Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure your primary email and cloud-storage accounts first: give every account a long, unique password, enable the strongest phishing-resistant multi-factor authentication (MFA) it supports, verify recovery methods, and stop using unexpected message links to sign in. Then review sessions, connected applications, sharing permissions, and administrator controls. The exact settings and available MFA methods vary by provider, so use each service’s current security dashboard.
Why email and cloud accounts deserve priority
Your primary email account is often the recovery route for other services. If an attacker takes it over, they may be able to reset passwords elsewhere, impersonate you, or read sensitive correspondence. Cloud-storage accounts can expose documents, photographs, backups, invoices, and shared work files. A phishing message that steals either account therefore has consequences beyond one login.
Phishing works by persuading you to enter credentials, approve a sign-in, open a harmful attachment, or disclose a verification code on a site controlled by someone else. Account security cannot eliminate deceptive messages, but it can reduce the value of a stolen password and make fraudulent sign-ins harder to complete.
The prioritized account-hardening checklist
- Secure the primary email account. It is usually the most important recovery and identity account.
- Secure cloud file-storage accounts. Apply the same password and MFA standards to personal and work storage.
- Enable the strongest MFA option available. Prefer FIDO/WebAuthn or a physical security key; use another method if the service does not support those options.
- Replace reused passwords. Create a different, long password for every account and store it in a password manager.
- Check recovery controls. Confirm that recovery email addresses, phone numbers, backup codes, and trusted devices are still under your control.
- Review active sessions and connected apps. Revoke devices, browser sessions, and integrations you do not recognize or no longer use.
- Audit cloud sharing and permissions. Remove public links, stale collaborators, and unnecessary third-party access.
- Adopt a message-verification habit. Treat unexpected sign-in links, attachments, invoices, and requests for codes as suspicious.
- Ask an employer’s administrator for stronger controls. Privileged and administrative accounts should receive phishing-resistant MFA and tightly limited permissions.
Work through the list in that order. It puts the accounts that can unlock other services ahead of lower-value accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose MFA by phishing resistance, not convenience alone
MFA adds a second proof of identity after a password. The methods are not equally resistant to a fake sign-in page. CISA states, “Any form of MFA is better than no MFA,” while advising people to use phishing-resistant MFA whenever it is available.
| MFA method | Typical phishing resistance | What to know before choosing it |
|---|---|---|
| FIDO/WebAuthn security key | Strongest among the common options listed by CISA | The credential is bound to the legitimate website, so it should not authenticate a look-alike domain. Confirm that the service, browser, and device support the key. Enroll a backup before relying on one. |
| Authenticator-app number matching | Stronger than a one-time code, but not equivalent to a security key | You approve a sign-in by matching a number shown on the login screen. Reject prompts you did not initiate and report repeated unexpected requests. |
| Authenticator-app one-time code | Useful protection, but a code can be relayed to a phishing site | Enter codes only in a sign-in you started through the known service address or official app. |
| Biometrics | Usually device-specific; often best paired with another method | A fingerprint or face unlock may protect a passkey or authenticator on one device. Check how the provider handles enrollment, replacement, and recovery. |
| SMS or email code | Weakest of the common methods in CISA’s hierarchy | Use it when stronger options are unavailable, but do not treat it as a reason to reuse passwords or ignore suspicious login pages. |
This is a broad hierarchy, not a guarantee that every provider offers every method. A service may label a passkey, hardware key, authenticator, or biometric option differently. Read the provider’s current security documentation and check compatibility with your phone, computer, browser, and account type.
How FIDO/WebAuthn blocks a common phishing path
When you authenticate with FIDO/WebAuthn, the credential is associated with the legitimate website origin. A fake domain can copy the appearance of a login page, but it should not be able to use that credential for its own origin. This is why CISA identifies FIDO/WebAuthn as phishing-resistant when the service implements it correctly.
Recommended Free Tools
A security key is a physical implementation of this approach. Keep it protected from loss, enroll a second key or another supported recovery method, and test the backup while you still have access to the account. Do not buy a key before checking the service’s supported standards and your devices’ ports or wireless capabilities.
Enable MFA safely in each account
Provider interfaces change, so there is no universal menu path. In each account, open the current security, sign-in, or account-protection area and look for MFA, two-step verification, passkeys, security keys, or authenticator settings.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Sign in by typing the known service address yourself or by opening its official application. Do not start enrollment from an unexpected email or text message.
- Record which MFA methods the account supports. Select FIDO/WebAuthn or a security key if available.
- Enroll the primary method and complete a test sign-in in a new browser window.
- Add a backup security key, passkey, authenticator, or provider-approved recovery method. Keep backup codes offline and protected from anyone who can access your email.
- Sign out of devices or sessions you no longer recognize, then confirm that future sign-ins require the new factor.
Never approve an MFA prompt you did not initiate. Several unsolicited prompts in a row can indicate that someone already knows your password and is trying to make you approve access.
Use a unique password for every account
MFA is an additional layer, not permission to reuse a password. If the same password appears on another site and that site is breached, an attacker can try it against your email or cloud account. A separate password limits the damage to the service where it was exposed.
- Use a long password or passphrase generated by a password manager.
- Do not base passwords on your name, company, pets, birthdays, public profile, or predictable substitutions.
- Do not copy your email password into cloud storage, shopping, social, or work accounts.
- Let the manager generate and fill passwords only after you have verified the domain and started the sign-in yourself.
- Protect the password manager with its own strong, unique master password and MFA.
A password manager helps create and store unique credentials, but it does not determine whether a page is genuine. Pause before accepting an autofill suggestion: check the domain and confirm that you reached the service through a known bookmark, typed address, or official app.
Review recovery and backup access
Recovery settings can bypass normal MFA, so they deserve the same attention as the primary login. In the provider’s current account-security settings, check every recovery email address, phone number, backup code, trusted device, and alternate sign-in method.
- Remove an old phone number, former employer address, or device that another person can access.
- Use a recovery address that is itself secured with a unique password and MFA.
- Store one-time backup codes offline in a protected location. Do not leave them in an unprotected inbox or shared document.
- Understand the provider’s lockout and identity-verification process before you lose your primary device.
- After changing a password or MFA method, review recovery settings again; some services retain previous methods for a limited period.
Recovery workflows and labels differ by provider and can change. Follow the service’s current instructions rather than assuming that a particular menu, code lifetime, or support process applies everywhere.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recognize and handle phishing messages
Unexpected requests for passwords, MFA codes, payment, document access, or urgent action deserve verification. A familiar logo or display name is not proof that the message is genuine.
Inspect the sender and context
Check the complete sender address, not only the display name. Be cautious when the address uses a look-alike domain, an unrelated mailbox, or a reply-to address that differs from the sender. Consider whether you were expecting the message and whether its urgency or secrecy is unusual.
Check links without opening them
On a computer, hover over a link; on a phone, press and hold only if your device safely shows the destination without opening it. Look for a misspelled domain, an unfamiliar subdomain, a shortened address, or a destination that does not match the claimed organization. Do not enter credentials after following an unexpected link. Instead, type the known service address, use a saved bookmark, or open the official app and inspect notifications there.
Treat attachments and shared documents as untrusted
Unexpected invoices, password-protected archives, macro-enabled documents, and “shared file” notices can be used to deliver malware or a fake sign-in page. Verify the request through a separate channel you already trust. Do not enable content or provide credentials merely because an attachment says it is required to view a document.
Report instead of replying
Use the reporting mechanism supplied by your employer or email provider. Do not reply to a suspicious sender, forward the message to colleagues as a warning without removing active links, or disclose information while asking whether the request is legitimate.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Harden cloud-storage access and sharing
After enabling MFA, inspect who and what can access your cloud files. A phishing attack may target a third-party application or a shared link rather than the main password.
- Review the account’s connected applications and revoke integrations you no longer need.
- Remove collaborators who have left a project and replace broad “anyone with the link” access with named people where possible.
- Check whether shared folders inherit permissions to sensitive subfolders.
- Separate personal and work storage, and do not synchronize confidential work files to an unmanaged device.
- Review sign-in alerts and device lists for locations, browsers, or operating systems you do not recognize.
Cloud providers use different names for sharing, application access, session management, and alerts. Verify each change in the provider’s current interface and document the intended owners of important shared folders.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What workplace administrators should enforce
Personal vigilance is not enough for organizational accounts. Administrators should make the secure path the default, especially for identities that can change users, access sensitive data, or alter security policy.
Protect privileged accounts first
Require phishing-resistant MFA for administrators and other privileged users wherever the identity platform supports it. Keep administrative identities separate from ordinary daily-use accounts, and avoid using a high-privilege account to read routine email or browse unrelated sites.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use identity and access management to limit damage
Apply least privilege: give each person and application only the permissions required for its role. Review group membership, delegated mailbox access, service accounts, and third-party integrations on a schedule. Remove access promptly when a person changes roles or leaves.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Roll out controls without creating recovery gaps
- Inventory email, cloud-storage, administrator, service, and contractor accounts.
- Identify which accounts support FIDO/WebAuthn, security keys, authenticator apps, or other MFA methods.
- Enroll privileged users first, including tested backup factors and documented recovery procedures.
- Set an organization-wide deadline for MFA, then monitor exceptions instead of allowing permanent bypasses.
- Review sign-in logs, risky sessions, forwarding rules, application consent, and unusual file sharing.
- Test the process for a lost device, suspected phishing, employee departure, and administrator lockout.
Communicate that the help desk will never ask users to disclose a password or one-time code. Provide a clear way to report suspicious messages and unexpected MFA prompts.
If you think you entered credentials into a phishing page
- Stop using the suspicious page and close it. From a trusted device, open the real service directly.
- Change the affected password immediately, then change any other account that reused it.
- Revoke unfamiliar sessions, devices, application connections, forwarding rules, and recovery methods.
- Reset MFA methods if you believe a code, approval, passkey, or security key was exposed. Enroll a known backup.
- Check sent mail, deleted mail, cloud sharing, and recent sign-in activity for unauthorized changes.
- Notify your employer, provider, financial institution, or other affected parties through official channels.
- Preserve the suspicious message and relevant timestamps for the organization’s security team, but do not continue interacting with the sender.
If a work account is involved, contact the administrator immediately; an administrator may be able to revoke sessions and investigate activity centrally.
A practical maintenance schedule
| When | Action |
|---|---|
| Today | Enable the strongest available MFA on primary email and cloud storage, replace reused passwords, and secure the password manager. |
| During the next account review | Verify recovery methods, enroll a backup factor, remove unknown sessions, and revoke unused applications. |
| Monthly or after major changes | Review sign-in alerts, shared links, collaborators, forwarding rules, and administrator notifications. |
| When a device, phone number, role, or employer changes | Remove the old device or recovery method, update trusted devices, and reassess application and folder permissions. |
| Immediately after a suspected phish | Change passwords, revoke sessions, reset exposed MFA methods, inspect account activity, and report the incident. |
How to choose the right protection when options are limited
If a service supports a security key or FIDO/WebAuthn, use it with a tested backup. If it offers only an authenticator, prefer number matching over a code when both are available, and reject unsolicited prompts. If the only choice is SMS or email, enable it rather than leaving the account unprotected, then revisit the setting when the provider adds a stronger method.
Compatibility and recovery are account-specific. A method that works on one provider may be unavailable on another, and a key that connects to one device may require a different connector or wireless capability on another. Confirm support before purchasing hardware or deleting an existing recovery method.
What secure behavior looks like every day
- You reach email and cloud storage through a known address, bookmark, or official app, not an unexpected message link.
- Your password manager supplies a different long password for each service.
- Your strongest available MFA is enabled, with a backup that you have tested.
- You verify unusual requests through a separate trusted channel.
- You review sharing and connected applications instead of assuming that a private account makes every file private.
- You report suspicious messages and unexpected MFA prompts rather than approving or answering them.
These controls work together: unique passwords reduce reuse risk, MFA limits what a stolen password can do, phishing-resistant methods prevent authentication on the wrong site, and careful verification reduces the chance that you surrender a credential or approve an attacker’s request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
