Password & Account Security Checklist
Password & Account Security Checklist
Online accounts protect important parts of your personal and professional life, including email, banking, social media, cloud storage, business applications, and work systems. Weak passwords, reused credentials, exposed recovery details, and unauthorized access can put these accounts at risk.
This Password & Account Security Checklist helps individuals, students, professionals, small business owners, and IT teams improve account protection through strong authentication, secure recovery methods, and regular access reviews.
Use this checklist when securing new accounts, reviewing existing accounts, responding to a suspected compromise, or improving an organization's account security practices.
1. Identify Important Accounts
List your primary email accounts.
Identify banking, payment, and financial accounts.
List social media and messaging accounts.
Identify cloud storage and productivity accounts.
List work, administrator, and business application accounts.
Include website hosting, domain registrar, and developer accounts where applicable.
Identify accounts that can reset access to other services.
Prioritize accounts containing sensitive information.
Identify accounts with administrative privileges.
Record where account ownership and recovery details are managed.
Verification: Confirm that you know which accounts are most important and which ones could be used to access other services.
2. Create Strong, Unique Passwords
Use a different password for every important account.
Prefer long passwords or passphrases that are difficult to guess.
Avoid predictable patterns and commonly used passwords.
Do not use easily discoverable personal information.
Avoid predictable variations of the same password across accounts.
Use a password manager to generate and store passwords where appropriate.
Replace default passwords on devices and services.
Change weak or reused passwords.
Change passwords promptly when compromise is suspected.
Follow organizational password requirements for work accounts.
Verification: Confirm that important accounts use unique credentials that are not easily guessed or reused.
3. Set Up a Password Manager
Select a reputable password manager appropriate for your needs.
Create a strong, unique master password or use the provider's supported secure authentication method.
Enable multifactor authentication where available.
Store passwords in the manager rather than unsecured notes or documents.
Use its password-generation feature where appropriate.
Review password-health warnings.
Secure account recovery options.
Keep emergency recovery information in a protected location.
Review browser extensions and device access associated with the manager.
Understand the provider's backup and recovery procedures.
Verification: Confirm that passwords are stored securely and that you can recover access to the password manager if necessary.
4. Enable Multi-Factor Authentication
Identify accounts that support multi-factor authentication (MFA).
Enable MFA on primary email accounts.
Enable MFA on financial and business accounts where available.
Enable MFA on social media and cloud accounts.
Protect administrator accounts with strong authentication.
Prefer passkeys or security keys where supported and appropriate.
Consider authenticator applications as an alternative to SMS where suitable.
Secure backup codes.
Register a backup authentication method when supported.
Test the sign-in and recovery process.
Verification: Confirm that critical accounts require an additional authentication factor and that backup access methods are protected.
5. Secure Account Recovery Options
Verify the recovery email address.
Confirm that the recovery phone number is current.
Protect the email account used for password resets.
Review security questions and recovery settings where available.
Avoid answers that can be easily discovered online.
Store recovery codes securely.
Remove outdated recovery devices or phone numbers.
Review trusted contacts where the service supports them.
Understand the account recovery process.
Confirm that recovery options do not expose accounts to unauthorized access.
Verification: Ensure that you can recover important accounts without relying on outdated contact details or insecure recovery information.
6. Protect Your Primary Email Account
Use a unique, strong password.
Enable MFA.
Review recovery email addresses and phone numbers.
Check active sessions and signed-in devices.
Remove unfamiliar sessions.
Review email forwarding rules.
Check filters and rules for suspicious changes.
Review connected applications and delegated access.
Confirm that account security alerts are enabled where available.
Verify that your email provider's recovery process is understood.
Verification: Confirm that the primary email account is protected because it may be used to reset passwords for many other services.
7. Review Active Sessions and Trusted Devices
Open the account's security settings.
Review currently signed-in devices.
Check recent login activity where available.
Identify unfamiliar locations, devices, or sessions.
Sign out of devices you no longer use.
Revoke sessions that appear suspicious.
Remove old trusted devices.
Review remembered browsers.
Check account activity after using shared computers.
Change credentials if unauthorized access is suspected.
Verification: Confirm that only recognized users and devices retain access to your accounts.
8. Review Connected Applications and Permissions
List applications connected to important accounts.
Identify services you no longer use.
Review the permissions granted to each application.
Remove access for unnecessary applications.
Check whether connected services can read email, files, or profile information.
Review third-party access to business accounts.
Revoke access for unfamiliar integrations.
Check browser extensions that can access sensitive websites.
Review API tokens and app passwords where applicable.
Document approved integrations for business-critical accounts.
Verification: Ensure that connected applications have only the permissions they need and that unused integrations no longer have access.
9. Protect Accounts on Shared and Public Devices
Avoid saving passwords on devices you do not control.
Do not enable automatic sign-in on shared computers.
Sign out when finished using a shared device.
Close sessions and browser windows after sensitive tasks.
Avoid accessing highly sensitive accounts on untrusted devices.
Do not leave authentication codes visible.
Check for unexpected browser extensions or security warnings.
Use your own trusted device for account recovery where possible.
Avoid copying passwords into public or shared documents.
Report suspected device compromise if you used the device for sensitive access.
Verification: Confirm that temporary access does not leave accounts signed in or credentials stored on devices you do not control.
10. Protect Against Phishing and Credential Theft
Check the sender's address before responding to security messages.
Inspect website domains before entering credentials.
Avoid clicking unexpected password-reset links.
Navigate directly to the official website when uncertain.
Never share one-time passwords or authentication codes with someone who contacts you unexpectedly.
Be cautious of urgent account-suspension warnings.
Verify requests from support staff through official channels.
Avoid entering credentials after following suspicious links.
Report phishing attempts.
Learn how to respond if credentials are entered on a fraudulent website.
Verification: Ensure that you can distinguish legitimate account activity from suspicious requests for passwords or authentication codes.
11. Secure Business and Administrator Accounts
Use individual accounts rather than shared administrator credentials where possible.
Enable MFA for administrative access.
Assign permissions based on job responsibilities.
Remove unnecessary administrator privileges.
Review access when employees change roles.
Disable accounts promptly when access is no longer authorized.
Store service credentials securely.
Restrict API tokens to required permissions.
Review domain registrar and hosting account access.
Document account ownership and emergency contacts.
Establish an approval process for high-impact access changes.
Verification: Confirm that administrative access is restricted, traceable, and reviewed regularly.
12. Monitor Account Security Alerts
Enable relevant security notifications.
Review alerts about new sign-ins.
Check notifications about password changes.
Review MFA changes and recovery-setting updates.
Investigate unfamiliar device registrations.
Check alerts about suspicious application access.
Verify unexpected account changes through the official service.
Report unauthorized activity.
Keep records of significant security incidents.
Review alert settings periodically.
Verification: Confirm that security alerts reach an appropriate person and that suspicious activity is investigated promptly.
13. Respond to a Suspected Account Compromise
Use a trusted device to access the affected account.
Follow the service's official account-recovery process.
Change the compromised password.
Change reused passwords on other affected accounts.
Revoke suspicious sessions and connected application access.
Review recovery email addresses and phone numbers.
Reconfigure MFA if authentication settings were changed.
Check for suspicious forwarding rules or account modifications.
Review recent transactions or activity where relevant.
Notify your organization's IT or security team if it is a work account.
Contact the relevant bank or service provider if financial access is affected.
Preserve relevant evidence and follow reporting requirements.
Verification: Confirm that unauthorized access has been addressed, recovery settings are secure, and related accounts have been reviewed. If you cannot regain access, use the provider's official recovery channel.
14. Review Password Exposure and Account Breaches
Use reputable breach-notification services or built-in security checks.
Review alerts about exposed credentials.
Change passwords associated with confirmed exposure.
Check whether exposed credentials were reused elsewhere.
Secure accounts that depend on the affected email address.
Review account activity for signs of misuse.
Avoid submitting passwords to untrusted checking websites.
Treat breach notifications as prompts for verification, not proof that every account has been accessed.
Document relevant remediation actions.
Recheck affected accounts after remediation.
Verification: Confirm that exposed credentials are replaced and that potentially affected accounts are reviewed.
15. Establish Regular Account Reviews
Review critical account settings monthly or according to risk.
Check active sessions and trusted devices.
Review MFA and recovery options.
Remove unused accounts and connected applications.
Review administrator permissions.
Check password-manager alerts.
Investigate unresolved security notifications.
Confirm that recovery codes remain accessible and protected.
Update account records after major changes.
Schedule the next review.
Verification: Ensure that account protection remains effective as devices, applications, responsibilities, and recovery details change.
16. Document Account Ownership and Recovery
Maintain an inventory of important accounts.
Record the account owner and business purpose where applicable.
Document approved recovery procedures.
Store recovery information in a secure location.
Identify who can authorize access recovery for business systems.
Document how to revoke access when a device is lost.
Establish a process for employee departures and role changes.
Review emergency access arrangements.
Keep instructions current without recording passwords in plain text.
Confirm that authorized personnel can follow the recovery procedure.
Verification: Ensure that accounts can be managed and recovered securely without relying on undocumented knowledge or unsafe credential sharing.
Common Password and Account Security Mistakes to Avoid
Reusing passwords: A breach on one service can put other accounts at risk.
Using weak recovery methods: Protect recovery email addresses, phone numbers, and codes.
Ignoring MFA: Enable additional authentication on important accounts.
Sharing one-time codes: Treat authentication codes as confidential.
Leaving old sessions active: Sign out devices and sessions you no longer trust.
Granting excessive application permissions: Review and revoke unnecessary access.
Ignoring security alerts: Investigate unexpected account changes.
Using shared administrator credentials: Prefer individually assigned accounts with appropriate permissions.
Storing passwords in plain text: Use a suitable password manager.
Waiting after a suspected compromise: Follow the provider's official recovery process promptly.
Final Password and Account Security Sign-Off
Important accounts have been identified.
Unique passwords are used for critical accounts.
A suitable password manager is configured where appropriate.
MFA is enabled on important accounts.
Recovery details and backup codes are secured.
Primary email security has been reviewed.
Active sessions and trusted devices are checked.
Connected applications and permissions are reviewed.
Business administrator accounts are protected.
Security alerts are enabled and reviewed.
Account recovery procedures are documented.
The next security review is scheduled.
Account review owner: ____________________
Review date: ____________________
Outstanding actions: ____________________
Conclusion
Strong account security depends on unique passwords, effective authentication, protected recovery methods, controlled access, and prompt responses to suspicious activity. Use this checklist to reduce the risk of unauthorized access and make account protection a regular habit.
Learn. Prepare. Grow. — GoBizly
Explore more practical technology and AI checklists at GoBizly to improve your digital security habits.
