1. Give every account its own password
Use a different password for each service. A password manager can help generate and store long passwords without relying on memory. Protect the password manager itself with its supported security and recovery options. Reusing a password can turn one breach into problems across several accounts.
2. Enable a stronger sign-in method
Check whether the service offers a passkey, security key or two-factor authentication. Set up a supported method and verify it with a sign-in. If you use authenticator codes, scan only the setup QR code shown by the genuine service. Keep that QR code and its secret key private.
3. Secure your recovery channels
Review the recovery email address and phone number on your account. Remove outdated details and protect the recovery email with its own strong sign-in settings. Store any recovery codes somewhere accessible if your everyday phone is unavailable.
4. Review devices and connected apps
Look through the service’s active sessions, devices and connected applications. Sign out sessions you do not recognize and remove integrations you no longer need. A connected application may retain access without asking for your authenticator code every time.
5. Keep the devices you trust in good shape
Install operating-system and browser updates, use a device screen lock and avoid opening unexpected sign-in links. Navigate to a service through its known app or address when checking a security alert. Repeat your account review after changing devices or receiving a genuine suspicious-activity notice.