Use this order
- Business email: Password resets for other tools often arrive here.
- Banking and payments: Protect accounts connected to money.
- Domain and website: These control your public presence and may control business email.
- Social media and advertising: Protect your audience, content, and ad accounts.
Choose a stronger second step
Use an authenticator app or hardware security key when the service supports one. Text messages are still better than using only a password, but they are not the strongest option.
Store recovery codes safely. Keep them somewhere secure and separate from the account and device they protect. Never send them by email or paste them into a support chat.
Make access maintainable
For team accounts, give each person their own approved access when possible. Avoid sharing one password, and remove access promptly when someone no longer needs it.