I’ve set a few strict rules for myself; otherwise, my hands tend to shake easily when the market gets tense.

Think of mnemonic devices as a “disconnected internet will,” only written on paper and tucked away, never taking photos or sending them to anyone (even if the other person’s avatar is myself).
Signatures/authorizations are a red line: if I don’t understand, I won’t sign; the more aggressively a pop-up urges me, the more I’ll pause, preferring to miss an airdrop rather than wake up in the middle of the night to find my wallet emptied.
Recently, modularization and the DAO layer are being hyped up, and developers are pretty excited, but ordinary users are often confused, making it easy for phishing sites to take advantage and set up “claim/transfer” pages…
Anyway, I’d rather go slow, first verify the domain name, then click the link—less money, more sleep, peace of mind.