Why a self-check beats a checklist
There is no shortage of online safety checklists. The problem with all of them is that they treat every item as equal, so you read twenty bullet points, feel vaguely guilty, and change nothing. A list without priorities is a list nobody acts on.
This check weights the questions. Two-factor authentication on your email is worth three times a screen lock, because your email is the reset mechanism for everything else you own — if someone controls it, they can take your bank, your cloud storage and your social accounts without ever knowing those passwords. The screen lock matters, but it matters less. Your result reflects that, and so does the order of your fix list.
The other thing a checklist cannot do is tell you what you did not know you did not know. The "not sure" option exists for that. If you have never looked at whether your email has a forwarding rule you did not create, "not sure" is the honest answer, and it will appear in your results with an explanation of why it matters and how to look.
The gaps almost everyone has
After you have done a few of these, the same handful of answers come up again and again.
Backups that have never been restored from. Nearly everyone with a backup has never tested it. A backup nobody has restored from is a hope, not a plan, and failed backups tend to be discovered at the worst possible moment.
Email settings nobody has ever looked at. Forwarding rules, filters that quietly delete security alerts, recovery addresses, connected apps with permission to read your mail. An attacker who gets in sets these up so they keep access after you change the password. It takes ten minutes to check and almost nobody has.
Two-factor backup codes saved as a screenshot on the phone. Which defeats the entire point, because the scenario the codes exist for is losing that phone.
No family check word. Voice cloning needs only a short clip from a social media video, so "it sounded exactly like her" stopped being evidence some time ago. A word agreed in advance costs nothing and restores the ability to verify.
Passwords stored in the browser. Convenient, and a primary target for information-stealing malware, which can extract them in seconds from a compromised machine.
If several of those are on your list, you are in ordinary company rather than unusually careless.
How your answers are handled
They are not handled at all, which is the point. The questions, the scoring and your results are all produced by JavaScript running in this page on your own device. Nothing is transmitted, nothing is logged, and there is no account, no email address and no database.
You can verify this rather than take our word for it: load the page, disconnect from the internet, and complete the check. It works exactly the same. When you close the tab, your answers are gone — so print or save your list if you want to keep it.
What to do with your result
Whatever you scored, the response is the same: start at the top of your list and work down. The list is ordered by how much risk each item removes, not by how easy it is, so the first two or three will make the biggest difference even if they take the longest.
Do not try to fix everything in one sitting. People who attempt that give up halfway and end up worse off than when they started, with half a job done and no memory of which half. One item this week is worth more than ten planned for next month.
If you would rather have it done than explained
Everything in this check is something you can do yourself for free, and the guides linked in your results explain exactly how. Some people would rather someone turned up and did it with them.
That is what the Cyber Hygiene Warrant of Fitness is: the same twenty points, worked through in person at your place, fixed on the spot where they can be, with a certificate at the end and a reminder next year. It is available in New Zealand only. Everything else on this site is free to anyone, anywhere, and always will be.
Do it again in six months
Cyber hygiene is called hygiene because it is maintenance rather than a project. Devices get replaced, accounts get created, people join the household, and things quietly drift. Coming back to this twice a year catches that drift while it is still small.
Frequently asked questions
Is this self-check free?
Yes, and there is no sign-up. It runs entirely in your browser, your answers are never sent anywhere, and closing the tab discards them.
How long does it take?
About five minutes for twenty questions. You can answer 'not sure' to anything you do not know, and the result will tell you how to find out.
What do I get at the end?
A score out of twenty, a plain-English explanation of each thing you did not pass, and a ranked list of what to fix first based on what actually prevents harm.
Is a low score bad?
It is normal. Most people score somewhere in the middle on a first attempt, and the common gaps are the same handful every time. The list at the end is ordered so the first two or three items remove most of the real risk.
Do you store my answers?
No. There is no account, no database and no analytics on your answers. The scoring happens on your own device in JavaScript, which you can verify by disconnecting from the internet after the page loads.