Key Takeaways
Summary
22 items · 30–60 minutes
Why a Security Audit Is Worth Your Time
Most people set up online accounts once and rarely revisit the underlying security settings. Passwords get reused, recovery options go stale, and third-party apps accumulate access they no longer need. A structured security audit addresses exactly these gaps — not by adding complexity, but by helping you see what's already there and fix what's quietly out of date.
This checklist covers the four areas that matter most: passwords and authentication, account recovery options, connected applications, and privacy controls. Working through it periodically — once or twice a year, or after a major life change like a new job or device — is one of the most practical things you can do for your digital safety.
For context on related habits worth building alongside this audit, see habits that quietly undermine your online privacy.
Prioritize Your Email Account First
Your primary email is the recovery key to almost every other account you own. If someone gains access to it, they can reset passwords across your entire digital life. Treat it as your most critical account and apply the strongest available security settings there before moving on to anything else.
What You'll Need Before You Start
Gather a few resources before working through the checklist. Having them ready reduces friction and means you're less likely to skip steps.
Password Manager
Stores, generates, and autofills unique passwords so you don't have to remember or reuse them.
Authenticator App
Generates time-based one-time codes (TOTP) for two-factor authentication, which are more secure than SMS codes.
Breach-Checking Tool
Checks whether your email addresses or passwords have appeared in known data breaches.
Secure Offline Storage
A safe physical location (e.g. a locked drawer or safe) where you keep backup codes and a master passphrase note.
Prioritize the accounts that carry the most risk if compromised: your primary email, financial accounts, social profiles, and any account tied to your phone number or used for single sign-on (logging into other services via Google, Apple, or a similar provider).
The Security Audit Checklist
Work through each group below. Items marked must are non-negotiable for baseline protection. Should items are strongly recommended. Nice-to-have items offer additional hardening for those who want to go further.
Passwords
Two-Factor Authentication (2FA)
Account Recovery Options
Connected Apps and Third-Party Access
Privacy and Visibility Settings
Revoking App Access Can Break Integrations
When you revoke a connected app's access, any functionality that app provided — automatic calendar syncing, email integrations, sign-in via that platform — will stop working immediately. Before revoking access in bulk, note which apps you actively rely on so you can re-authorize only those you need.
If you're also setting up a new device, the steps you take at that stage shape long-term security. Our guide on setting up a new device without creating a security headache later complements this audit well.
After the Audit: Staying Current
Completing this checklist once is a meaningful step — but security isn't a one-time event. Accounts accumulate new connected apps, platform settings change, and old recovery details go out of date. A brief review every six to twelve months, or any time you get a security alert, keeps things current without demanding significant ongoing effort.
Two-factor authentication deserves special attention as you maintain your accounts. SMS-based codes are convenient but carry real vulnerabilities. Our article on why a text message isn't always enough for two-factor authentication explains the differences between available methods and why they matter.
If your accounts connect to smart home devices or a shared home network, extending your security thinking to that environment is worthwhile. See home automation security habits worth keeping for practical guidance. And for a broader look at what platform privacy policies actually say about how your data is used, reading a privacy policy without losing your mind is a useful companion.