Personal Security & Privacy Checklist 2026

This is my personal security and privacy checklist for 2026, ordered by impact. Work through it top to bottom. The first three sections close the most common routes into your accounts. The rest shrink what a scammer can learn about you and what you lose if something still goes wrong. Every item is one action, and anything non-obvious links to the primary source.

New to this? Start with the data exposure check to see how much of you is already public, then come back to section 1.

1. Lock down your accounts (do this first)

• Install a password manager (Apple Passwords, Google Password Manager, Bitwarden, or 1Password) and give every account a unique password. CISA
• Stop changing passwords on a schedule. Change one only when it leaks. NIST now says services shall not require periodic password changes.
• Turn on passkeys wherever they are offered, starting with your email, your Apple or Google account, and your bank. FIDO Alliance
• Where there is no passkey, pick MFA in this order: security key, authenticator app, then SMS only as a last resort. CISA calls FIDO/WebAuthn the only widely available phishing-resistant MFA.
• On your primary email account, register two security keys or passkeys and keep one somewhere other than your home.
• Save every account's recovery codes in your password manager or on paper in a safe place.
• Check your important passwords against known breaches with the password breach check, and follow this plan for any that leaked.
• Run Google Security Checkup and review the devices signed in to your Apple Account. Remove anything you do not recognize.

2. Protect your phone number from SIM swaps

• Turn on your carrier's free number lock: Verizon Number Lock, AT&T Wireless Account Lock, or T-Mobile SIM Protection and Port Out Protection.
• Set a carrier account PIN that you use nowhere else.
• Set a SIM PIN so a stolen SIM cannot be used in another phone (iPhone, Android).
• Move every account that matters off SMS codes (see section 1). A locked number protects the codes; not depending on them protects you more.

3. Devices and updates

• Turn on automatic updates for your phone, computer, browser, and apps. CISA
• Use a passcode of at least six digits, plus Face ID, Touch ID, or fingerprint unlock.
• iPhone: turn on Stolen Device Protection. Android: turn on Theft Detection Lock and Offline Device Lock.
• Turn on full-disk encryption: FileVault on a Mac, BitLocker or Device Encryption on Windows.
• Update your home router and change its default admin password.
• Delete apps you no longer use and deny permissions an app does not need.

4. Freeze your credit and financial identity

• Freeze your credit at all three bureaus. It is free and does not affect your score. FTC
  • Equifax
  • Experian
  • TransUnion
  • NCTUE (utility and phone accounts)
• Get an IRS Identity Protection PIN so nobody else can file a tax return in your name.
• Pull your free reports at AnnualCreditReport.com and look for accounts you did not open.
• Turn on transaction alerts for every bank and card account.
• If your identity is stolen, start at IdentityTheft.gov.

5. Family and AI voice-clone scams

• Agree on a family safe word that is never posted or texted. The FBI recommends a secret word or phrase to verify identity.
• Do not trust a familiar voice. Hang up and call back on a number you already know. FTC
• Treat any urgent request for a wire, cryptocurrency, or gift cards as a scam until proven otherwise.
• Make social accounts private and limit public video and voice clips where you can.
• Walk older relatives through these four items. Browse the Scam Atlas together to see how real cases unfold.
• Report scams at ReportFraud.ftc.gov.

6. Shrink your data footprint

• Run the data exposure check to see which data brokers likely hold your details.
• California residents: submit one deletion request to every registered data broker through DROP. Everyone else: opt out broker by broker, or pay a removal service.
• Turn on Global Privacy Control in your browser so sites receive an opt-out of sale signal.
• Use email aliases for shopping and newsletters so a breach at one store does not expose your main address.
• Delete old accounts you no longer use.
• Review the third-party apps connected to your Google, Apple, Microsoft, and social accounts. Revoke what you do not use.

7. Privacy settings and encrypted DNS

• Encrypt your DNS lookups: iCloud Private Relay on Apple devices, DNS over HTTPS in Firefox, or Private DNS on Android and your router.
• On iPhone, choose Ask App Not to Track by default.
• Turn on Advanced Data Protection for end-to-end encrypted iCloud backups.
• Use an end-to-end encrypted messenger such as Signal for sensitive conversations, with disappearing messages on.
• Turn off ad personalization and location history you do not use in your Google and Apple settings.

8. Backups and recovery

• Turn on automatic cloud backups for your phone and computer.
• Keep a second copy of photos and documents on an external drive you disconnect after each backup.
• Restore one file from each backup to prove it works.
• Add an Apple recovery contact and Legacy Contact, or set up Google Inactive Account Manager.
• Give one trusted person emergency access to your password manager.

Monthly 10-minute checkup

1. Install pending updates on every device.
2. Check your password manager's breach and reuse report.
3. Review signed-in devices on your email and Apple or Google account.
4. Scan bank and card statements for charges you do not recognize.
5. Confirm your carrier lock and credit freezes are still on.

Travelling soon? Pair this with my travel security checklist.

Updated: October 2026