Clear up the risks

Start with the account whose loss would cause the greatest disruption. Your primary email is often a priority because it receives reset links for other services. Check its recovery dependencies too.

Prioritize unique, strong passwords and change them when they may be exposed, reused or compromised. A personal rotation schedule is not a substitute for uniqueness. Follow applicable organizational requirements.

Properly implemented passkeys resist common credential phishing because they are bound to the legitimate service. They do not protect every part of an account: device security, synced-account access and recovery still matter.

It is generally better than a password alone when stronger options are unavailable. Text codes have weaknesses, including phone-number takeover. Prefer a supported phishing-resistant method when practical.

No. It mainly limits what the private session retains locally after its windows close. Websites, employers and network operators may still observe activity, and downloaded files can remain.

No. HTTPS encrypts the connection to the destination. A fraudulent website can also use HTTPS. Verify the service independently before signing in or paying.

Close the page and avoid downloads or permissions. A click alone does not prove compromise. If you entered credentials or approved a prompt, use the real service from a trusted device to secure the account and review sessions.

Removing link access can prevent future access through that link, but it normally cannot erase copies already downloaded or captured. Share only necessary information with the intended recipients.

Use access-controlled storage that is not entirely dependent on the device or account the codes recover. Consider physical and digital risks. Never send codes to support callers or put them in this site’s contact tool.

No. The checklist records your own review, not a scan or certification. Settings, devices and threats change. Revisit the relevant steps when your circumstances change.