Start here
What to do right now: a free online security checklist
Ten steps, in order. Every one is free, most take five or ten minutes, and together they stop the attacks that actually happen to most people: reused passwords, new accounts opened in your name, and someone talking you into sending money. Tick them off as you go (the ticks are not saved, and nothing on this page is sent anywhere).
Today: about an hour
Change the password to a long one you use nowhere else and turn on two-factor sign-in. Your email can reset almost every other account you have, so it comes first. Check the recovery phone number and backup email are still yours.
How to set up two-factor sign-inFree by federal law. Create an account at Equifax, Experian and TransUnion and freeze each one. A freeze stops anyone opening new credit in your name, and you can lift it in minutes when you apply for a loan or card.
Step-by-step credit freeze guideUse an authenticator app or a passkey where offered. With your mobile carrier, also set an account PIN or port-out protection so nobody can move your number to their SIM.
Which kind of two-factor is bestSearch your address at haveibeenpwned.com. For each breach it lists, change that password and any account where you reused it.
What to do with the resultsOn your phone, laptop and browser. Updates close the holes that real attacks use, and they do more than any app you can buy.
Where the update settings are
This week
Begin with your ten most important accounts and let it generate a new password for each. The free managers built into iPhone, Android and your browser are a fine start; a dedicated one works across every device.
Password managers comparedLog in to the router (the address is usually on a sticker), replace the default admin password, turn on WPA3 or WPA2 encryption and install any firmware update.
Home Wi-Fi settings, one by oneEvery American can get free weekly reports from all three bureaus at AnnualCreditReport.com, the only official site. Look for accounts or addresses you do not recognize.
What to do if something is wrongAnyone with an SSN or ITIN can request one at IRS.gov. It stops someone filing a tax return in your name, which a credit freeze does not.
Any call, text or email asking for money urgently gets checked by calling the person back on a number you already have. That one habit defeats most impersonation scams, including voice clones.
How to spot phishing
If something has already gone wrong
- Your details were in a breach: follow our data breach guide, sorted by what leaked.
- Someone opened an account in your name: report it at IdentityTheft.gov for a personal recovery plan, then see what to do if your identity is stolen.
- You sent money to a scammer: call your bank or card issuer now, then report at ReportFraud.ftc.gov and IC3.gov. Speed matters for getting money back.
- Your phone is acting strangely: see how to tell if your phone is hacked.
Optional paid upgrades
None of these replace the free steps above. They are worth considering once those are done. Links marked below are affiliate links: we may earn a commission if you sign up, at no extra cost to you (how we make money).
- A cross-device password manager such as Proton Pass (affiliate link), 1Password or Bitwarden. Compared here.
- Data broker removal, if you want your address and phone number off people-search sites without doing the opt-outs yourself. Optery (affiliate link) has a free scan that shows where you are listed. Services compared.
- A VPN, mainly if you use public Wi-Fi often or travel. NordVPN (affiliate link) is a popular paid option, and Proton VPN has a free tier. Do you need one?
- Antivirus beyond the built-in protection, if you want web and ransomware protection across several devices. Bitdefender (affiliate link) is one option. Is free antivirus enough?
By the editors of ProtectYour.com · Updated October 18, 2026