Why a Personal Security Audit Matters

Most people assume a data breach or account hack happens to someone else. In reality, compromised credentials, phishing attempts, and weak privacy settings affect millions of everyday users every year. The good news: you don't need to be a tech expert to dramatically reduce your risk.

A personal online security audit is simply a structured walkthrough of your accounts, passwords, and settings — done on your own schedule, at your own pace. If you're new to thinking about digital privacy, the Online Privacy From the Ground Up guide is a helpful starting point before diving into this checklist.

This checklist is organized into logical groups so you can work through one category at a time, skip areas you've already handled, and return to the rest later. Aim to revisit it every few months — your digital life changes more often than you might realize.

Required

Password Manager

Generates and securely stores strong, unique passwords for every account so you only need to remember one master passphrase.

Required

Have I Been Pwned (haveibeenpwned.com)

Lets you check whether your email address has appeared in any known public data breaches.

Required

Authenticator App

Generates time-based one-time codes for two-factor authentication, providing stronger security than SMS text messages.

Required

Your Device's App Permission Settings

Built into your phone's settings, this shows which apps have access to your camera, microphone, location, and contacts.

The Full Audit Checklist

Work through each group below at your own pace. Items marked must are non-negotiable fundamentals. Should items are strongly recommended, and nice to have items offer meaningful improvements if you have the time.

Passwords

Identify any accounts using duplicate passwords and update each to a unique passphrase or randomly generated password. Must
Ensure all passwords are at least 12 characters long and include a mix of letters, numbers, and symbols. Must
Change the password for any account that has been flagged in a known data breach — use a service like Have I Been Pwned to check. Must
Set up a reputable password manager to generate and securely store strong, unique credentials for every account. Should

Two-Factor Authentication (2FA)

Enable two-factor authentication on your primary email account — this is your highest-priority account to protect. Must
Turn on 2FA for any account holding financial information, including banking, payment apps, and tax services. Must
Enable 2FA on social media, shopping, and any other accounts that support it. Should
Switch from SMS-based verification to an authenticator app wherever possible for stronger protection. Should

Account Access and Connected Apps

Review the list of third-party apps connected to your email and social accounts, and revoke access for any you no longer use or recognize. Must
Check active login sessions for your main accounts and sign out of any device or location you don't recognize. Must
Verify that your account recovery phone numbers and backup email addresses are current and still under your control. Must
Delete or deactivate old accounts you no longer use to reduce your exposure if those services are breached. Should

Privacy Settings

Review who can see your posts, profile details, and contact information on each social platform you use. Must
Turn off location sharing for any app that doesn't genuinely require it to function. Should
Audit app permissions on your phone — camera, microphone, and contacts access should only be granted to apps that clearly need them. Should
Opt out of data-sharing or personalized advertising settings where your platform accounts provide that option. Nice to have

Device and Software Security

Confirm that automatic software updates are enabled on your phone, computer, and any connected home devices. Must
Verify that your devices' screens lock automatically after a short period of inactivity and require a PIN, password, or biometric to unlock. Must
Check that any antivirus or security software is active and up to date on your computer. Should
Review browser extensions and remove any you installed a long time ago, no longer use, or can't identify. Nice to have

Email and Phishing Awareness

Unsubscribe from or delete email accounts you no longer use — dormant email accounts are common targets. Should
Check your email's filter and forwarding rules to ensure no unknown rule is quietly copying your messages elsewhere. Must

Your Email Account Is the Master Key

If someone gains access to your primary email account, they can use the 'forgot password' feature to reset credentials for nearly every other account you own. Prioritize your email above all else: use a strong, unique password and enable two-factor authentication before moving on to anything else in this checklist.

For a deeper dive into locking down your social accounts specifically, see our guide to social media privacy settings. And if you want to extend this audit to your home Wi-Fi and connected devices, the home network security audit checklist covers that ground thoroughly.

Making Your Audit Stick

Completing a one-time audit is a great start, but online security is an ongoing habit, not a single event. Threats, apps, and your own account footprint all shift over time. A few practices will help your improvements last.

Consider using a password manager to maintain strong, unique passwords across all your accounts without memorizing them. If you're unsure how they work, our explainer on what a password manager actually does breaks it down clearly. When setting up two-factor authentication, you may also want to compare your options — our guide to SMS codes vs. authenticator apps explains which method offers stronger protection.

For protecting the devices you use to access all these accounts, see keeping everyday devices secure without becoming a tech expert. If you have children at home, don't overlook their online exposure — keeping children safer online is worth a read alongside this audit.

Set a calendar reminder to revisit this checklist every three to six months. Small, consistent check-ins are far more effective than occasional deep dives.