Cyber Hygiene

Checklists
GitHub

Cyber Hygiene

Home
GitHub
Checklists
Contributing
License

Settings

Theme

Backup

Import

Data

Getting Started

Decide What You're Actually Protecting

Decide Who You're Protecting It From

Start With What Blocks the Most Common Attacks

Prefer Changes You Will Actually Keep

Accept That Nothing Is Perfectly Secure

Revisit This Periodically

Authentication

Use a Strong Password

Don't Reuse Passwords

Use a Secure Password Manager

Avoid Sharing Passwords

Enable 2-Factor Authentication

Keep Backup Codes Safe

Sign Up for Breach Alerts

Shield your Password/PIN

Change Passwords After a Breach, Not on a Schedule

Don’t Save your Password in Browsers

Avoid Logging In on Someone Else’s Device

Avoid Password Hints

Never Answer Online Security Questions Truthfully

Don’t Use a 4-digit PIN

Avoid Using SMS for 2FA

Avoid Using your PM to Generate OTPs

Know Which Face Unlock You Have

Watch Out for Keyloggers

Consider a Hardware Token

Use Passkeys Where Available

Register a Second Passkey Before You Need It

Don't Remove the Password Until the Passkey Works

Consider Offline Password Manager

Consider Unique Usernames

Web Browsing

Block Ads

Ensure Website is Legitimate

Watch out for Browser Malware

Use a Privacy-Respecting Browser

Use a Private Search Engine

Remove Unnecessary Browser Addons

Keep Browser Up-to-date

Use DNS-over-HTTPS

Multi-Session Containers

Use Incognito

Understand Your Browser Fingerprint

Manage Cookies

Block Third-Party Cookies

Block Third-Party Trackers

Beware of Redirects

Do Not Sign Into Your Browser

Disallow Prediction Services

Avoid G Translate for Webpages

Disable Web Notifications

Disable Automatic Downloads

Disallow Access to Sensors

Disallow Location

Disallow Camera/ Microphone access

Disable Browser Password Saves

Disable Browser Autofill

Protect from Exfil Attack

Disable WebRTC

Resist Fingerprinting with the Right Browser, Not Add-ons

Prevent HSTS Tracking

Prevent Automatic Browser Connections

Enable 1st-Party Isolation

Strip Tracking Params from URLs

First Launch Security

Use The Tor Browser

Disable JavaScript

Email

Have more than one email address

Keep Email Address Private

Keep your Account Secure

Disable Automatic Loading of Remote Content

Use Plaintext

Don’t connect third-party apps to your email account

Don't Share Sensitive Data via Email

Consider Switching to a Secure Mail Provider

Use Smart Key

Use Aliasing / Anonymous Forwarding

Subaddressing

Use a Custom Domain

Sync with a client for backup

Be Careful with Mail Signatures

Be Careful with Auto-Replies

Choose the Right Mail Protocol

Self-Hosting

Always use TLS Ports

DNS Availability

Prevent DDoS and Brute Force Attacks

Maintain IP Blacklist

Messaging

Only Use Fully End-to-End Encrypted Messengers

Use only Open Source Messaging Platforms

Use a "Trustworthy" Messaging Platform

Check Security Settings

Ensure your Recipients Environment is Secure

Disable Cloud Services

Secure Group Chats

Create a Safe Environment for Communication

Agree on a Communication Plan

Strip Meta-Data from Media

Defang URLs

Verify your Recipient

Enable Ephemeral Messages

Avoid SMS

Watch out for Trackers

Consider Jurisdiction

Use an Anonymous Platform

Ensure Forward Secrecy is Supported

Consider a Decentralized Platform

Social Media

Secure your Account

Check Privacy Settings

Think of All Interactions as Public

Think of All Interactions as Permanent

Don't Reveal too Much

Be Careful what you Upload

Don't Share Email or Phone Number

Don't Grant Unnecessary Permissions

Be Careful of 3rd-Party Integrations

Avoid Publishing Geo Data while still Onsite

Remove metadata before uploading media

Implement Image Cloaking

Consider Spoofing GPS in home vicinity

Consider False Information

Don’t have any social media accounts

Networks

Understand What a VPN Does and Doesn't Do

Change your Router Password

Use WPA3 (or WPA2) with a Strong Passphrase

Keep router firmware up-to-date

Implement a Network-Wide VPN

Protect against DNS leaks

Use a secure VPN Protocol

Secure DNS

Avoid the free router from your ISP

Change the Router’s Local IP Address

Don't Reveal Personal Info in SSID

Opt-Out Router Listings

Disable WPS

Disable UPnP

Use a Guest Network for Guests

Kill unused processes and services on your router

Don't have Open Ports

Disable Unused Remote Access Protocols

Disable Cloud-Based Management

Manage Range Correctly

Route all traffic through Tor

Disable WiFi on all Devices

Mobile Devices

Encrypt your Device

Turn off connectivity features that aren’t being used

Keep app count to a minimum

App Permissions

Only install Apps from official source

Be Careful of Phone Charging Threats

Set up a mobile carrier PIN

Protect Against SIM Swapping

Opt-out of Caller ID Listings

Use Offline Maps

Opt-out of personalized ads

Erase after too many login attempts

Monitor Trackers

Use a Mobile Firewall

Reduce Background Activity

Sandbox Mobile Apps

Tor Traffic

Avoid Custom Virtual Keyboards

Restart Device Regularly

Keep your Number Private

Watch out for Stalkerware

Favor the Browser, over Dedicated App

Consider running a custom ROM (Android)

Personal Computers

Keep your System up-to-date

Encrypt your Device

Backup Important Data

Be Careful Plugging USB Devices into your Computer

Activate Screen-Lock when Idle

Disable Cortana or Siri

Review your Installed Apps

Manage Permissions

Disallow Usage Data from being sent to the Cloud

Avoid Quick Unlock

Power Off Computer, instead of Standby

Weigh Up Signing In to Your OS Account

Check which Sharing Services are Enabled

Don't use Root/Admin Account for Non-Admin Tasks

Block Webcam + Microphone

Use a Privacy Filter

Don't Charge Devices from your PC

Randomize your hardware address on Wi-Fi

Use a Firewall

Protect Against Software Keyloggers

Check Keyboard Connection

Prevent Keystroke Injection Attacks

Use Built-in Anti-Virus, Not a Third-Party Suite

Periodically check for Rootkits

BIOS Boot Password

Use a Security-Focused Operating System

Make Use of VMs

Compartmentalize

Disable Undesired Features (Windows)

Secure Boot

Secure SSH Access

Close Un-used Open Ports

Implement Mandatory Access Control

Use Canary Tokens

Backup & Recovery

Follow the 3-2-1 Rule

Keep One Backup Offline

Encrypt Your Backups

Test That You Can Actually Restore

Automate It

Harden Your Account Recovery Options

Store Recovery Codes Where You Can Reach Them

Keep an Offline Record of Critical Accounts

Plan for Emergency and Long-Term Access

Know What to Do If You Are Breached

Smart Home

Rename devices to not specify brand/model

Disable microphone and camera when not in use

Understand what data is collected, stored and transmitted

Set privacy settings, and opt out of sharing data with third parties

Don't link your smart home devices to your real identity

Keep firmware up-to-date

Protect your Network

Be wary of wearables

Don't connect your home's critical infrastructure to the Internet

Mitigate Alexa/ Google Home Risks

Monitor your home network closely

Deny Internet access where possible

Assess risks

Personal Finance

Sign up for Fraud Alerts and Credit Monitoring

Apply a Credit Freeze

Use Virtual Cards

Use Cash for Local Transactions

Understand What Cryptocurrency Does and Doesn't Hide

Store Crypto Securely

Know the Rules Before Buying Crypto Privately

Treat Coin Mixers as a Legal Risk, Not a Privacy Tool

Use an Alias Details for Online Shopping

Use alternate delivery address

Human Aspect

Verify Recipients

Don't Trust Your Popup Notifications

Never Leave Device Unattended

Prevent Camfecting

Stay protected from shoulder surfers

Educate yourself about phishing attacks

Install Reputable Software from Trusted Sources

Store personal data securely

Obscure Personal Details from Documents

Do not assume a site is secure, just because it is `HTTPS`

Opt-out of public lists

Never Provide Additional PII When Opting-Out

Opt-out of data sharing

Remove Yourself from Data Broker Sites

Compartmentalize Your Identities

WhoIs Privacy Guard

Use a forwarding address

Use anonymous payment methods

Physical Security

Destroy Sensitive Documents

Opt-Out of Public Records

Watermark Documents

Don't Reveal Info on Inbound Calls

Stay Alert

Secure Perimeter

Physically Secure Devices

Keep Devices Out of Direct Sight

Protect your PIN

Check for Skimmers

Protect your Home Address

Use a PIN, Not Biometrics

Reduce exposure to CCTV

Anti-Facial Recognition Clothing

Reduce Night Vision Exposure

Protect your DNA

Prepare Devices Before Crossing a Border

Take Extra Care on Public and Hotel Networks

Beware Public Charging Points

AI & Privacy

Never Share Secrets with AI Chatbots

Turn Off Model Training on Your Data

Be Sceptical of AI-Generated Messages

Verify Voice and Video (Deepfakes)

Review AI App Permissions

Prefer Local or Private AI Models

Limit Your Public Voice and Photo Footprint

Watch for Data Scraping and Opt Out

Don't Blindly Trust AI Output

Built & maintained by Subash Jaganathan · DFIR Expert · View source on GitHub