Hacking isn’t “one click” — beginners often miss the most important step