Home Digital Safety Baseline: 9 Things to Check Before Something Goes Wrong

Most of us do not think of our email account, phone number, bank login, password manager, and recovery codes as one connected system.

I did not either—until someone took over part of mine.

It is not a promise that your accounts will never be compromised, and it is not an enterprise security checklist. It is a practical starting point for the person who keeps the household phones, computers, accounts, Wi-Fi, and backups working.

1. START WITH YOUR PRIMARY EMAIL

For many people, email is the recovery hub for everything else.

Password-reset links, security alerts, new-device notifications, receipts, and account-recovery messages often land there. If someone gets your email, they may get a path into other accounts too.

Do this:

• Give your primary email a password you do not use anywhere else.
• Turn on MFA or a passkey if the provider supports it.
• Check the recovery email address and recovery phone number.
• Remove recovery methods or signed-in devices you no longer control.
• Save recovery codes somewhere safe and separate from the device you normally use to sign in.

You are in good shape when you can answer this question without guessing:

“If I lost my phone tonight, how would I get back into my email tomorrow?”

If the answer is “I’m not sure,” fix that before moving on.

2. TREAT YOUR MOBILE NUMBER LIKE A SECURITY ASSET

A phone number is not a password, but it can act like a key when accounts use text messages for sign-in or recovery.

That is what made my own incident spread so quickly.

The FTC warns that someone who takes over a phone number can receive texted verification codes and use them to get into other accounts. The FCC has also described SIM-swap and port-out fraud as a way attackers can take over phone service and then reach financial, email, and other accounts.

Do this:

• Put a strong, unique PIN or password on your mobile-carrier account.
• If your carrier offers a SIM-change lock, number lock, port-out lock, or similar protection, turn it on.
• Protect the email account tied to your carrier.
• Review who is authorized to make account changes.
• For sensitive accounts, prefer stronger authentication than SMS when a better option is available.

One more thing: if your phone suddenly loses service for no obvious reason, do not automatically assume it is a routine outage—especially if you also receive account-change alerts.

Use another trusted device or phone to contact your carrier through a number or website you know is real.

The exact controls vary by carrier, so this is one area where the setup steps should be checked against your carrier’s current instructions.

3. STOP REUSING PASSWORDS

Password reuse turns one breach into several possible breaches.

If the same password protects your shopping account, email, cloud storage, and something financial, an attacker only needs to learn it once.

A password manager makes this problem much easier to solve.

NIST’s current authentication guidance recognizes password managers as a practical way to maintain distinct passwords for different services, and notes that password managers with generators can help people choose stronger passwords.

Do this:

• Use a reputable password manager.
• Let it generate a different password for each account.
• Give the password manager itself a strong, unique master password or passphrase.
• Start with the accounts that would hurt the most to lose: email, mobile carrier, financial accounts, cloud storage, payment services, and the password manager itself.
• Replace reused passwords over time. You do not have to fix your entire digital life in one afternoon.

Do not waste energy inventing clever variations of the same favorite password. Different accounts should have genuinely different passwords.

You are in good shape when a password leaked from one service does not automatically work anywhere else.

4. USE MFA—BUT UNDERSTAND THAT THE METHOD MATTERS

MFA adds another barrier after the password.

That is worth doing.

But not every second factor protects you from the same threats.

Text-message codes are convenient, and if SMS is the only MFA an account offers, the FTC says it is still better than leaving the account password-only. My own experience is also a reminder of the weakness: if someone takes over your phone number, texted codes can go to them instead of you.

Authenticator apps avoid that particular SIM-swap problem because the code is generated in the app rather than delivered to your phone number.

Passkeys and compatible security keys can go further. Modern cryptographic authentication can be phishing-resistant because the sign-in is bound to the legitimate service instead of relying on a code you manually type into whatever page is in front of you.

A practical order of preference is:

1. Passkey or phishing-resistant security key, when the service supports it and you can use it reliably.
2. Authenticator app or another app-based method.
3. SMS or another available MFA method rather than password-only access when stronger options are unavailable.

After you turn MFA on:

• Save recovery codes somewhere safe.
• Add a second recovery method if the service supports one.
• Remove old phones or authenticators you no longer control.
• Never give an unexpected caller or texter your verification code.

The goal is not to collect as many security settings as possible. The goal is to make a stolen password less useful.

5. LET YOUR DEVICES UPDATE THEMSELVES

Updates are boring right up until the update you skipped fixes the vulnerability someone is trying to use.

For most household devices, the best default is simple: turn on automatic updates.

Check:

• Phones and tablets.
• Windows, macOS, or other computer operating systems.
• Web browsers.
• Frequently used apps.
• Security software, if you use it.
• Router or mesh firmware when automatic updates are available.
• Smart-home devices that expose update settings.

You do not need to install every optional feature release the second it appears. But routine security updates should not sit ignored for months.

You are in good shape when your normal devices can receive security fixes without depending on you remembering to check every week.

6. LOCK AND ENCRYPT THE DEVICES THAT HOLD YOUR LIFE

Think about what is already signed in on your phone.

Email. Photos. Messages. Banking apps. Cloud storage. Password-manager access. Maybe work or school accounts.

A lost phone or laptop should not become an unlocked copy of your digital life.

Do this:

• Use a device PIN, password, or biometric lock.
• Keep automatic screen locking enabled.
• Check that device or disk encryption is enabled.
• If your system uses an encryption recovery key, make sure you know where that key is stored.
• Back up important data before making major encryption changes.

Many current devices include encryption as part of normal setup, but do not rely on “probably.” Check the actual setting for your device.

You are in good shape when someone who finds or steals the device still has a meaningful barrier between them and your data.

7. GIVE YOUR HOME WI-FI A BASIC SECURITY CHECK

You do not need an enterprise firewall to have a reasonably protected home network.

Start with the basics.

Check that:

• Your router’s administrator password is not the factory default.
• Your Wi-Fi password is strong and not reused as an account password.
• Wi-Fi security is set to WPA3 Personal or WPA2 Personal.
• Router or mesh firmware is current.
• Remote management is turned off if you do not use it.
• You log out of the router’s administrator interface when you are finished.

The FTC also recommends disabling features such as WPS and UPnP when you do not need them and using a guest network where appropriate. Those are useful next steps, but they do not have to turn this baseline into a networking course.

We will go deeper in a dedicated home Wi-Fi security guide.

For now, the goal is simpler: do not leave the gateway to your household devices running on factory defaults and outdated protection.

8. BACK UP THE THINGS YOU WOULD ACTUALLY MISS

Cybersecurity is not only about keeping people out.

It is also about getting your life back when hardware fails, a phone disappears, malware damages files, or someone deletes the wrong folder.

Start with the things you would hate to lose:

• Family photos and videos.
• Important household records.
• Personal projects.
• School files.
• Work files you are actually allowed to back up.
• Anything else that would be painful or impossible to recreate.

Then make sure another copy exists.

That might be an external drive, an appropriate cloud-backup service, or a combination of methods.

One caution: “It syncs to the cloud” is not automatically the same thing as “I can recover it.” Check whether your service keeps deleted files, older versions, or another recovery path.

And test it.

Restore one harmless file.

A backup you have never restored is still partly an assumption.

You are in good shape when you know where the backup is and you have personally recovered something from it.

9. FOR UNEXPECTED MESSAGES, LEAVE THE MESSAGE FIRST

This is the household rule I want to make easy to remember:

An unexpected message does not get to choose the link, phone number, or sign-in page you use to verify a problem.

If you get a text or email saying there is a suspicious charge, missed delivery, account lock, unpaid bill, password problem, or other urgent issue:

Do not solve the problem from inside the message.

Instead:

• Open the company’s app yourself.
• Type the website you already know or use a trusted bookmark.
• Call a number you already know is real.
• Contact the person through a separate conversation if the message supposedly came from someone you know.

The FTC gives essentially the same advice: when an unexpected message might be legitimate, contact the company using a phone number or website you know is real—not the information in the message.

This rule is simple on purpose.

You do not need to become an expert at spotting every convincing phishing message if you stop letting the message control the route you use to verify it.

ONE SMALL THING THAT MAKES ALL OF THIS EASIER:

THE HOUSEHOLD RECOVERY MAP

This is a TechSproutHQ practice recommendation rather than a government checklist.

Make a short recovery map that tells you where recovery starts when something goes wrong.

Do not put passwords, MFA codes, recovery keys, bank account numbers, or other secrets in it.

The map can record things like:

• Which email account is the primary recovery account.
• Which password manager the household uses.
• Where recovery codes are stored—location only, not the codes.
• Which service backs up family photos and important files.
• Where an external backup is kept.
• Who manages the home router.
• Which mobile carrier portal is used.
• Where device-encryption recovery information is stored.
• When you last reviewed the baseline.

Why bother?

Because security settings are only useful if you remember they exist when you are stressed and trying to recover an account.

The map is not a secret vault.

It is a set of directions.

THE POINT IS NOT PERFECT SECURITY

No checklist can make a household impossible to attack.

That is not the goal.

The goal is to make one bad password, one stolen phone number, one lost device, or one convincing message less able to turn into a chain reaction.

That is the lesson I took away from my own account takeover.

Start with the accounts that unlock other accounts. Protect the recovery paths. Use stronger authentication where you can. Keep your devices current. Have a backup you know how to restore.

Then improve from there.

You do not have to turn your home into an IT department.

You just need a safer starting point.

COMPANION TOOL

Use the separate Home Digital Safety Baseline Checklist as a working copy you can actually mark up.

A checked box should mean you verified the item yourself. It does not mean TechSproutHQ tested your account or device.

Open the companion Home Digital Safety Baseline Checklist.