Most “forgot password” links go to your main email. If someone gets into that inbox, your other accounts are at risk too. So a security check doesn’t need to cover every account at once. Start with email.

One rule before you begin: go to settings through the official website or app, never through a link in a “security alert” email or text. Fake security alerts are one of the most common phishing tricks.

Step 1: how do you sign in?

  • Is your email password used anywhere else? If so, change it to one used only for this account.
  • Turn on two-step verification or set up a passkey, following the service’s official instructions, for example Google 2-Step Verification.
  • Work or school accounts may be managed by an administrator. If in doubt, ask their support.

Never write passwords, codes or recovery codes in your task list. The list records that you checked something, not the secret itself.

Step 2: who has access?

  • Signed-in devices: look into any you don’t recognise in the official security settings, then sign them out if they aren’t yours.
  • Connected third-party apps: remove the ones you no longer use.
  • Email forwarding rules: an unfamiliar rule could be quietly sending your mail to someone else.

On shared or work accounts, don’t remove access until you know who is using it.

Step 3: can you still recover the account?

Make sure your recovery phone number and backup email are still yours and still reachable. If the service offers recovery codes (such as Google backup codes), keep them in a password manager or on paper, somewhere other than your task list.

Then move on to other accounts

Once email is done, run the same three steps on your bank, payment, cloud storage and main social accounts. If you can’t finish in one go, list the rest as follow-up tasks.

If you find signs of a break-in, such as unknown sign-ins or messages you didn’t send, stop the routine check and follow the service’s official account recovery process straight away.

Try one round with the timer

Thirty minutes in three parts:

  • 5 minutes choose accounts: your main email plus two or three of the most important others.
  • 15 minutes check sign-in and access: passwords, two-step verification, devices, apps, forwarding.
  • 10 minutes check recovery and wrap up: recovery phone, backup email, recovery codes and loose ends.

Don’t rush security settings. Pause the timer if you need to.

Next

Copy the personal account security checklist and tick off each item. While you are in your accounts, look for forgotten charges too: how to check subscriptions and auto-renewals.

Sources

Partly adapted from HowToLiveBetter by eternity4719 and contributors (14 October 2026 snapshot), licensed under CC BY 4.0. Todo & Timer rewrote the steps and examples.

Book entries used: chapter 14, “Account and information security”: 14.1 · 14.2 · 14.3 · 14.6 · 14.7 · 14.10.