Your Annual Digital Security Checkup
Photo credit: ResultsPoint.net | Find The Required Information
In this article
Run through this checklist once a year to catch weak passwords, unused accounts, outdated software, and other gaps before someone else finds them.
Key Takeaways
- Weak or reused passwords are one of the most common ways accounts get compromised — a password manager makes fixing this practical.
- Old accounts you no longer use are security liabilities; closing them removes attack surface you don't need.
- Software updates patch known security holes that attackers actively exploit — keeping devices current matters.
- Two-factor authentication adds a meaningful layer of protection even when a password is stolen.
- Reviewing app permissions and connected third-party services each year limits how much data is quietly shared.
Why a Once-a-Year Review Is Worth Your Time
Most digital security problems don't happen because someone was careless. They happen because the internet changes faster than our habits do. An account opened years ago, a router that's never been updated, an app you haven't touched in months — each one is a small gap that adds up over time. Think of this checkup the same way you'd think about changing smoke alarm batteries or rotating tires: low effort, high return, easy to schedule.
This checklist covers the areas where everyday users are most exposed: passwords, old accounts, software updates, privacy settings, and backups. Work through it once a year — or after any major life event like a move, a job change, or a breach notification — and you'll close the most common attack paths before someone else finds them. For more on the everyday habits that create risk without anyone noticing, see what quietly undermines online security.
You don't need to be technical to complete this checklist. Most steps take just a few clicks once you know where to look.
Password Manager
Generates, stores, and audits unique passwords for every account so you never have to reuse them.
TOTP Authenticator App
Provides time-based one-time codes for two-factor authentication, a more secure alternative to SMS codes.
Breach-Checking Service
Checks whether your email addresses appear in publicly known data breaches.
Cloud Backup Service
Automatically backs up your files and photos so you can recover them after device loss or ransomware.
Router Admin Panel
Lets you update your router's firmware and review which devices are connected to your home network.
Data Broker Opt-Out Tool
Helps you request removal of your personal information from sites that collect and resell it.
How to Work Through the Checklist
Set aside a focused block of time — an hour is usually enough for a first pass, longer if you haven't done this before. Work through one group at a time rather than jumping around. The groups are ordered roughly by impact: password and authentication problems are the most exploited, so start there.
Unused Accounts Are Not Harmless
An account you forgot about ten years ago may still hold your real name, address, payment method, and password. If that site suffers a breach, those details can be used to access other accounts or enable identity theft. Closing dormant accounts is not housekeeping — it is a concrete risk reduction.
As you go, keep a simple notes document open. Jot down any account you decided to close, any password you changed, and any permission you revoked. That record helps you pick up if you're interrupted, and gives you a reference point for next year's checkup.
If you're also planning a trip or spending time on public networks, the steps around device updates and account security carry extra weight. Our guide on protecting your data when you travel covers the additional steps worth taking before you leave home. For a deeper look at why keeping software current matters — and when it's reasonable to wait — see understanding software updates.
Passwords & Authentication
Account Cleanup
Device & Software Updates
Privacy & Data Sharing
Backups & Recovery
After the Checkup: Staying Ahead
Completing this review once puts you ahead of the majority of internet users. Completing it every year keeps you there. Consider pairing this digital review with other annual routines — a financial check-in, for instance, covers overlapping ground around account access and fraud exposure. Our annual financial review checklist is a natural companion to this one.
Don't Skip the Breach Check
Many people discover their credentials were exposed months or years after a breach occurred. Stolen login details are often sold and reused in automated attacks long after the original incident. Checking your email against a reputable breach database and acting on any results is one of the highest-value steps in this checklist.
SMS Two-Factor Has Real Limitations
Text-message verification codes can be intercepted through SIM-swapping attacks, where a bad actor tricks your carrier into transferring your number to a device they control. For accounts holding sensitive financial or personal data, an authenticator app provides meaningfully stronger protection than SMS codes alone.
If anything in this checklist surfaced an active problem — a breach hit, suspicious account activity, or a device you can't secure — treat it as urgent rather than part of a routine. Contact the relevant service's support team, and if financial information is involved, alert your bank or card issuer. For concerns that touch identity theft or fraud, the Federal Trade Commission's IdentityTheft.gov resource is a good starting point for understanding your options.
Staying safe online isn't about being paranoid. It's about making the obvious fixes that close the gaps most attackers are looking for.
Author
Tech Editorial Team
Tech Editorial Team is the collective byline for our editorial team and contributor network. Articles published under this byline or an editorial pen name are researched, written, and reviewed according to our editorial standards for clarity, consistency, and independence before publication.
View all articles →