The Security Checklist: What to Do, in What Order

The Security Guide is a reference, ranked by risk. This page is the other thing you need: a sequence. If you have one free, unhurried day, doing the steps below in this order covers every base — and the order matters, because several steps depend on the ones before them. Each step is one line of what and why; the details live on the linked page. Everything here is universal — no particular token, chain, or protocol required.

Time: most of a day. Nothing here should be rushed, and nothing needs to be finished today except Steps 1–4 — the rest can spill into the week.

Before You Start — What to Gather

Have these in hand (or ordered) before the day begins, so no step stalls on a missing part. Prices as of mid-2026:

• A hardware wallet — bought new, direct from the manufacturer, never from a marketplace or second-hand ($60–180). Which one and why: the Wallets guide. Ship it to a pickup point, not your home — the reasoning is in Physical Security & OPSEC.
• A metal seed backup — one plate or capsule ($45–120), or a DIY steel plate with letter stamps ($10–25). Options compared on the Seedphrase page.
• Two hardware security keys (~$50 each) — for logins, not the wallet; two because a lone key’s main guarantee is lockout. What they protect: Security Guide 4.b. Optional but strongly recommended.
• Pen and paper — for the disk-encryption recovery keys. They go with your physical backups, never into a file.
• The computer you’ll dedicate to crypto (or your everyday one, to harden).
• Your phone — it’ll carry the authenticator app.
• Two storage places decided in advance — where the metal backup lives, and a second location, so seed and hardware wallet are never stealable in the same sixty seconds.

The Order

1. Orient — 15 minutes of reading, zero clicks. Skim the Security Guide’s risk table so you know why each step below exists. Security you understand survives; rituals don’t.
2. Harden the machine — about an hour. Everything else happens on this computer, so it comes first: the Mac setup guide or the Windows setup guide, top to bottom. Recovery keys go on paper.
3. Set up the hardware wallet — the careful hour. Unbox and verify it, generate the seed on the device, add a passphrase, and stamp the seed into metal. The step-by-step for both backup standards and the passphrase: the backup guide; the reasoning: Seedphrase security and the Wallets guide. This is the step where the money actually becomes safe — take it slowest.
4. Place the backups. Metal backup to its home, hardware wallet to a different one — the split-location rule from Physical Security & OPSEC. Done right, no single burglary, fire, or lost bag can hurt you.
5. Lock the browser down — 20 minutes. One browser, bookmarks-only navigation, no extensions beyond the wallet: the Browsers guide.
6. Build the account perimeter — the second hour. In this order: a password manager, then 2FA on the four accounts that matter (register both security keys, remove SMS everywhere, set the carrier port-freeze PIN), then a private email that exists only for crypto.
7. Learn the ten-second habits — 20 minutes of reading. Transaction & signing hygiene and social engineering: the attacks that beat hardware, and the habits that beat them back.
8. Read the runbook once, now. If you think you’re compromised is written for a bad hour — read it before that hour, so the order of moves is already in your head.
9. Do one small practice run. Send a small test amount to your new wallet and confirm receipt in the wallet itself, then send from it once. An hour of practice converts the whole setup from theory to muscle memory.
10. Homework for the week: the estate plan. Crypto Inheritance — the letter-of-instruction pattern takes an evening, and it’s the one step nobody can do later.

When You’re Done

You’ll have covered machines, money, logins, habits, the bad day, and the day after you’re gone — every base the Security Guide ranks, in an order where each step protected the next. Revisit yearly; the inheritance guide pairs the review with tax season.

Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the address stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.