4) don't browse dodgy websites

5) don't open emails from unknown individuals, businesses, government departments etc.

6) don't click links or open attachments in emails forwarded by friends or family, even if they're "amazing", "really funny" etc. You might miss something you'd wished you'd seen. You might also miss a ransomware installation.

For Flash, I recommend the FlashBlock extension for Firefox/Pale Moon. Blocks Flash by default on all sites, but you can either whitelist a site, or allow a specific control to play if you want. Hence, it's not too annoying if you do need to allow on a specific site.

What does that give that the browser built-in click-to-play plus uMatrix doesn't provide?

I use Pale Moon which doesn't have "click to play". Must admit, I've not tried uMatrix, might have to give that a try...

And, I've tried it. Looks interesting, but the main thing that FlashBlock does give is simplicity. A simple Flash icon that turns into a "play" icon when you hover over it. Click, and that Flash element loads and plays.

> I use Pale Moon which doesn't have "click to play"

It did (in about:config only), but apparently it keeps getting broken in recent versions, so people have resorted to extensions like FlashBlock. Meh.

Doesn't really bother me. One tiny extension and the issue is solved. uMatrix is interesting, but it has the downside of breaking most sites without a lot of fiddling to configure it properly. FlashBlock is a lot less powerful, but does work rather more simply overall.

It's easy enough to allow common frameworks/CDNs across all sites (and then use Decentraleyes to use local copies instead). Anything which breaks after that deserves further attention.

Thanks everyone for the suggestions and safety recommendations. I would surely look into them. More suggestions are also welcome.