The short version: you do not need a whole weekend. Five small steps, about 30 minutes in total, make your accounts harder to take over. You can stop after any step.
How it works
Set a timer for each step. When it rings, move on, or stop for today. A partly finished clean-up is still useful. The first steps matter most.
This will not make you “safe” forever. It makes your accounts harder to take over, and that is a good result.
Minutes 0-5: Secure your main email
Your email account can reset the passwords for your other accounts, so it is the one to protect first. Use a strong, unique password. Add a second step (an extra check when you sign in). Check your recovery phone number and recovery email.
Full steps are in How to Secure Your Email Account. Your first time may take longer. That is fine.
Minutes 5-10: Use a password manager
A password manager is an app that makes and remembers a different password for each account. Your phone or browser may already have one built in. It is hard to make and remember a strong, different password for every account. A built-in tool or a password manager can do it for you.
Change the password on your email account first. Then change the password on the one other account that matters most to you, such as your bank. See the password manager guide if this is new.
Minutes 10-20: Turn on a second step
A second step is called two-factor authentication (2FA). It asks for something more than your password. Turn it on for:
- your email
- your bank and money apps
- your Apple, Google and Microsoft accounts
- your social media accounts
Choose a passkey or an authenticator app if the account offers one. An authenticator app or a security key (a small device you connect to your phone or computer) is more secure than a code sent by text message. Passkeys should be your first choice wherever a service offers them. Use a text message only when nothing else is offered.
Do not try to finish all accounts today. Start with email, then the money accounts.
Minutes 20-25: Save your recovery options
Recovery options help you get back in if you lose your phone or password. Check that your recovery phone number and recovery email are current and belong to you. If an account gives you recovery codes, save them somewhere safe, such as a printed copy with your important papers. Do not share them with anyone. See Recovery Codes and Backups.
Minutes 25-30: Remove what you do not use
Fewer old accounts mean fewer places to protect. Pick one or two of these today.
- Close accounts you no longer use. Closing an account can be permanent, so save any photos or documents you need first. Do not close your main email, Google, Microsoft or Apple account in this step. Closing those can also remove other services. Look in the account settings for “delete account” or “close account”. Some services make this hard to find, so search the company’s help page.
- Remove old apps. Delete apps you no longer use. This does not always close the account behind them.
- Remove old sign-ins. In your email account, check the list of devices and sign out old ones. See the email guide.
- Check your sharing. Look at files you share by link: Google Docs “Anyone With the Link”.
There is no need to feel bad about old accounts. Most people have some.
Check for a data breach. A data breach is when a company’s data is exposed and your details may be in it. A free service called Have I Been Pwned (haveibeenpwned.com) lets you type in an email address to see which known breaches include it. Never type a password into a breach-check site. A result of “not found” does not prove you were never in a breach. The service says it holds only a small part of all the breaches.
Keep the habit
Once every three months, take under 10 minutes for a quick check. Do three things:
- Install updates for your phone, computer and apps. Updates fix security problems. Turn on automatic updates if you can.
- Look at your devices and sign-ins.
- Close one account you no longer use. Save anything you need first.
Your checklist
Copy this list to a notes app or print it.
- ☐ Email: strong password or passkey, second step, recovery options
- ☐ Password manager started; email and bank passwords changed
- ☐ Second step on email, money, Apple/Google/Microsoft and social accounts
- ☐ Recovery options checked; recovery codes saved somewhere safe
- ☐ One unused account closed; old apps and sign-ins removed
- ☐ Email address checked in a breach-check service
- ☐ Updates on, with automatic updates turned on if offered
- ☐ Next check set for three months from now
If you lost money or lost control of an account: in the US, report at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.
Related words: two-factor authentication, authenticator app, recovery code, privacy settings, identity theft, single sign-on.
Do this today (about 9 minutes)
- Set a timer for 9 minutes.
- Do only the first step: secure your main email account. Check the password, the second step and the recovery options.
- Stop when the timer rings. The other steps can wait for another day.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. The time for each step is an estimate. Settings screens change. If yours looks different, search the company's help page.
