NEW: The practical guide "Securing Windows" as a PDF - only €9.99 - Download now - NEW: The practical guide "Securing Windows" as a PDF - only €9.99 - Download now -
Skip to content

Checklists

Five checklists you can work through in a single weekend. Each checklist is written so you can carry out the steps on your own PC – no need to be an administrator of someone else's system.

Checklist 1: Windows After a Fresh Install

  1. Windows Update. Settings → Windows Update → Check for updates. Repeat until “You're up to date” appears. Don't skip the restart.
  2. Microsoft account with 2FA. account.microsoft.com → Security → Advanced security options → enable two-factor authentication. Install an authenticator app on your phone.
  3. Enable BitLocker (if you have Windows Pro). Control Panel → BitLocker Drive Encryption. Print the recovery key or store it in a password manager, don't just save it on the same PC.
  4. Keep Defender active. Settings → Privacy & Security → Windows Security → Virus & threat protection. Everything set to “On.”
  5. Browser. Install Firefox or Edge, set as default. Chrome only if you use a Google account with 2FA.
  6. Password manager. Install KeePassXC (local) or Bitwarden (cloud) and set a strong master password. See Downloads.
  7. Set up a backup. Windows Backup or a separate tool. Follow the 3-2-1 rule: three copies, two different media, one stored off-site.

Checklist 2: Secure Your Microsoft Account

  1. Enable 2FA. account.microsoft.com → Security.
  2. Change your password. At least 14 characters, no dictionary words. Use a password generator.
  3. Check recovery options. Keep your phone number and recovery email up to date.
  4. Review signed-in devices. Sign out old devices.
  5. Check your activity history. Watch for unusual sign-ins.

Checklist 3: Secure Your Home Router

  1. Open the router interface. Usually 192.168.0.1 or 192.168.1.1, credentials on a sticker or in the provider's documentation.
  2. Change the admin password. Don't leave the default in place.
  3. Update the firmware. Manufacturer's website or auto-update in the router menu.
  4. Disable remote management from the internet. Often labeled “Remote Management,” “HTTPS from WAN,” or “Admin over Internet.”
  5. Disable UPnP. Unless you have console gaming or NAT issues, you don't need it.
  6. Guest Wi-Fi. Enable only when actually needed. Use a different password than the main Wi-Fi, isolated from the home network (if the router supports it).
  7. DNS. Keep the provider's default DNS, or switch to a trustworthy provider like Quad9 (9.9.9.9) or Cloudflare (1.1.1.1).

Checklist 4: Check Your Wi-Fi

  1. Encryption. WPA2 (AES) or WPA3. Not WEP or WPA (TKIP).
  2. Password. At least 16 characters, no dictionary word. Use a password generator.
  3. Keep the SSID visible – a hidden network isn't a real security gain, just a usability loss.
  4. Check the device list. Review all connected devices in the router menu. Unknown device → change the Wi-Fi password and remove the device from the list.

Checklist 5: Set Up Backups (3-2-1)

  1. Three copies of your most important data: the original on the PC, a second copy on an external drive, a third copy stored off-site (cloud or with family).
  2. Two different media. Local drive + cloud, or local drive + external USB drive.
  3. One off-site copy. Cloud storage (with 2FA), a bank safe deposit box, or with family members.
  4. Encryption. Encrypt the local backup drive with VeraCrypt or BitLocker. Leave cloud backups encrypted by the provider.
  5. Test regularly. Once a quarter, restore a file from the backup and check it's readable.