How to Secure Your Old Accounts

Most of us have a trail of accounts we stopped thinking about years ago: a forum from college, a photo site that went out of fashion, a game we played for one summer. Those accounts don't disappear when we stop logging in. Many still hold an old password, an email address we no longer check, and personal details we would rather keep private.

Forgotten accounts are an easy target. If an old password leaked in a breach and you reused it elsewhere, attackers can try it on your current accounts. An old account with your real name can be taken over and used to scam your friends. This guide walks through securing those accounts one by one. If you haven't made your list yet, start with our guide on finding your old accounts, then come back here.

Step 1: Build the list

You can't secure accounts you don't know about. Pull together every username you remember using, plus your email addresses, and work from three sources:

• Your password manager or browser's saved logins. These often list sites you forgot about entirely.
• Your inbox. Search old email addresses for "welcome", "verify your account" and "password reset".
• A username search. Run your handles through our username search, which checks 3,450+ sites and takes up to five usernames at once. For Found results it shows the public display name, avatar and bio, which helps you recognize your own profiles quickly.

Remember that Found means a profile with that name exists, not that it is yours. Open each one and confirm it before you act. Blocked and Unknown results mean the check didn't finish, so try those sites by hand. The digital footprint checker is set up for exactly this kind of self-audit, and you can export results as CSV to use as a working checklist.

Keep track as you go with our account inventory template (CSV): one row per account, with what you secured and when.

Step 2: Decide keep, lock or delete

Go through the list and sort each account into one of three groups:

• Keep: accounts you still use or want to hold onto, including handles you'd like to keep so nobody else can grab them.
• Lock down: accounts you don't use but can't delete, or want to keep for their history.
• Delete: everything else. An account that no longer exists can't be breached.

When in doubt, lean toward deleting. Every account you keep is one more thing to maintain.

Step 3: Fix recovery details first

For every account you keep or lock down, log in and update the recovery email and phone number before anything else. An account tied to an old school email or a phone number you gave up is one forgotten password away from being lost. Worse, if someone else now controls that email address or phone number, they may be able to reset your password.

While you are in the settings, check for:

• Active sessions and devices you don't recognize. Sign them out.
• Forwarding rules on email accounts that send copies of your mail elsewhere.
• Old security questions with answers someone could look up, like your first school or pet's name. Change them to random answers and store those in your password manager.

Step 4: Move every password into a password manager

Password reuse is what turns one old breach into many compromised accounts. A password manager fixes that by generating and remembering a unique, long password for every site. Most browsers and phones include one, and there are standalone options too.

As you work through your list, change each account's password to a new generated one and save it. Start with the accounts that matter most: your main email, your bank, and anything you use to sign in to other sites. Your email account is the master key, because password resets for everything else go there.

Step 5: Turn on two-factor authentication

Two-factor authentication (also called multi-factor authentication or two-step verification) means a stolen password alone isn't enough to get in. CISA's guide to turning on MFA covers the basics: look in an account's security settings, switch it on, and choose a method.

Not all methods are equally strong. In its MFA guidance for businesses, CISA ranks security keys as the best protection, followed by authenticator apps, with codes sent by text or email as the weakest option. Any of them is much better than none. Save the backup codes each site gives you in your password manager, so you don't lock yourself out if you lose your phone.

Step 6: Revoke old app connections

Over the years, you have probably clicked "Sign in with" on dozens of sites and given quizzes, games and tools access to your social or email accounts. Those connections often stay active long after you stopped using the app.

Open the security or privacy settings of your main accounts and look for a section on connected apps, third-party access or apps with account access. Remove anything you don't recognize or no longer use. If you used a "Sign in with" button to create other accounts, note which ones before you remove access, so you don't lock yourself out of something you want to keep.

Step 7: Delete what you don't need

Deleting is often harder than signing up, but most platforms have a way:

• Look for "delete", not "deactivate". Deactivation usually hides an account but keeps the data. Deletion removes it, though many sites wait a few weeks before finishing the job.
• Download your data first if there is anything you want to keep, such as photos or messages.
• Remove content before deleting on sites that keep posts visible after the account is gone. Some forums do this.
• Search the site's help center for "delete account" if the option isn't in settings. Some sites only delete on request through a form or email.
• Remove payment methods from anything you are closing.

If you can't get back into an old account, use the platform's own recovery or support process. Be wary of anyone offering to recover accounts for a fee.

A note on usernames you want to keep

Once you delete an account, the username may become available to anyone. If an old handle matches your name or your brand, consider keeping the account, securing it, and leaving it quiet rather than deleting it. A locked-down placeholder is safer than a handle in a stranger's hands. Our platform checkers show whether a handle is currently taken on a specific site.

Still building the list? Here's how to find forgotten accounts from your phone, starting with your email inbox and saved passwords.

Step 8: Make it a habit

Set a reminder to repeat a lighter version of this audit once a year. Search your handles again, look for new accounts you don't recognize, and check that recovery details are still current. Running the same search every year and comparing the exports shows you what changed.

Our tool is free and needs no sign-up. The username is sent to our server only to run the check, and we don't store or log it. If you're curious how the same techniques are used by investigators, the OSINT username search page and the OSINT tools hub explain them, and the use cases section includes a self-audit page.

Ready to start your list? Search your usernames and work through the steps above.