thermometers, fitness trackers and musical greetings cards. If a child swallows one, it can react with saliva and burn through the throat or stomach within hours. The Royal Society for the Prevention of Accidents (RoSPA) is aware of UK deaths and life-changing injuries caused this way, and even a "flat" battery still holds enough charge to do harm. So check that battery compartments need a deliberate action or a screwdriver to open, store spare and used batteries well out of reach, and dispose of dead ones promptly. If you ever suspect a child has swallowed one, go straight to A&E or call 999 and do not wait for symptoms; the Child Accident Prevention Trust has clear guidance.

While you are at it, a five-minute sweep of the rest: route and tidy trailing cables so nobody trips and no child can pull a monitor down by its lead; anchor top-heavy shelving to the wall; keep drawing pins, staples and USB sticks in closed drawers; and give plugs and leads a quick check for damage without daisy-chaining overloaded extension leads. The HSE has free guidance on setting up a home workstation safely, which also helps your posture over the long term. For ideas on a comfortable, tidy setup that is easy to keep secure, see our budget home office inspiration.

Where Manchester PC can help

A lot of this you can do yourself in an afternoon. But if any of it feels like a faff, or you would simply rather it was done properly so you can get on with your actual job, that is what we are here for. We regularly help home workers and small businesses across Greater Manchester with checking Windows 11 eligibility and the upgrade, making sure Defender, the firewall and device encryption are on, setting up a password manager and two-step verification, hardening routers and Wi-Fi, putting a proper 3-2-1 backup in place, and cleaning up a machine you suspect has picked up malware. For ongoing help, see our IT support service, and we offer free local collection and return right across Manchester so you do not even need to leave the house.

To recap the essentials: turn on two-step verification (email first), use three random words and a password manager, keep everything updated and get off Windows 10, back up with the 3-2-1 rule, and leave the free, built-in Microsoft Defender switched on. Then add the bits a home full of family needs: respect those button batteries, tidy the cables, and keep confidential paperwork and small fingers well apart. Do that, and you have gone from an open spare bedroom to a properly secure home office. If you would like a hand with any of it here in Manchester, get a free, no-obligation quote, get in touch or call us on 0161 820 1992.