Why a VPN Alone Isn't Enough
A VPN is the foundation of online privacy — it encrypts your traffic and hides your IP address. But privacy requires a layered approach. Think of it like home security: a VPN is a strong front door lock, but you also need to close the windows.
Here are 15 practical steps that, combined with a VPN, will dramatically improve your online privacy.
1. Use a Privacy-Focused Browser
Chrome tracks everything. Switch to Firefox (with privacy extensions) or Brave for daily browsing. Both block third-party trackers by default and don't report your browsing to their makers.
Firefox recommended extensions:
- uBlock Origin — Best ad/tracker blocker
- Privacy Badger — Learns and blocks invisible trackers
- HTTPS Everywhere — Forces encrypted connections
2. Enable DNS-over-HTTPS (DoH)
Your DNS queries reveal every website you visit — even with a VPN, if DNS queries leak outside the tunnel. Enable DoH in your browser settings and use a privacy-respecting DNS provider:
- Cloudflare: 1.1.1.1 (no logging)
- Quad9: 9.9.9.9 (malware blocking + no logging)
Most quality VPN services (including VPN XO) handle DNS queries through the VPN tunnel automatically.
3. Use a Password Manager
Reusing passwords is the #1 cause of account breaches. Use a dedicated password manager to generate and store unique 20+ character passwords for every account.
Top picks: Bitwarden (free, open source), 1Password, or KeePassXC (offline).
Never store passwords in your browser — browser password stores are a prime target for malware.
4. Enable Two-Factor Authentication Everywhere
2FA blocks 99.9% of automated attacks. Use an authenticator app (not SMS — SIM swapping is too easy):
- Authy — Cloud backup, multi-device
- Google Authenticator — Simple, local-only
- YubiKey — Hardware security key (most secure)
Enable 2FA on: email, banking, social media, cloud storage, VPN accounts, and anything containing personal data.
5. Audit App Permissions Regularly
Review what permissions your apps have on mobile:
- Does a flashlight app need access to contacts? No.
- Does a weather app need your call history? No.
- Does a game need microphone access? No.
On Android: Settings → Apps → Permissions
On iOS: Settings → Privacy & Security
Remove any permission that isn't essential to the app's primary function.
6. Use End-to-End Encrypted Messaging
Standard SMS and many messaging apps don't encrypt your messages. Switch to:
- Signal — Gold standard for privacy (open source, audited)
- WhatsApp — End-to-end encrypted (but owned by Meta)
Avoid: SMS/MMS, Facebook Messenger (unless Secret Mode), Telegram default chats (not E2E encrypted by default).
7. Minimize Your Digital Footprint
- Delete unused accounts — Use justdeleteme.xyz to find how to delete old accounts
- Use throwaway emails — Services like SimpleLogin create aliases that forward to your real email
- Opt out of data brokers — Sites like DeleteMe help remove your info from people-search sites
- Avoid "Sign in with Google/Facebook" — It links your activity across sites
8. Keep Software Updated
Security patches fix known vulnerabilities that hackers actively exploit. Enable automatic updates for:
- Operating system
- Browser
- Phone apps
- Router firmware (often forgotten but critical)
The 2025 MOVEit breach affected 2,000+ organizations because they delayed a patch by just 48 hours.
9. Use Encrypted Email
Standard email is sent in plaintext between servers. For sensitive communications:
- ProtonMail — Free tier, Swiss jurisdiction, E2E encrypted
- Tutanota — Free tier, German jurisdiction, fully encrypted
Even for regular email, enabling PGP/GPG encryption adds a layer of protection.
10. Secure Your Home Network
- Change default router admin password (admin/admin is not secure)
- Use WPA3 encryption (WPA2 at minimum)
- Disable WPS (known vulnerability)
- Create a separate guest network for IoT devices
- Update router firmware regularly
- Consider router-level VPN (VPN XO supports this)
11. Be Skeptical of "Free" Services
If a product is free and not open source, you are the product. This applies to: free VPNs (most of them), free email providers (Gmail reads your email for ads), free cloud storage, social media platforms.
Look for services with clear business models — typically paid subscriptions or open-source donations.
12. Use Virtual Cards for Online Shopping
Services like Privacy.com generate virtual credit card numbers for each merchant. Benefits:
- If the merchant is breached, your real card is safe
- Easily cancel and replace merchant-specific cards
- Set spending limits per card
- Keep your real financial info private
13. Review Cloud Storage Security
Google Drive, Dropbox, and OneDrive can read your files (they're not end-to-end encrypted). For sensitive documents:
- Tresorit — E2E encrypted cloud storage
- Cryptomator — Encrypts files before uploading to any cloud provider (free, open source)
- Veracrypt — Create encrypted volumes for local storage
14. Be Careful with Smart Devices
Smart speakers, cameras, and doorbells are always listening/watching. If you must use them:
- Put IoT devices on a separate network
- Review and delete recordings regularly
- Disable features you don't use
- Research the manufacturer's privacy policy before buying
- Consider open-source alternatives (Home Assistant)
15. Use a VPN on All Devices
A VPN only protects the device it's running on. Your phone, laptop, tablet, and even smart TV should all be covered.
VPN XO supports up to 3 simultaneous devices on premium plans, covering your entire household with one subscription. Even the free tier provides genuine protection for 1 device with 10/5 Mbps speed and up to 8 GB/month data.
The bottom line: Privacy is a layered practice. Start with a VPN, then add these steps one by one. You don't need to do everything at once — every step you take makes you significantly harder to track.