For years, ransomware — spyware that locks you out of your files unless you pay the hacker who infected your computer — has been a problem for computer users and businesses. Given its frequency and the risk of losing sensitive assets like documents or family photos as a result of a ransomware outbreak, it’s a good idea to make sure you’re secured. Microsoft has added tools to its built-in Windows Security software that can help keep your machine safe from ransomware starting with Windows 10.

There are two tiers of Windows Security when it comes to ransomware. The first is malware scanning, which is enabled by default and can be learned more about here. While this will prevent ransomware from being installed on your computer, the scans will not be able to safeguard your files if a piece of malware does manage to get through.

The second level of defense is Windows’ ransomware protection, which must be enabled manually. Before you do, keep in mind that this option isn’t enabled by default for a reason. It works by allowing only authorized apps to make modifications to your files, preventing ransomware from encrypting and locking them away. This, however, can cause issues with apps that aren’t expecting it, so if you have ransomware protection switched on, you may need to do some troubleshooting from time to time.

While Windows’ ransomware protection is a powerful built-in tool, it’s probably not a good idea to rely on it as your only line of defense — like all anti-malware systems, it should be treated as a backup rather than the first line of defense. Here are some steps you can take to avoid becoming infected with ransomware in the first place and to ensure that your data is safe even if the worst happens.

Ransomware, like any other type of malware, can spread in a variety of methods, including attachments to phishing emails, exploiting security gaps in out-of-date software, and posing as a legitimate program. When you’re online, it’s crucial to be cautious; if someone tries to persuade you to download a program from an untrustworthy source that appears to be too good to be true, proceed with caution.

It’s also crucial to double-check the file extensions you get. If someone claims an attachment is a paper yet contains a.exe or.msi extension, it is most likely a harmful file. If you don’t see the file’s extension right away, right-click it and select “Properties.” Next to the “Type of file” heading, Windows will inform you what kind of file it is.

Microsoft’s guide to protecting yourself from ransomware lists some of the things that can lead to your computer being infected:

• Visiting unsafe, suspicious, or fake websites.

• Opening file attachments that you weren’t expecting or from people you don’t know.

• Opening malicious or bad links in emails, Facebook, Twitter, and other social media posts, or instant messenger or SMS chats.

It’s also critical to keep up with the newest security patches for your operating system and any software you use daily. Most browsers will automatically update themselves, and Windows will normally install updates as they become available. Go to “Settings”> “Windows Update” and click the “Check for updates” option to manually check for updates.

If all of your defences have failed and you realize that your machine has been infected with ransomware, you should take the following three steps:

Disconnect your computer from Wi-Fi or ethernet – certain ransomware can spread to other machines on your network, so limiting the damage is critical.
The ransom may be unlawful, depending on where the hackers are attempting to extort you, and paying does not guarantee that you will regain access to your files.
If you have backups, don’t plug them in because the ransomware will almost certainly try to destroy them as well.