Beginner Security Checklist

This 10-item checklist gives you a baseline digital security audit without buying new hardware or becoming a system administrator. Work through these items in order. Each one closes a gap that most attackers can trivially exploit without you knowing.

1. Where Your Identity Actually Leaks

1. Use a password manager. Generate a unique password for every account. Bitwarden, 1Password, or KeePass will do. If you reuse passwords anywhere, a single breach exposes everything.
2. Enable two-factor authentication (2FA) everywhere. Prefer a hardware security key (YubiKey) over SMS. If you must use an app, use Authy or Aegis. Never rely on SMS-based 2FA alone.
3. Keep software updated. Enable auto-updates for your operating system, browser, and apps. Most exploited vulnerabilities are patched within days of discovery — if you don't update, you're playing catch-up with known exploits.
4. Install an ad and tracker blocker. uBlock Origin stops malicious ads and invisible trackers. Consider NextDNS or Pi-hole for network-wide blocking. Ads are the #1 malware delivery vector for average users.
5. Encrypt your DNS. Configure DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to prevent your ISP from seeing every domain you visit. Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) both support encrypted DNS.
6. Enable full-disk encryption. This is automatic on iOS and Android. On Windows, turn on BitLocker. On macOS, enable FileVault. On Linux, use LUKS at install time. Without encryption, a stolen device is a compromised device.
7. Secure your Wi-Fi router. Change the default admin password. Use WPA3 (or WPA2 if WPA3 isn't available). Disable WPS. Hide your SSID if you can. Update the firmware — many routers ship with known vulnerabilities.
8. Back up your data (3-2-1 rule). Keep 3 copies of your data, on 2 different media, with 1 copy offsite. Encrypt your backups. Test restoration at least once. Ransomware and hardware failure don't warn ahead of time.
9. Audit your account recovery options. Remove old email addresses and phone numbers from recovery. Don't use SMS as a backup for 2FA — use recovery codes stored offline. Check for accounts you forgot you had at haveibeenpwned.com.
10. Review app permissions. On mobile, disable location access for apps that don't need it. On desktop, uninstall browser extensions you no longer use. Each installed app is a potential attack surface — fewer is safer.

---

2. The Mitigation Plan

After completing the 10 items, run these quick checks:

• DNS leak test: Visit dnsleaktest.com — your ISP's name should not appear in the results.
• Breach check: Search haveibeenpwned.com — no password should be shared across any breached accounts.
• Port scan: Run nmap -sT -p 1-1024 localhost on your machine — no unexpected services should be listening.