The most important "rule" in my opinion: If you aren't the sole controller of your private keys, you don't have any bitcoins.
This is important to remember. Online bitcoin wallets are just like bank savings accounts - when you put your money in a savings account you don't actually own that money, you own an IOU from the bank. You don't actually own the money if it's not cash in your possession, in your home.
With bitcoin, the "possession" part comes from owning the private keys (which is a 26+ long character alphanumeric number). If you have this private key for your wallet, you have full and sole possession of your bitcoin. The alternative is a bank-like set up (companies like Coinbase or Circle). Those companies own the private keys and you own an IOU from those companies. It's not bad, just important to know.
A lot of people make it seem like using an online wallet is crazy risky. It's risky only in the sense that there's no insurance to protect you if the company goes out of business, such insurance exists for savings accounts with banks if your bank goes out of business.
Welcome to the forum and to Bitcoin!
