Your account
1. Turn on two-step verification
This is the big one. With two-factor authentication, signing in needs a code from an authenticator app on your phone as well as your password, so a leaked password on its own isn't enough. On the website it's under Dashboard, then Security; in the app, under Settings, then Account. It's free.
2. Put the backup codes somewhere safe
When you turn it on, you get 10 backup codes, shown once. Each works once if you lose your phone. Print them or keep them in a password manager, not in a file on the PC you're protecting.
3. Only remember browsers that are yours
Without two-step verification, a new browser asks for a code we email you, and you can tick Remember this browser for 30 days. That's handy on your own laptop and a bad idea on a shared or work computer. On anything that isn't yours, use a private window and sign out when you're done.
Your PCs
4. Use unattended access only on your own PCs
Unattended access lets your console in without anyone clicking Allow. It's meant for PCs you own and look after, and it can only be turned on by someone at the PC. For helping other people, leave it off: the Allow prompt is what keeps them in charge. Not sure which you need? See attended or unattended, and how to set up unattended remote access for the safe way to turn it on.
5. Review trusted consoles and browsers
Each PC remembers the consoles and browsers it trusts. Right-click the RemoteAccessApp icon next to the clock, choose Trusted consoles and browsers… and remove anything you don't recognize or no longer use, like an old laptop. Removal takes effect at once. For the bigger picture, including SSH servers, see how to control who can access your PCs and servers.
6. Add a connection password where it matters
A connection password is an extra lock on one PC: anyone connecting has to type it first, from the app or a browser. The PC checks it itself, and after repeated wrong tries it makes people wait. It's a good fit for an always-on PC or one with unattended access. See connection passwords.
7. Limit where your account works, if your locations are fixed
If you only ever connect from home and the office, you can limit your account, or a single PC, to trusted networks. Anywhere else is refused. Skip this if you travel, or update the list before you go. If you'll be on a network you don't control, see remote access to your PC from hotel, campus and public Wi-Fi for what to set up before you leave.
8. Remove PCs you no longer use
Sold a laptop or retired an old desktop? Remove it from your account with Remove this PC from your account in its tray menu. Signing out of the app on a PC removes it too, so nobody can reach it until it's set up again.
Habits
9. Glance at the security log now and then
Your account keeps a log of sign-ins, PCs added or removed, account changes and when each session took place (never what happened in it). If something there wasn't you, change your password and check your trusted consoles.
10. Let updates happen
RemoteAccessApp installs its own updates in the background, with notice first and never while someone is connected. Keep Windows updated too. For a fresh install, download it yourself from remoteaccessapp.com: our Windows app is now code-signed, and that post explains the SmartScreen warning Windows may still show for a while.
11. Never let a stranger in
No setting can stop someone from being talked into clicking Allow. Real companies don't phone out of the blue and ask to connect to your PC. Share how to spot a remote access scam with the people you help.
In a team?