Cyber Hygiene Checklist: 10 Minutes to Stay Safer

Cyber hygiene is a short list of habits that make you a harder target. This page is the ten-minute version, followed by guides for the specific apps and scams people search for most, each with a scored practice scenario.

The ten-minute checklist

1. Secure your email first. Email resets the password for almost everything. Give it a long unique password and turn on multi-factor authentication or a passkey. The Google account security checkup guide shows what to review.
2. Use a different password for every account. A password manager makes that practical. Try the password strength checker.
3. Turn on multi-factor authentication or passkeys for email, banking, social media and shopping accounts. App-based codes or passkeys are generally harder to intercept than text messages. See the passkey lab.
4. Check recovery options. Make sure the recovery email and phone number on your important accounts are yours and current.
5. Review signed-in devices and connected apps. Sign out sessions you do not recognise and remove apps you no longer use.
6. Update your phone, computer and apps. Turn on automatic updates where you can.
7. Tighten privacy settings in the apps you use most, starting with the guides below.
8. Slow down on anything urgent. Scams push you to act fast, move to another app, pay in an unusual way or share a code. Verify through a number or app you already trust.
9. Know your first hour. Decide now what you would do if an account were taken over, so you are not working it out under stress.
10. Check your exposure. The digital footprint check shows what is easy to find about you, and the identity protection guide covers credit freezes and next steps.

If your account has been taken over

The first hour matters. Each guide has the steps in order and a scored practice scenario.

• Instagram Hacked? What to Do in the First Hour: Instagram hacked and locked out? The first-hour steps from Instagram and the FTC: secure your email, recover the account, warn friends, lock it down. Practise it in the lab.
• Facebook Hacked? What to Do in the First Hour: Facebook account hacked? Start recovery at the official page, lock the intruder out, warn friends and avoid recovery scams. A plain first-hour checklist. Practise it in the lab.
• WhatsApp Hacked? What to Do in the First Hour: Locked out of WhatsApp or seeing strange messages sent as you? Get back in, remove unknown devices, warn contacts and lock it down, step by step. Practise it in the lab.
• Gmail Hacked? What to Do in the First Hour: Gmail taken over? Recover the account, remove hidden forwarding rules, sign out intruders and secure the accounts your email unlocks, step by step. Practise it in the lab.
• How to Know If Your Phone Is Hacked (and What to Do): Battery drain, pop-ups, odd texts: which signs of a hacked phone are real, which are normal, and what to do on iPhone and Android, step by step. Practise it in the lab.

Spot the scam before it works

Same tricks, different costumes: urgency, a request to move off the platform, and a ask to pay or share a code.

• WhatsApp Scams: How to Spot Them Before You Reply: Wrong-number chats, fake jobs, "Hi Mum" texts and investment groups: learn the WhatsApp scam red flags and what to do the moment one shows up. Practise it in the lab.
• Amazon Scams: How to Spot Fake Orders, Calls and Refunds: Fake delivery texts, "unauthorised purchase" calls, refund and Prime scams: how to spot Amazon impersonators and what to do the moment one shows up. Practise it in the lab.
• AI Scams: How to Spot Them and What to Do First: Cloned-voice calls, deepfake video, AI-written phishing and fake trading bots: the red flags from FBI and FTC advice, and what to do the moment one hits. Practise it in the lab.
• Online Dating Scams: Red Flags and What to Do If Hit: Love-bombing, no video call, a sudden emergency or a crypto tip: the red flags of online dating scams and what to do if you have already sent money. Practise it in the lab.

Lock down the settings

Ten minutes per app. Menus change, so each guide links the official help page.

• WhatsApp Privacy Settings: A Checklist With Trade-offs: Last seen, profile photo, groups, read receipts, chat lock, calls and backups: what each WhatsApp privacy setting does, and what it costs you. Practise it in the lab.
• Facebook Privacy Settings: A Checklist With Trade-offs: Posts, friends list, who can find you, tags, apps, ads, location and logins: what each Facebook privacy setting does and what it costs you. Practise it in the lab.
• Instagram Privacy Settings: A Checklist With Trade-offs: Private or public, who can message and tag you, stories, comments, blocking, linked apps and two-factor: what each Instagram setting does and costs. Practise it in the lab.
• TikTok Privacy Settings: A Checklist With Trade-offs: Private or public, comments, Duet and Stitch, messages, suggestions, ad data, apps and two-step verification: what each TikTok setting does and costs. Practise it in the lab.
• iPhone Privacy Settings: A Checklist With Trade-offs: Safety Check, app permissions, tracking, Stolen Device Protection, Lockdown Mode and iCloud encryption: what each iPhone setting does and what it costs. Practise it in the lab.
• Android Security Settings: A Checklist With Trade-offs: Screen lock, Find Hub, Play Protect, app permissions, Theft Protection and Private Space: what each Android security setting does and what it costs. Practise it in the lab.
• Google Account Security Checkup: A Step-by-Step Guide: Run a Google Account Security Checkup: devices, 2-Step Verification, passkeys, recovery info, linked apps, saved passwords and Gmail forwarding. Practise it in the lab.
• Google Privacy Checkup: A Plain Guide With Trade-offs: Run a Google Privacy Checkup: My Activity, auto-delete, location, ad settings, your profile, Gemini activity and Takeout, with what each change costs. Practise it in the lab.
• Is ChatGPT Safe? A Privacy Checklist That Works: Is ChatGPT safe to use? What to type and what not to, which data and memory settings to check, shared links, fake apps and account security, with sources. Practise it in the lab.

Home, money and identity

The accounts and devices that cost the most when they go wrong.

• Smart Home Security: A 10-Step Checklist for Your Home: Router, cameras, speakers, default passwords, updates and old devices. A plain settings walkthrough with the trade-offs, based on CISA and NCSC advice. Practise it in the lab.
• Online Banking Security: A Checklist You Can Finish Today: Strong login, alerts, fake fraud-team calls, fake apps, public Wi-Fi and the first steps after a bad transfer, with US, UK and Australian sources. Practise it in the lab.
• Crypto Wallet Security: A Checklist With Trade-offs: Hot vs hardware wallets, seed phrases, address poisoning, fake support, token approvals and what to do if a phrase leaks, with primary sources. Practise it in the lab.
• How to Protect Your Identity Online: A Checklist: Unique passwords, email first, passkeys, credit freezes, SIM-swap locks, phishing habits and recovery steps if your identity is used. US, UK, AU sources. Practise it in the lab.

For families

Written for parents, carers and teachers.

• Internet Safety for Kids: A Parent's Checklist, by Age: A calm checklist for parents and carers: talking early, setup, parental controls and their limits, strangers, scams and what to do if something goes wrong. Practise it in the lab.

Frequently asked questions

What is cyber hygiene?

Cyber hygiene is the small set of habits that keep your accounts and devices from being an easy target: updates, unique passwords, multi-factor authentication or passkeys, careful clicking, and knowing what to do first if something goes wrong.

How often should I do a cyber hygiene check?

A short check once a month is a sensible rhythm for most people, plus a quick look whenever you get a security alert, lose a device or hear about a breach affecting a service you use. The checklist below takes about ten minutes.

What should I secure first?

Your email account, because it can reset the password of almost everything else. Then your bank and money apps, then your phone, then your social accounts.

Is a password manager really needed?

Unique passwords are the point; a password manager is the practical way to have a different strong password for every account without remembering them. Passkeys, where a service offers them, remove the password for that account altogether.

What if I think I have already been hacked?

Use the account-takeover guides above: they give the first steps in order for Instagram, Facebook, WhatsApp, Gmail and phones, and each has a practice scenario. Start with the account that can reset the others, usually your email.

Sources

• UK National Cyber Security Centre: top tips for staying secure online
• US Federal Trade Commission: how to avoid a scam
• Each guide above lists the official help pages it relies on.