The whole checklist

Every action this manual teaches, on one page, grouped by chapter, each linked to the section that explains it. Essentials come first in each group; the rest is marked Go deeper.

Your ticks are saved in this browser, separately from the ticks on each chapter page. Print the page for a paper checklist. The Show only the essentials switch on chapter pages does not apply here, so optional items stay visible and are labelled Go deeper.

Print the checklist

Your starting list

• Make the text on your screen comfortable to read. How
• List each device on the device list, with who uses it and the system and version it runs. How
• Write your main email in the first row of the account list. How
• Give the phone company its own row, with the last four digits of the number. How
• Add your bank or credit union, each card, any linked money app and the device account, and mark the three that matter most. How
• Check that neither list holds a password, PIN, code, security answer or full number. How
• Choose where the printed list will live, apart from any password book. How
• Run the account sweep on your main email. How (Go deeper; optional)
• Run a built-in breach check (Apple Passwords or Google Password Checkup). How (Go deeper; optional)
• If two people share one email address, decide together whose phone is the recovery phone. How (Go deeper; optional)

Getting back in

• Check that the main email's recovery phone is a phone you have now. How
• Check that the main email's recovery email is a different account, and sign in to it today. How
• On the recovery sheet, write the date you checked the recovery phone and email, and where any printed code is kept. How
• If your devices sign in with a different account (Apple Account, Google Account or Microsoft account), check its recovery details too. How
• Add a recovery contact on each account that offers one, and tell the person. How
• If you have a Microsoft account, print its recovery code and keep it with your important papers. How
• List the people you trust with a role on the recovery sheet, with how to reach them. How (Go deeper; optional)
• Put a date on your calendar to look again a week after any Google recovery change. How (Go deeper; optional)

Passwords

• Turn on the built-in password manager, or choose a password book, where it lives and its conditions. How
• Give the main email a new password of four or more random words or 15 or more characters, used by no other account. How
• Save the new email password in the manager or write it in the book, and sign in once with it. How
• Run the password check, and mark on the account list which accounts still share a password. How
• Change the money accounts' passwords, or set a time this week to change them. How
• On one site, replace the security question answers with random words kept with that password. How (Go deeper; optional)
• Make a six-word passphrase with dice and compare it in the passphrase calculator. How (Go deeper; optional)
• Delete any exported password file from an old manager. How (Go deeper; optional)

Two-step sign-in and passkeys

• Turn on two-step sign-in for the main email, with the strongest method it offers. How
• Print the backup codes, and write where they are kept on the recovery sheet. How
• Turn on the phone company's number lock, or ask the company how. How
• Mark two-step sign-in and backup codes for the main email on the account list. How
• Turn on two-step sign-in, or ask about it, for each bank and card account. How
• Learn the two rules: approve only a sign-in you started, and read a code to no one who contacted you. How
• Make a passkey on the main email account. How (Go deeper; optional)
• Review the text-code option on accounts where another method has worked. How (Go deeper; optional)

Your phone and tablet

• Install waiting updates and turn on automatic updates on each phone and tablet. How
• Write on the device list when each one stops getting updates, or "not published." How
• Set a screen lock of six or more digits and a short auto-lock time. How
• Turn on Find My or Find Hub (on Android, check that the phone shows up at android.com/find). How
• Turn on Stolen Device Protection or Theft protection, or mark it "not offered." How
• Get apps only from the App Store or Google Play, and check which apps can use location, camera and microphone. How
• Check who else has access, with Safety Check, Apple's checklists or the Google Account devices page. How
• Review every app's permissions with the App Privacy Report or the privacy dashboard. How (Go deeper; optional)
• Erase any old phone in the maker's order, and write it on the old devices sheet. How (Go deeper; optional)

Your computer and home Wi-Fi

• Check each computer for updates today, and turn on automatic updates. How
• Write each computer's system, version and update end date (or "not published") on the device list. How
• Check the built-in protection on each computer, and note it on the device list. How
• Put the router on the router sheet, with its maker and who manages it. How
• If you manage the router, change its admin password and write on the sheet where it is kept. How
• For a Windows 10 computer, choose ESU, Windows 11 or a replacement, and write the dates down. How (Go deeper; optional)
• Check the router settings one by one, and list the smart devices. How (Go deeper; optional)
• Erase any computer that left the house, and write it on the old devices sheet. How (Go deeper; optional)
• Set the Mac to ask for its password soon after the display turns off. How (Go deeper; optional)

Backups

• Turn on the phone or tablet backup, and write its last backup date on the backup sheet. How
• Check whether your photos are synced or inside the backup. How
• Compare the storage the backup needs with the free amount in the account it uses. How
• Turn on File History (Windows) or Time Machine (Mac) to an external drive, and unplug the drive after each backup. How
• Move the files you want to keep from Downloads to My Drive. How
• Open one file from each backup, and write the date on the backup sheet. How
• Set up a second copy for the rows that matter most, one of them on a drive kept unplugged. How (Go deeper; optional)
• Make an encrypted computer backup of an iPhone or iPad, and write where its password is kept. How (Go deeper; optional)

Recognizing scams

• Learn the four signs of a scam and the payment rule. How
• List your bank, card and phone company numbers on the numbers sheet, each copied from a card, a statement or a site you typed in. How
• Agree on a family code word, and note on the sheet who knows it (not the word). How
• Say the hang-up line out loud once. How
• Turn on junk filtering for calls and texts on your phone. How
• Practice the hang-up with someone you trust, in both roles. How (Go deeper; optional)
• Print the check card with your three numbers, and keep it by the phone. How (Go deeper; optional)

Checking what you read

• Stop before you share or act on one surprising claim this week. How
• Open a new tab, search for who is behind the claim, and come back to the first page. How
• Check the claim against two outside sources, and write what you found in your notes. How
• Run one reverse image search on your own device. How
• Save your bank's address as a bookmark, or find where it is printed on your card or statement. How
• Break one chatbot or AI Overview answer into claims, and check each one. How (Go deeper; optional)
• Compare the same photo in TinEye and Google Lens. How (Go deeper; optional)

Money and identity

• Freeze your credit at Equifax, Experian and TransUnion, and date each freeze on the money sheet. How
• Write on the money sheet where each bureau's sign-in is kept (the place, not the password). How
• Turn on alerts for the main bank account. How
• Turn on alerts for each card from another company. How
• Read one free credit report, and write what you found on the reports list. How
• If you use a money app, turn on two-step sign-in and payment alerts in it. How (Go deeper; optional)
• Get an IRS IP PIN, or set it aside. How (Go deeper; optional)
• Open a my Social Security account or choose a block, or set both aside. How (Go deeper; optional)
• If you are on Medicare, read your statements against your calendar. How (Go deeper; optional)
• Place a ChexSystems freeze, or set it aside. How (Go deeper; optional)
• Sign up for Informed Delivery with multifactor sign-in, or set it aside. How (Go deeper; optional)
• Name a trusted contact at a bank or brokerage, or set it aside. How (Go deeper; optional)

When something goes wrong

• Check that the numbers sheet has your bank, card and phone company numbers, copied from your own card, statement or bill. How
• Read the quick start once, and note where its link is. How
• Learn the first call if money leaves your account: the bank or card company, at the number on your card. How
• Find your main email provider's own recovery page, and remember that no one charges to recover an account. How
• Find the page that marks each phone and tablet as lost (icloud.com/find or android.com/find). How
• If something has gone wrong, write the bank call, the passwords changed and each report with its reference number in the incident log. How
• If someone connected to your computer, run a full scan with its built-in protection. How (Go deeper; optional)
• Read the unauthorized-transfer timelines and the crypto receipt advice. How (Go deeper; optional)
• Run the five-minute drill with the person who helps you. How (Go deeper; optional)

Your security file

• Give the four essential sheets (device list, account list, recovery sheet, numbers sheet) at least one row each, with no password, code or full number in any row. How
• Print the security file, date it and store it with your important papers. How
• Set a legacy or inactive-account contact on your main account, or write "none offered" on the recovery sheet. How
• Tell the person you named, and write their name on the recovery sheet. How
• Put the next check-up date on your calendar. How
• Walk through your main account's own security checkup once. How
• Save an export of the security file on your own device or on a drive kept with your papers. How
• Set an Apple Legacy Contact on your Apple Account. How (Go deeper; optional)
• Set up an Inactive Account Manager plan on your Google Account. How (Go deeper; optional)
• If you have a Microsoft account, write "none offered" for it. How (Go deeper; optional)
• Set a contact, or write "none offered," for every account on the recovery sheet. How (Go deeper; optional)
• Give a second copy to someone you trust, who knows the five things. How (Go deeper; optional)
• Set up Assistive Access or Easy mode, if the person wants a simpler phone. How (Go deeper; optional)

This list holds no passwords, codes or account numbers, and it should not. The records of what is set up and where things are kept go on the sheets of your security file.