Checklists

A one-hour review that closes the most common routes into your accounts.

• Install a password manager and move your important accounts into it first: e-mail, bank, cloud storage, phone account.
• Give your e-mail account a unique, long password. Whoever controls it can reset the rest.
• Turn on multi-factor authentication for e-mail, banking, social media and cloud storage. Prefer passkeys or an authenticator app to SMS.
• Save the backup codes of each service somewhere offline.
• Check the recovery e-mail and phone number of your main accounts.
• Review active sessions and signed-in devices; sign out the ones you do not recognise.
• Look at which apps and sites have access to your accounts and remove old ones.
• Close accounts you no longer use.

Basic hygiene that stops most commodity attacks.

• Turn on automatic updates for the operating system, browser and apps.
• Replace any device that no longer receives security updates, or keep it off sensitive work.
• Set a screen lock with a PIN of at least six digits or a passphrase; enable biometrics as a convenience.
• Turn on full-disk or device encryption and note where the recovery key is stored.
• Install apps only from the official store; remove ones you do not use; review permissions.
• Use a standard user account for daily work on a computer.
• Enable device-location and remote-wipe features so a lost device can be found or erased.
• Back up photos and documents to a place that is not the same device.

The router is the front door of everything at home.

• Change the router's administrator password from the default and update its firmware.
• Use WPA2 or WPA3 with a long Wi-Fi password; switch off WPS.
• Switch off remote administration of the router unless you need it.
• Put visitors and smart-home devices on a guest network if the router supports it.
• Change default passwords on cameras and other connected devices; remove ones you no longer use.
• List the devices connected to the router and ask about any you cannot identify.

Controls that matter most for a team without a dedicated security staff.

• Keep a list of devices, accounts, software and where customer data lives.
• Require multi-factor authentication for e-mail, remote access, accounting and administrator accounts.
• Give each person their own account and only the access their job needs; remove access on the day someone leaves.
• Require a second person to approve payments and changes of supplier bank details.
• Back up business data using the 3-2-1 idea and test a restore at least twice a year.
• Apply updates to servers, firewalls and VPN devices within days, not months.
• Write a one-page incident plan: who decides, who is called, which systems are isolated first.
• Find out which personal data you hold and what the data-protection law requires if it leaks.

A short hardening list for a site you run or commission.

• Serve every page over HTTPS and send the Strict-Transport-Security header.
• Send a Content-Security-Policy that avoids inline scripts and wildcards.
• Add X-Content-Type-Options: nosniff, a Referrer-Policy and frame protection.
• Mark session cookies Secure, HttpOnly and SameSite.
• Use parameterised queries and encode output; check every permission on the server.
• Keep the platform, plugins and dependencies updated; remove those you do not use.
• Protect the administration area with multi-factor authentication and, if possible, an address allow-list.
• Publish a way to report security problems, such as a security contact address.

What to do when you suspect an account or device is compromised. Write down the time and what you saw before you change anything.

• Write down the time, what you noticed and which accounts or devices are involved.
• Disconnect the affected device from the network, but do not turn it off if a forensic examination may follow.
• From a different, clean device, change the password of the affected account and sign out all sessions.
• Check recovery options, forwarding rules and connected apps on the account.
• Tell your IT contact, your bank or the service provider, as the case requires.
• If money moved, contact the bank immediately; the first hours matter most.
• Keep messages, headers and screenshots as they are; do not delete the evidence.
• When personal data of others is involved, find out whether a legal notification duty applies.