Lock down a new account

# Lock down a new account

I just signed up for [service]. Walk me through the four steps that cover 95% of the risk.

## What I want back

A 5-minute checklist:

**1. Set a strong, unique password.** Specifically: how to do it for this service, where to store it (a password manager — name one), and why "I'll just remember it" doesn't work.

**2. Turn on two-factor authentication.** Walk through it specifically for this service. Push or app-based, not SMS, unless SMS is the only option. Save backup codes — where, and how.

**3. Check what's connected.** Third-party apps with access, OAuth grants, API keys. For this specific service, where is that page? Anything that doesn't need to be there: revoke.

**4. Set the recovery options that won't lock me out.** Recovery email, recovery phone, trusted device — set what makes sense, don't set what's a security hole. Specifically for this service.

**Then:**

- **The one extra step worth taking** for this specific service (e.g. for a bank, set transaction alerts; for email, check your forwarding rules).
- **What I should write down.** Not the password. The recovery info. Where I put it matters as much as what it is.

## Rules

- Tell me which service first. Generic advice helps no one.
- Don't suggest 12 steps. The point is 4.
- Be honest about which steps matter most.

Tell me the service.