An online security checkup is a short routine for finding weak passwords, suspicious sessions, risky app permissions, outdated software, and malware signs before they turn into account theft. In 2026, run this check at least monthly, and run it immediately after a strange login alert, phishing message, fake support call, suspicious download, or password-reset email you did not request.
The fastest version is simple: update your devices, secure your email first, review active sessions, remove unknown apps and extensions, turn on strong multifactor authentication, and scan the device if anything was downloaded or if passwords keep changing back. The sections below explain what to check and what to do when something looks wrong.
Why These Checks Matter in 2026
Old security advice often stops at “use strong passwords” and “install updates.” Those still matter, but the risk pattern has widened. CISA’s public safety guidance still centers on four basics: strong passwords, multifactor authentication, software updates, and phishing resistance. FBI complaint data continues to show phishing/spoofing, personal data breaches, and account-takeover-style incidents as common victim problems. Verizon’s 2026 DBIR also reported a major shift toward vulnerability exploitation as an initial breach path, which makes patching browsers, devices, routers, and apps more important than ever.
That is the main reason this checklist is not just about your PC. A real security checkup covers accounts, recovery methods, browser add-ons, phones, cloud storage, payment accounts, and the device you use to change passwords.
Start With This 15-Minute Security Checkup
- Update first. Install operating system, browser, app, router, and phone updates before opening risky files or changing many passwords.
- Secure your email account. Email is the reset key for most other accounts. Check recent activity, recovery email, recovery phone, forwarding rules, and active sessions.
- Review active sessions. Sign out unknown devices from Google, Microsoft, Apple, social media, banking, password manager, and cloud accounts.
- Turn on stronger MFA. Prefer passkeys, authenticator apps, or security keys. SMS is better than nothing, but it should not be the first choice for high-value accounts.
- Remove old connected apps and browser extensions. Revoke apps you no longer use, especially anything with mail, contacts, cloud storage, advertising, shopping, or “all site data” permissions.
- Scan the device if there was a download or repeated account trouble. Malware, unwanted extensions, and stealers can capture passwords, browser cookies, and autofill data.
1. Update Every Device and App You Still Use
Updates are not only cosmetic. They close security holes in Windows, macOS, Android, iOS, browsers, office apps, VPN clients, routers, PDF readers, password managers, and messaging apps. Attackers often move quickly after a vulnerability becomes public, so the safest setting is automatic updates for the operating system, browser, and core apps.
Check more than your laptop. Phones, tablets, routers, NAS devices, smart TVs, security cameras, and gaming devices can keep old software for years. If a device no longer receives security updates, do not use it for banking, email recovery, password management, or admin access.
What to do: open the update settings for Windows/macOS and your phone, update browsers, remove apps you no longer use, and reboot if the system is waiting for a restart. If your router has never been updated, check the vendor firmware page or replace it if it is no longer supported.
2. Check Passwords, Passkeys, and Breach Exposure
A strong password is not enough if it is reused. If one old forum, store, game, or app leaks a password, attackers can try the same email-password pair on email, social networks, cloud storage, and banking sites. Your email and password manager should have the strongest unique passwords because they can unlock everything else.
Use a password manager to generate unique passwords. Where passkeys are available, use them for major accounts such as Google, Apple, Microsoft, PayPal, banking, and password-manager logins. Passkeys reduce the chance of typing a password into a fake login page, but you still need recovery options that you control.
What to do: replace reused passwords starting with email, banking, cloud storage, social media, and shopping accounts. Save recovery codes offline. If you suspect malware or a stealer, clean the device first, then change passwords from a trusted browser or phone.
3. Review Account Activity, Recovery Methods, and MFA
Many victims notice the problem through an unfamiliar login alert, a password-reset email, a new device notification, or friends receiving strange messages. Do not click the alert link first. Open the official app or type the service address yourself, then review recent activity and active sessions.
Check recovery email addresses, recovery phone numbers, backup codes, trusted devices, forwarding rules, and app passwords. Attackers often add a recovery method or mail-forwarding rule so they can return after you change the password.
What to do: sign out unknown sessions, remove unknown trusted devices, update recovery options, enable MFA, and save backup codes. If MFA prompts keep appearing when you are not logging in, assume someone knows the password and change it from a trusted device.
4. Audit Connected Apps, Permissions, and Browser Extensions
Connected apps and browser extensions are easy to forget. A once-useful calendar tool, coupon extension, game mod helper, file converter, or “AI assistant” may keep access to mail, contacts, cloud files, browsing data, or social media accounts long after you stopped using it.
Review OAuth apps connected to Google, Microsoft, Apple, Facebook, Discord, Slack, GitHub, and cloud storage. Then check browser extensions in Chrome, Edge, Firefox, and Safari. Remove anything you do not recognize, anything that asks for all-site access without a good reason, and anything installed outside a trusted store.
For browser hardening, use our browser security settings guide to review pop-ups, downloads, site permissions, cookies, and extension behavior.
5. Check Running Processes, Startup Items, and Browser Symptoms
You do not need to memorize every process name, but you should know what looks normal for your device. Warning signs include unknown startup entries, a browser opening tabs by itself, search redirects, fake virus alerts, high CPU from an unfamiliar process, disabled security tools, or passwords changing back after you reset them.
On Windows, check Task Manager, Startup apps, installed programs, browser extensions, and scheduled tasks if the symptom is persistent. Be careful with random “end task” advice: some process names are legitimate when they run from the correct signed location, but suspicious when they appear in Temp, AppData, Downloads, or a strange folder.
What to do: document the process name, file path, publisher, and what triggered the warning. If you see pop-ups, redirects, or fake support alerts, compare them with our phishing red flags and phone-hacked warning signs guides, depending on where the problem appeared.
6. Scan for Malware Before Resetting Everything
A malware scan is not a replacement for account security, but it is important when the device may be part of the problem. Scan if you downloaded a file, installed a browser extension, ran a cracked program, opened a suspicious attachment, saw fake update prompts, or keep finding new sessions after you sign them out.
Gridinsoft Anti-Malware can help check for stealers, unwanted apps, suspicious startup entries, browser hijackers, and other threats that may keep accounts exposed. You can also use the Gridinsoft Online Virus Scanner to check a suspicious file before opening it, and Gridinsoft Anti-Malware for a full device scan when symptoms are already present.
After cleanup, change important passwords from a clean device, revoke active sessions again, and watch for another round of login alerts. If a scammer had remote access, also review payment accounts, saved cards, and identity-theft indicators.
What Victims Usually Search For
People rarely search for “online security checks” while everything is calm. They search by symptom. These are the queries and situations this checklist should cover:
- “I clicked a phishing link.” Open the real site directly, change the password if credentials were entered, sign out sessions, and scan if you downloaded anything.
- “Someone logged into my account.” Secure email first, remove unknown sessions, reset the password, check recovery methods, and enable MFA.
- “I got a password reset email I did not request.” Do not click it. Open the account directly and review recent activity.
- “My friends got weird messages from me.” Assume the account or one active session was used. Warn contacts and remove sessions.
- “My phone is hacked.” Separate scam pop-ups from real compromise, then check apps, profiles, browser settings, and account sessions.
- “My identity may have been stolen.” Review exposed data, financial accounts, credit alerts, and recovery email security. Our identity theft signs guide explains what to do next.
- “I got scammed.” Preserve screenshots, contact the payment provider, secure accounts, and avoid fake recovery services. Start with our scam victim checklist.
How Often Should You Run These Checks?
Run a quick account and device check monthly. Run a deeper check every three months or whenever you change phones, lose a device, install a new browser extension, travel, receive a breach alert, or see a login warning. High-value accounts such as email, banking, cloud storage, password managers, Apple Account, Google Account, Microsoft Account, and social media should be checked more often than low-value accounts.
For small businesses, add shared mailbox forwarding rules, admin accounts, payroll portals, domain registrar accounts, website admin panels, and cloud dashboards to the checklist. One weak recovery email or abandoned admin account can undo stronger security elsewhere.
FAQ
What is the most important online security check?
Start with your email account. It controls password resets for many other services. Review recent activity, active sessions, recovery methods, forwarding rules, and MFA before you move to less important accounts.
Should I change all passwords every month?
No. Forced monthly password changes often lead to weaker habits. Use unique passwords, store them in a password manager, and change a password when it was reused, exposed, phished, shared, or used on a device that may be infected.
Is SMS two-factor authentication safe enough?
SMS MFA is better than no MFA, but passkeys, authenticator apps, and security keys are stronger choices for email, banking, cloud storage, and password-manager accounts.
Do I need to scan my PC if only an online account was hacked?
Scan if you downloaded a file, installed an app or extension, used a cracked program, saw browser redirects, or found that attackers keep returning after password changes. If the compromise was only a reused password from an old breach, account cleanup may be enough.
Can browser extensions steal passwords or data?
Some extensions can read page content, browsing data, forms, cookies, or site activity depending on their permissions. Remove extensions you do not recognize or no longer use, and avoid extensions that request broad access without a clear reason.
References
- Cybersecurity and Infrastructure Security Agency. “Secure Our World.” CISA, accessed June 7, 2026. https://www.cisa.gov/secure-our-world
- Federal Bureau of Investigation Internet Crime Complaint Center. “2025 IC3 Annual Report.” FBI IC3, May 2026. https://www.fbi.gov/file-repository/2025_ic3report.pdf
- Verizon. “Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds.” Verizon, May 2026. https://www.verizon.com/about/news/breach-industry-wide-dbir-finds
