How to Protect Your Online Accounts: The Full Guide

To protect your online accounts, do five things in this order: secure your email first, give every account its own long password, turn on two-step verification, use passkeys where they are offered, and learn what to do when something looks wrong. None of this needs technical skill. Most of it takes a few minutes, and you do it once.

This guide explains each step in plain words. It also tells you what to do if an account has already been taken over. Each section links to a longer article if you want more detail.

Why ordinary people are targets

Many people think, "I have nothing a criminal wants." That is not how it works. Criminals do not pick you one by one. They use software that tries the same stolen password on thousands of websites, or they send the same fake message to a million people and wait for a few to answer.

Your accounts are useful to them even when your bank balance is small. A hacked email account can be used to send scam messages to your friends. A hacked shopping account can be used to buy gift cards. A hacked social media account can be used to ask your family for money. We explain this in more detail in why a hacker would target you.

The good news is the same fact seen from the other side: because the attack is automatic, a small amount of care stops most of it. Software moves on to the next person when your account is harder to open.

Start with the accounts that unlock the others

Not all accounts matter equally. Protect these first.

Your main email account. Almost every website lets you reset a password by sending a link to your email. Whoever controls your email can reset the rest. If you have more than one email address, start with the one you use for banking, shopping and official letters.
Your phone account. Your phone number is often used to send codes. Someone who takes over your number can receive them.
Your banking and payment accounts. These are the ones with direct money.
Your cloud storage and photo accounts. They hold documents, ID scans and private pictures.
Your work accounts. Follow your employer's rules. They often apply stricter settings, and a problem there can affect your colleagues.

Write this list on paper. Then work through it from the top. If you do only the first item well, you have already closed the most common way into your other accounts.

Passwords you do not have to remember

A strong password is long and used in only one place. Length matters more than clever symbols. A short password with a number and an exclamation mark at the end is easy for software to guess. A long phrase is hard.

Reuse is the bigger danger. Say a small website you joined years ago loses its customer list. Criminals take the email addresses and passwords from that list and try them on bigger sites: email, shopping, banking. If your password is the same everywhere, one small loss opens all your accounts. This is called credential stuffing, and it is very common.

There are two good ways to avoid it.

For the few passwords you must remember, such as the one that unlocks your computer or your password manager, use a phrase of four or more unrelated words. Read how to create a strong password you can remember.
For everything else, let a password manager create and store the passwords. It fills them in for you. You only remember one strong password. Many people worry that this puts everything in one place. We answer that question in is a password manager safe to use.

If a password manager is not possible for you, a paper notebook kept at home is better than reusing the same password. A burglar is a smaller risk than software that attacks a million accounts at once.

Two-step verification done right

Two-step verification (also called 2FA or multi-factor authentication) asks for a second proof after your password. Even if a criminal learns your password, they cannot get in without the second step.

The second step can be:

a code from an authenticator app on your phone,
a code sent by text message,
a small physical security key,
a prompt on your phone that you approve.

Not all of these are equal. A security key or a passkey is the strongest. An authenticator app is strong and easy. A text message is weaker, because a criminal can sometimes trick a phone company into moving your number, but it is much better than nothing. Use the best option each site offers.

Turn it on in this order: email, banking, cloud storage, social media, shopping.

The one rule about codes

Never read a code to another person, and never type it into a page that you reached through a link in a message. A code is the second key to your door. A real company will not phone you and ask for it. If you receive a code you did not ask for, someone has just tried to sign in with your password. Read what to do about 2FA codes you did not request. The short answer: do not use the code, and change your password for that account.

Save your backup codes

When you turn on two-step verification, most sites show a list of backup codes. Save them in your password manager or print them and keep them at home. If you lose your phone, these codes let you in. Without them, getting back into your account can take days.

Passkeys: sign in without a password

A passkey is a way to sign in using your phone or computer's screen lock: your fingerprint, your face or your device PIN. There is no password to type, and nothing for a criminal to steal and reuse. A passkey also works only on the real website, so a fake page cannot collect it.

Many sites offer passkeys. When a site offers you one, it is normally a good choice. Make sure you can still get in if you lose your phone: check that your passkeys are saved to your phone account or password manager so they move to a replacement device. The steps are in what a passkey is and how to set one up.

Keep your two-step verification on for sites that do not offer passkeys.

Sign-in alerts and connected apps

Turn on alerts. Most email, banking and social media accounts can tell you when someone signs in from a device or place they do not know. It is the closest thing you have to a burglar alarm.

When you get an alert, ask one question: was this me? If you just bought a phone or travelled, it probably was. If not, act at once:

Do not click the link in the alert message. Open the app or type the website address yourself.
Look at the list of recent sign-ins and devices.
Sign out of all other devices.
Change the password and check that two-step verification is still on.

The full steps are in what to do about an unknown sign-in alert.

Connected apps and old devices

Many accounts let other apps connect to them: a calendar app, a photo printing service, a game. Each connection is a door. Once a year, open the security page of your main accounts and remove apps you no longer use. Do the same for old phones and laptops in the list of signed-in devices.

When an account is taken over

Signs that an account has been taken over:

friends tell you they received a strange message from you,
you cannot sign in and your password no longer works,
you see purchases, posts or sent messages you did not make,
you get password reset messages you did not ask for.

Do not panic. Work through this order.

Recover the account. Use the official "forgot password" or "account recovery" page. Type the address yourself.
Change the password to a long one that you have never used anywhere else.
Check the recovery options. Criminals often add their own phone number or email address so they can return. Remove any you do not recognise.
Check email rules. In a hacked email account, look for forwarding rules or filters that you did not create. They send copies of your mail to the criminal.
Sign out everywhere, then turn two-step verification on.
Tell the people who might be affected. A short message to friends: "My account was hacked. Do not click anything I sent."
Check your other accounts that used the same password and change those too.

Email is the account that matters most, so we wrote a separate guide on how to recover a hacked email account. If the account is a work account, report it to your employer's security or IT team straight away. Do not wait to see if it fixes itself. Early reports are welcome and usually avoid bigger problems.

A worked example

Say Soraya uses the same password for a recipe website and her email. The recipe website loses its customer list. A week later Soraya's email is opened from another country. The criminal then asks her bank for a password reset and reads the reset link in her inbox.

What would have stopped this? Any one of three habits: a separate password for the recipe website, two-step verification on her email, or a sign-in alert she acted on within the hour. She did none of the three, so the criminal had time. Each habit alone breaks the chain. All three together make her a very hard target.

After a data breach letter

Sometimes a company writes to say your information was part of a data breach. It can feel frightening, but the letter is usually a reason to take a few short steps, not a reason to panic.

Confirm the letter is real. Do not use the link or phone number in the letter. Find the company's official website yourself and look for the notice there.
Change the password for that account, and for any other account where you used the same one.
Turn on two-step verification.
Watch for scam messages that mention the company. Criminals use breach news to make fake messages look real.
Follow any extra advice about financial accounts from your bank and from the official body in your country that deals with fraud and identity theft.

More detail is in what to do with a data breach notification letter.

Common mistakes

Using your birthday, pet name or street in a password. These are easy to find.
Using a small variation of the same password ("Summer1", "Summer2"). Software tries these.
Sending a code to someone who asks for it, even if they say they are from your bank.
Putting off two-step verification because it feels like extra work. It adds a few seconds per sign-in.
Leaving the recovery email or phone number out of date. If these are old, you cannot recover the account and a criminal may use them.
Signing in from a link in a message. Open the site yourself.
Hiding a compromise. If you think an account is hacked, tell the right people early. It is never a shame.

Quick reference

Job	What to do	How long
Email	Long unique password, two-step verification on	10 minutes
Other important accounts	Password manager, two-step verification	A few minutes each
Passkeys	Turn on where offered	2 minutes each
Alerts	Switch on sign-in alerts	2 minutes each
Backup codes	Save in a safe place	5 minutes
Recovery details	Check the phone and email are yours	5 minutes

Questions people ask

Which account should I protect first?

Your main email. Other accounts send their password reset links there, so whoever controls it can take over the rest. Give it a long, unique password and two-step verification before you do anything else.

Is a password manager really safer than remembering passwords?

For most people, yes. It lets you use a different long password for every site without remembering them. Protect it with one strong phrase and two-step verification. The real danger for most people is reuse, not a break-in to the manager itself.

Is a text message code good enough?

It is much better than no second step. It is weaker than an authenticator app, a security key or a passkey, so choose one of those when you can. If text is the only option, use it.

What should I do if I clicked a link and entered my password?

Go to the real website by typing its address, change the password at once, and turn on two-step verification. Do the same for any other account that used that password. If it was a work account, tell your employer's security or IT team.

How often should I change my passwords?

You do not need to change strong, unique passwords on a schedule. Change one when you have a reason: a breach, an alert, a hacked device, or a password you used in more than one place.

Learn this in five minutes

The track "Your Essential Defences" teaches the foundations in five short lessons: protect your most important accounts first, keep devices up to date, stop and check unusual requests, share information with care, and report problems early. Each lesson takes about five minutes and ends with a few questions so you can practise the habit.