Always use HTTPS when possible. Assume anyone can see anything you are doing if not using HTTPS. HTTPS is secure, HTTP is not. If you are using HTTPS then someone might be able to see which website are visiting but not the data you send to the website.
For example, Google, YouTube, Facebook and others now use HTTPS by default (you need to check). So someone could see you are visiting these sites but not see your emails, messages, search results, videos you are watching, etc.
But .. Cheaprvliving does not use HTTPS so assume anyone can read your private messages, intercept your password, etc. Do not use a password on this site that you use elsewhere. It would be great if this website would use HTTPS at least for the login.
Knowing the difference between HTTP and HTTPS is a huge first step in protecting yourself.
VPN's are more about anonymity then security. They also can get around websites that are blocked on free wifi spots. If a free wifi is blocking Netflix, start a vpn and you can get to netflix.
Ad blockers are about blocking ads which significantly slow down websites and allow third parties to track your habits. websites load 10+ times faster with ad blockers. Always be sure to allow ads on sites you support.
Open/free DNS servers are again about preventing your ISP from tracking you and selling the data or inserting ads into your http requests.