--- title: "Cyber Hygiene Checklist: 10 Minutes to Stay Safer" url: https://playciso.com/blog/cyber-hygiene-checklist updated: 2026-11-07 section: Blog publisher: PlayCISO --- # Cyber Hygiene Checklist: 10 Minutes to Stay Safer > A ten-minute cyber hygiene checklist, plus step-by-step guides and practice scenarios for hacked accounts, scams and privacy settings. Source: https://playciso.com/blog/cyber-hygiene-checklist · Published: 2026-11-07 · Publisher: PlayCISO (https://playciso.com) --- Cyber hygiene is a short list of habits that make you a harder target. This page is the ten-minute version, followed by guides for the specific apps and scams people search for most, each with a scored practice scenario. ## The ten-minute checklist - Secure your email first. Email resets the password for almost everything. Give it a long unique password and turn on multi-factor authentication or a passkey. The [Google account security checkup guide](/blog/google-account-security-checkup-guide) shows what to review. - Use a different password for every account. A password manager makes that practical. Try the [password strength checker](/tools/password-strength). - Turn on multi-factor authentication or passkeys for email, banking, social media and shopping accounts. App-based codes or passkeys are generally harder to intercept than text messages. See [the passkey lab](/tools/passkey-lab). - Check recovery options. Make sure the recovery email and phone number on your important accounts are yours and current. - Review signed-in devices and connected apps. Sign out sessions you do not recognise and remove apps you no longer use. - Update your phone, computer and apps. Turn on automatic updates where you can. - Tighten privacy settings in the apps you use most, starting with the guides below. - Slow down on anything urgent. Scams push you to act fast, move to another app, pay in an unusual way or share a code. Verify through a number or app you already trust. - Know your first hour. Decide now what you would do if an account were taken over, so you are not working it out under stress. - Check your exposure. The [digital footprint check](/tools/digital-footprint-check) shows what is easy to find about you, and the [identity protection guide](/blog/how-to-protect-your-identity-online) covers credit freezes and next steps. ## If your account has been taken over The first hour matters. Each guide has the steps in order and a scored practice scenario. - [Instagram Hacked? What to Do in the First Hour](/blog/instagram-hacked-what-to-do): Instagram hacked and locked out? The first-hour steps from Instagram and the FTC: secure your email, recover the account, warn friends, lock it down. [Practise it in the lab](/tools/instagram-hacked-recovery-lab). - [Facebook Hacked? What to Do in the First Hour](/blog/facebook-account-hacked-what-to-do): Facebook account hacked? Start recovery at the official page, lock the intruder out, warn friends and avoid recovery scams. A plain first-hour checklist. [Practise it in the lab](/tools/facebook-hacked-recovery-lab). - [WhatsApp Hacked? What to Do in the First Hour](/blog/whatsapp-hacked-what-to-do): Locked out of WhatsApp or seeing strange messages sent as you? Get back in, remove unknown devices, warn contacts and lock it down, step by step. [Practise it in the lab](/tools/whatsapp-hacked-recovery-lab). - [Gmail Hacked? What to Do in the First Hour](/blog/gmail-hacked-what-to-do): Gmail taken over? Recover the account, remove hidden forwarding rules, sign out intruders and secure the accounts your email unlocks, step by step. [Practise it in the lab](/tools/gmail-hacked-recovery-lab). - [How to Know If Your Phone Is Hacked (and What to Do)](/blog/how-to-know-if-your-phone-is-hacked): Battery drain, pop-ups, odd texts: which signs of a hacked phone are real, which are normal, and what to do on iPhone and Android, step by step. [Practise it in the lab](/tools/phone-hacked-triage-lab). ## Spot the scam before it works Same tricks, different costumes: urgency, a request to move off the platform, and a ask to pay or share a code. - [WhatsApp Scams: How to Spot Them Before You Reply](/blog/whatsapp-scams-how-to-spot): Wrong-number chats, fake jobs, "Hi Mum" texts and investment groups: learn the WhatsApp scam red flags and what to do the moment one shows up. [Practise it in the lab](/tools/whatsapp-scam-spotter-lab). - [Amazon Scams: How to Spot Fake Orders, Calls and Refunds](/blog/amazon-scams-how-to-spot): Fake delivery texts, "unauthorised purchase" calls, refund and Prime scams: how to spot Amazon impersonators and what to do the moment one shows up. [Practise it in the lab](/tools/amazon-scam-spotter-lab). - [AI Scams: How to Spot Them and What to Do First](/blog/ai-scams-how-to-spot): Cloned-voice calls, deepfake video, AI-written phishing and fake trading bots: the red flags from FBI and FTC advice, and what to do the moment one hits. [Practise it in the lab](/tools/ai-scam-spotter-lab). - [Online Dating Scams: Red Flags and What to Do If Hit](/blog/online-dating-scams-how-to-spot): Love-bombing, no video call, a sudden emergency or a crypto tip: the red flags of online dating scams and what to do if you have already sent money. [Practise it in the lab](/tools/dating-scam-spotter-lab). ## Lock down the settings Ten minutes per app. Menus change, so each guide links the official help page. - [WhatsApp Privacy Settings: A Checklist With Trade-offs](/blog/whatsapp-privacy-settings-checklist): Last seen, profile photo, groups, read receipts, chat lock, calls and backups: what each WhatsApp privacy setting does, and what it costs you. [Practise it in the lab](/tools/whatsapp-privacy-settings-lab). - [Facebook Privacy Settings: A Checklist With Trade-offs](/blog/facebook-privacy-settings-checklist): Posts, friends list, who can find you, tags, apps, ads, location and logins: what each Facebook privacy setting does and what it costs you. [Practise it in the lab](/tools/facebook-privacy-settings-lab). - [Instagram Privacy Settings: A Checklist With Trade-offs](/blog/instagram-privacy-settings-checklist): Private or public, who can message and tag you, stories, comments, blocking, linked apps and two-factor: what each Instagram setting does and costs. [Practise it in the lab](/tools/instagram-privacy-settings-lab). - [TikTok Privacy Settings: A Checklist With Trade-offs](/blog/tiktok-privacy-settings-checklist): Private or public, comments, Duet and Stitch, messages, suggestions, ad data, apps and two-step verification: what each TikTok setting does and costs. [Practise it in the lab](/tools/tiktok-privacy-settings-lab). - [iPhone Privacy Settings: A Checklist With Trade-offs](/blog/iphone-privacy-settings-checklist): Safety Check, app permissions, tracking, Stolen Device Protection, Lockdown Mode and iCloud encryption: what each iPhone setting does and what it costs. [Practise it in the lab](/tools/iphone-privacy-lab). - [Android Security Settings: A Checklist With Trade-offs](/blog/android-security-settings-checklist): Screen lock, Find Hub, Play Protect, app permissions, Theft Protection and Private Space: what each Android security setting does and what it costs. [Practise it in the lab](/tools/android-security-lab). - [Google Account Security Checkup: A Step-by-Step Guide](/blog/google-account-security-checkup-guide): Run a Google Account Security Checkup: devices, 2-Step Verification, passkeys, recovery info, linked apps, saved passwords and Gmail forwarding. [Practise it in the lab](/tools/google-account-checkup-lab). - [Google Privacy Checkup: A Plain Guide With Trade-offs](/blog/google-privacy-checkup-guide): Run a Google Privacy Checkup: My Activity, auto-delete, location, ad settings, your profile, Gemini activity and Takeout, with what each change costs. [Practise it in the lab](/tools/google-privacy-checkup-lab). - [Is ChatGPT Safe? A Privacy Checklist That Works](/blog/is-chatgpt-safe-privacy-checklist): Is ChatGPT safe to use? What to type and what not to, which data and memory settings to check, shared links, fake apps and account security, with sources. [Practise it in the lab](/tools/chatgpt-privacy-lab). ## Home, money and identity The accounts and devices that cost the most when they go wrong. - [Smart Home Security: A 10-Step Checklist for Your Home](/blog/smart-home-security-checklist): Router, cameras, speakers, default passwords, updates and old devices. A plain settings walkthrough with the trade-offs, based on CISA and NCSC advice. [Practise it in the lab](/tools/smart-home-security-lab). - [Online Banking Security: A Checklist You Can Finish Today](/blog/online-banking-security-checklist): Strong login, alerts, fake fraud-team calls, fake apps, public Wi-Fi and the first steps after a bad transfer, with US, UK and Australian sources. [Practise it in the lab](/tools/online-banking-security-lab). - [Crypto Wallet Security: A Checklist With Trade-offs](/blog/crypto-wallet-security-checklist): Hot vs hardware wallets, seed phrases, address poisoning, fake support, token approvals and what to do if a phrase leaks, with primary sources. [Practise it in the lab](/tools/crypto-wallet-security-lab). - [How to Protect Your Identity Online: A Checklist](/blog/how-to-protect-your-identity-online): Unique passwords, email first, passkeys, credit freezes, SIM-swap locks, phishing habits and recovery steps if your identity is used. US, UK, AU sources. [Practise it in the lab](/tools/identity-protection-lab). ## For families Written for parents, carers and teachers. - [Internet Safety for Kids: A Parent's Checklist, by Age](/blog/internet-safety-for-kids-checklist): A calm checklist for parents and carers: talking early, setup, parental controls and their limits, strangers, scams and what to do if something goes wrong. [Practise it in the lab](/tools/kids-internet-safety-lab). ## Frequently asked questions ### What is cyber hygiene? Cyber hygiene is the small set of habits that keep your accounts and devices from being an easy target: updates, unique passwords, multi-factor authentication or passkeys, careful clicking, and knowing what to do first if something goes wrong. ### How often should I do a cyber hygiene check? A short check once a month is a sensible rhythm for most people, plus a quick look whenever you get a security alert, lose a device or hear about a breach affecting a service you use. The checklist below takes about ten minutes. ### What should I secure first? Your email account, because it can reset the password of almost everything else. Then your bank and money apps, then your phone, then your social accounts. ### Is a password manager really needed? Unique passwords are the point; a password manager is the practical way to have a different strong password for every account without remembering them. Passkeys, where a service offers them, remove the password for that account altogether. ### What if I think I have already been hacked? Use the account-takeover guides above: they give the first steps in order for Instagram, Facebook, WhatsApp, Gmail and phones, and each has a practice scenario. Start with the account that can reset the others, usually your email. ## Sources - [UK National Cyber Security Centre: top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) - [US Federal Trade Commission: how to avoid a scam](https://consumer.ftc.gov/articles/how-avoid-scam) - Each guide above lists the official help pages it relies on.