Install operating system, browser, password manager, router, and app updates. Prioritize anything described as actively exploited, critical, or security related.

Check for reused, weak, old, or breached passwords. Rotate the most sensitive accounts first and replace password-only logins with passkeys or stronger MFA where available.

Remove extensions you no longer use. Extensions can read sensitive pages, change over time, or be sold to new owners, so keep the list short and review permissions.

Review shared files, public links, collaborator lists, and old folders in cloud storage. Remove access that is no longer needed and avoid public links for personal documents.

A backup is only real if it can be restored. Test a small restore, confirm recent files exist, keep at least one offline or protected copy, and ensure ransomware cannot easily delete every backup.

Check third-party apps connected to Google, Microsoft, Apple, GitHub, social media, banking, and cloud accounts. Revoke anything you do not recognize or no longer use.

Review bank alerts, credit alerts, transaction notifications, and account notices. Investigate small unfamiliar transactions because criminals often test cards before larger fraud.

Revisit the five unfinished items with the highest impact. Security work is easier when the next step is obvious and small enough to finish today.