Device Security Checklist

How it works

1. 1

   Finish patching before suite logos

   Free

   Unpatched OS and browser holes beat fancy suite logos. Turn on automatic updates, reboot when asked, and remove unused software that never gets patched.

   • OS auto-updates enabled
   • Browser and office apps current
   • Unused apps uninstalled
2. 2

   Encrypt data at rest

   Free

   A stolen laptop without encryption is an open folder. Turn on BitLocker (Windows), FileVault (macOS), or the phone lock-screen encryption your OS already offers, and store recovery keys offline.

   • Disk encryption on for primary laptop
   • Phone lock with biometrics or strong PIN
   • Recovery keys stored offline, not in email drafts
3. 3

   Confirm the free antivirus baseline

   Free

   On Windows, verify Microsoft Defender real-time protection is healthy and not disabled by an expired trial. On macOS, keep Gatekeeper and XProtect defaults; do not stack multiple always-on engines.

   • Real-time protection enabled
   • No conflicting expired AV trials
   • Full scan monthly if you install lots of software
4. 4

   Lock accounts that unlock everything else

   Free

   Antivirus does not fix reused passwords. Put MFA on email and banking, use unique passwords, and prefer a password manager when reuse is the real problem.

   • MFA on primary email
   • Unique passwords for email and finance
   • Stop SMS-only MFA where an authenticator app is available
5. 5

   Backups you can restore

   Free

   A green backup icon is not a restore test. Keep at least one copy that ransomware on your daily PC cannot silently encrypt, then restore a sample file.

   • Versioned backups for documents and photos
   • At least one offline or immutable copy
   • Documented restore test in the last quarter
6. 6

   Optional paid tooling after leftovers

   Optional paid

   Add Bitdefender when multi-device always-on coverage is the leftover job, or Malwarebytes when cleanup after a scare remains. Prefer one real-time product. Re-check checkout before buying.

   • Multi-device seat count known
   • Who should not buy reviewed
   • Affiliate links use our own tracking only
7. 7

   Browser and extension hygiene

   Free

   A patched OS with a reckless browser profile still fails. Remove unused extensions, prefer official stores, and treat unexpected permission prompts as a stop sign. Antivirus does not replace careful install habits.

   • Unused browser extensions removed
   • Installs only from official stores or vendor sites you typed yourself
   • Unexpected permission prompts declined until verified
8. 8

   Admin accounts and remote access

   Free

   Everyday browsing should not run as a standing admin session when your OS offers a standard user option. Turn off unused remote-desktop or sharing features, and review who can log into the device.

   • Daily account is not unnecessary admin
   • Unused remote access and sharing features off
   • Screen lock set for short idle periods
9. 9

   Network basics for a single device

   Free

   Router defaults and open guest Wi-Fi often matter more than a suite upsell. Change default admin passwords, keep router firmware current when the vendor still ships updates, and prefer WPA2/WPA3 on home Wi-Fi.

   • Router admin password changed from factory default
   • Home Wi-Fi uses modern encryption (WPA2 or WPA3)
   • Guest network used for visitors when available
10. 10

    When to reopen the Antivirus Finder

    Free

    Only after patch, encrypt, baseline AV, MFA, and restore-tested backups. Use /tools/antivirus-finder/ to route by leftover job (suite seats, cleanup, or VPN bundle), not by which logo feels loudest.

    • Free steps above marked done
    • Leftover job named in one sentence
    • Finder opened without stacking dual real-time engines
11. 11

    Product analysis: Bitdefender seats vs Malwarebytes cleanup

    Optional paid

    On a healthy device, Bitdefender Antivirus Plus from $24.99/yr or Total Security Individual from $59.99/yr (2026-08-09) fits multi-device always-on leftovers after free hygiene. Malwarebytes Windows Individual Standard from $59.99/yr fits residual cleanup after a scare, not as a default Defender replacement.

    • Name the leftover job in one sentence
    • Keep one real-time layer
    • Re-check same-day
12. 12

    Scenario: healthy Defender, leftover household seats

    Free

    If this single-device walk is done and the leftover job is licensing several family devices, prefer Bitdefender seat packaging over panic cleanup logos. If the leftover is a residual scare, leave for the remove-malware PC guide instead.

    • Free walk completed on this device
    • Seat count known before buying
    • Incident cleanup uses the PC removal guide
13. 13

    Scenario: expired trial left Defender off

    Free

    Re-enable Windows Security real-time protection and run a full scan before any suite CTA. Paid Bitdefender or Malwarebytes cannot honestly replace a free baseline that is still disabled.

    • Defender real-time on
    • Full or offline scan completed
    • Defer seat shopping until baseline is healthy
14. 14

    Scenario: router still on factory admin password

    Free

    Change the router admin password and confirm WPA2/WPA3 before buying endpoint suites. A paid AV logo will not harden an open home gateway.

    • Factory router password changed
    • Guest Wi-Fi for visitors when available
    • Suite shopping only after network basics
15. 15

    Scenario: travel laptop on hotel Wi-Fi

    Free

    Public Wi-Fi raises phishing and session risk more than missing suite logos. Keep disk encryption on, lock the screen, and finish MFA before shopping travel antivirus bundles. We invent no hotel-Wi-Fi infection rates.

    • Disk encryption and screen lock confirmed
    • MFA on email before travel shopping
    • Skip panic AV purchases sold as hotel-Wi-Fi insurance
16. 16

    Scenario: BitLocker or FileVault still off

    Free

    Turn on disk encryption before buying endpoint suite seats. A paid AV logo will not protect files on a stolen unencrypted laptop. Finish the free walk, then reassess seats only for a named leftover.

    • Enable BitLocker or FileVault when the device supports it
    • Confirm a recovery key is stored safely
    • Defer suite CTAs until encryption is on
17. 17

    Scenario: IoT cameras still on default passwords

    Free

    Change camera and smart-plug defaults before shopping endpoint suites. A Bitdefender card on your laptop will not harden an open camera on the same Wi-Fi.

    • Change default IoT admin passwords
    • Segment guest Wi-Fi when available
    • Return to endpoint seat math only after gateway basics
18. 18

    Final verdict

    Free

    Finish the free single-device walk first. After that: Bitdefender when multi-device seats are the leftover job; Malwarebytes when residual cleanup remains. Overall score is not assigned. Commissions never set the checklist order.

    • Free walk marked done
    • Leftover job named in one sentence
    • Re-check same-day