Summary
22 items · 30–60 minutes
Why a Security Audit Matters
Most people set up their online accounts once — and never look back. Passwords get reused, old phone numbers linger as recovery options, and forgotten apps retain access to your data for years. A personal account security audit is a structured way to close those gaps before someone else exploits them.
This checklist covers your email, social media, financial, and cloud storage accounts. It doesn't require technical expertise — just a focused block of time and a methodical approach. Working through it once a year, or after a major life change, is a habit that security professionals consistently recommend. For a broader look at foundational practices, see Digital Safety Habits That Hold Up Over Time.
Before you begin, gather any password-related tools you use and have access to your primary email and phone — you'll need them to verify recovery settings.
Password Manager
Generates strong unique passwords and stores them securely so you don't need to remember or reuse credentials.
Authenticator App
Provides time-based one-time codes for two-factor authentication, which are more secure than SMS codes.
Breach-Notification Service (e.g., Have I Been Pwned)
Checks whether your email addresses or passwords have appeared in known public data breaches.
Secure Note or Encrypted Document
Used to record backup 2FA codes and recovery information in a safe, offline or encrypted location.
The Complete Security Audit Checklist
Work through each group in order. Items marked must are non-negotiable for baseline protection; should items are strongly recommended; nice-to-have items add meaningful extra protection if time allows.
Passwords
Two-Factor Authentication (2FA)
Account Recovery Options
Connected Apps & Permissions
Active Sessions & Devices
Privacy & Visibility Settings
Your Email Account Is the Master Key
If someone gains access to your primary email address, they can use the 'forgot password' function to reset credentials for nearly every other account you own. Securing your email — with a strong unique password and two-factor authentication — is the single highest-priority action in this entire checklist. Do not skip it.
For a detailed walkthrough on enabling two-factor authentication across every service you use, see Two-Factor Authentication Across Every Account You Own. And if you're weighing how to store your passwords going forward, Password Managers vs. Browser-Saved Passwords breaks down the trade-offs clearly.
What to Do After the Audit
Once you've worked through the checklist, prioritize any must items you couldn't complete immediately — especially password changes and two-factor authentication setup. Note anything requiring follow-up, such as contacting a bank to update a registered phone number.
Consider pairing this audit with your annual financial review. Your online account security and your financial health are increasingly intertwined, and checking both together makes sense. See Annual Financial Checkup: What to Review Every Year for a complementary checklist.
For readers who want to go deeper on how personal data moves online and what that means in practice, Online Privacy for People Who Don't Work in Tech is a practical next step. Set a calendar reminder to revisit this checklist in 12 months — or sooner if you experience a suspected breach or account compromise.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.