Freelancers face a distinct security challenge: no company IT department, personal devices doing double duty for business, and access spread across many different clients’ systems simultaneously. This checklist pulls together the practical steps that matter most for a working freelancer, drawing on the more detailed guides elsewhere on this site.
Separate personal and work digital life where practical
Use a separate browser profile, or ideally a separate user account on your computer, for client work versus personal browsing. This limits how much a compromise in one context (a risky personal download, for example) can affect the other, and makes it easier to reason about what data and access exists where when a project ends.
Use a password manager organized by client
Our dedicated guide on storing client passwords and API keys safely covers this in depth. At minimum, every client’s credentials should live in their own clearly labeled folder within a proper password manager, never in a shared spreadsheet, sticky note, or browser autofill with no organization.
Enable two-factor authentication everywhere it is offered
This applies to your own accounts and, where you have the ability to configure it, any client accounts you have been granted access to. See our full two-factor authentication guide for the specific setup details, including which methods (authenticator apps over SMS) offer meaningfully better protection.
Use a VPN on public and untrusted networks
Freelancers working from coffee shops, co-working spaces, and while traveling connect to untrusted networks far more often than someone working from a single dedicated office. A VPN, covered in our VPN guide, protects your connection specifically in these scenarios where you have no control over or visibility into the network’s own security.
Keep your own devices and software updated
Without an IT department pushing updates automatically, this responsibility falls entirely on you. Enable automatic updates wherever your operating system and key applications support it, and periodically check manually for anything that does not update automatically, since an outdated device you use across multiple clients’ work represents a single point of failure with unusually broad consequences if compromised.
Back up your own work and business data
As a freelancer, you likely do not have an employer’s IT team maintaining backups on your behalf. Set up automated backups for your own devices and any client work stored locally, following the same principles covered in our cloud backup strategies guide, adapted to a solo operator’s scale — even a simple automated cloud backup service is far better than no backup strategy at all.
Be alert to phishing targeting freelancers specifically
Freelancers are frequently targeted with phishing attempts disguised as new client inquiries, fake payment notifications, or urgent requests appearing to come from an existing client, precisely because freelancers are accustomed to receiving genuine unsolicited inquiries and may apply less scrutiny than an employee would to an unexpected external email. Our phishing guide covers the specific patterns to watch for, including verifying unusual payment or credential requests through a separate communication channel before acting.
Have a written client offboarding habit
At the end of every engagement, run through a short mental or written checklist: remove or archive that client’s credentials from your password manager, confirm any shared access has been revoked on the client’s end, and delete any client data you no longer have a legitimate ongoing reason to retain. Making this an automatic habit after every project, rather than an occasional cleanup task, prevents the slow accumulation of stale access that becomes harder to fully audit the longer it is left unaddressed.
Handling security requirements written into client contracts
As client work grows more security-conscious, it is increasingly common for contracts to include specific security requirements — mandatory two-factor authentication, data handling clauses, or requirements to use the client’s own approved tools rather than your personal setup. Read these clauses carefully before signing, and if a requirement is unclear or seems to conflict with how you normally work, ask the client to clarify before the engagement begins rather than discovering a compliance gap partway through the project.
Keeping a simple personal record of which clients have specific contractual security requirements, separate from clients with no such requirements, helps ensure you do not accidentally apply a less rigorous default practice to an engagement that specifically called for more.
Complete checklist
1. Separate personal and work browsing where practical.
2. Organize client credentials by client in a proper password manager.
3. Enable two-factor authentication on your own and, where possible, client accounts.
4. Use a VPN on any public or untrusted network.
5. Keep devices and software updated, checking manually where automatic updates are not available.
6. Set up automated backups for your own work and locally stored client data.
7. Apply extra scrutiny to unsolicited inquiries and unusual payment or credential requests.
8. Build a consistent offboarding habit at the end of every client engagement.
Frequently asked questions
Is this level of security overkill for a freelancer just starting out?
Most of these steps take minimal ongoing time once initially set up, and the cost of a compromised client account or lost work — both financial and reputational — is disproportionately high compared to the modest time investment required to prevent it, even early in a freelance career.
Should freelancers carry any form of cyber insurance?
This depends on the nature and sensitivity of the work, and is worth discussing with an insurance professional familiar with your specific field, particularly if you regularly handle sensitive client data or have contractual liability exposure written into client agreements.
What is the single most impactful step for a freelancer with limited time to invest in security?
Setting up a proper password manager organized by client, combined with two-factor authentication on your most important accounts, addresses the highest-probability risks with the least ongoing time investment, making it the most reasonable starting point if you can only prioritize one or two items from this checklist immediately.
For more on building your freelance security practice, see our full hardening guides section and tool reviews.