1. Is every critical account (email, bank, password manager) on MFA?

Yes No / Not sure

MFA is the highest-impact ATO defence by 10x.

2. Are passwords unique across your top 10 accounts?

Yes No / Not sure

One leak breaks all reused accounts.

3. Have you checked Have I Been Pwned in the last 6 months?

Yes No / Not sure

Or use our Password Leak Checker / Username Leak Checker.

4. Are your passwords managed in a password manager?

Yes No / Not sure

Browser-autofill is not a password manager.

5. Are recovery emails and phone numbers current?

Yes No / Not sure

Old recovery options are a re-compromise path.

6. Do your passwords exceed 14 characters for critical accounts?

Yes No / Not sure

Short passwords are brute-forceable offline. Use our Password Generator.

7. Have you reviewed active login sessions in the last 3 months?

Yes No / Not sure

Google and Microsoft both show where you're logged in. Sign out of stale ones.

8. Are login alerts enabled (email on new device/location)?

Yes No / Not sure

Most platforms support this — turn it on everywhere.

9. Do you avoid using SMS for MFA where possible?

Yes No / Not sure

SIM-swap attacks beat SMS MFA. Use authenticator apps or hardware keys.

10. Have you checked for old / unused accounts and closed them?

Yes No / Not sure

Forgotten accounts with weak passwords = lateral movement paths.

11. Is your email provider's account secure (strong password + MFA)?

Yes No / Not sure

Email controls all password resets. Treat it like your crown jewel.

12. Do you use a hardware key (YubiKey) on at least one critical account?

Yes No / Not sure

$25 hardware key = phish-proof login.

Account Takeover Risk Score