Review every request
Before connecting to a dapp, check the website domain, requested wallet, requested network, and any permissions shown in the wallet approval screen. A connection request should match the site you intended to visit; if the domain looks off, cancel.
Signing is not the same as sending
Some dapps ask for message signatures while others request transactions. A signature can still authorize actions like token approvals, so read approval screens carefully and reject requests you do not understand. Never sign a blank or confusing message.
Disconnect stale sessions
If a dapp no longer needs access, disconnect the session and reconnect later only when you need it. Periodically reviewing connected sites and token approvals limits what an old or compromised dapp could do.