Pick your year
Home by Dark
×

Security basics: sign-in, email, domain and devices

⏱ 25 min5 steps

The more you build, the more there is to protect.

I've learned a few of these the hard way. One of my own product domains couldn't receive email: anyone who wrote to it got a bounce. Two of my service keys were exposed, and I had to replace them. When I looked back at five website reviews I'd done for businesses, none of them had checked , password managers or backups. Nobody knew the answers.

Can't find the two-step setting? That's normal. Every company hides it somewhere else.

two-step sign-in Signing in with your password plus a second thing, like a code on your phone, so a stolen password isn't enough. All words

Before this, you'll want:

×

Steps

Step 1 of 50 done · about 25 min left

Steps for
  1. Step 1 of 5, not done yet
  2. Step 2 of 5, not done yet
  3. Step 3 of 5, not done yet
  4. Step 4 of 5, not done yet
  5. Step 5 of 5, not done yet

  1. Turn on two-step sign-in for the accounts that matter most

    Two-step sign-in means a password isn't enough on its own. You also need a code from your phone, or a tap on it. A stolen password stops being a disaster.

    Start with these, in this order:

    • Your main email. Whoever controls your email can reset every other password.
    • Your AppleMicrosoft , and your bank.
    • Your Claude account signs in through your email or Google, so it's safe once those are.
    • Anywhere you pay for things, and later, where you bought your and .

    For each one:

    1. Go to the account's settings and find Security or Sign-in.
    2. Turn on two-step verification. Most offer a code from an app or a text message. Either is far better than nothing.

    If your business has an account other people depend on, give it two admins: you and one person you trust. If you're locked out, someone can still get in.

    account A sign-in with a company, like a domain, email or hosting. Whoever owns the account controls what's in it. All wordsdomain Your website's name on the internet, like gethomebydark.com. You rent it by the year from a company called a registrar. All wordsGitHub A website that keeps a copy of your git project, with every version saved. Your backup, and where changes get reviewed. All words
    That's not what I see
    I can't find two-step sign-in in the settings.
    Every company names it a little differently: two-step verification, 2-step, two-factor, 2FA or multi-factor. Look under Security or Sign-in in the account's settings, or search the settings for "two". Still stuck? Ask the where to turn on two-step sign-in for that service, and name the service.Claude app Claude on your phone or computer, where you chat with it by typing. claude.ai is the same thing in a web browser. All words
    It's asking for backup codes and I don't know what to do with them.
    Backup codes get you in if you lose your phone. Save them in your , in a note next to that account's password. Don't keep them only in your email, because that's one of the accounts they protect.password manager An app that remembers a different strong password for every account, so you only remember one. All words

  2. Put your passwords in one password manager

    A password manager remembers a different strong password for every account. You remember one.

    On a newer Mac, it's theOn Windows, the easiest one is built into Microsoft Edge, in its Passwords app. It shares your passwords with your iPhone. settings. If you already use another password manager, keep using that one.

    1. Open PasswordsMicrosoft Edge: press Cmd+Spacethe Windows key, type PasswordsEdge and press Enter. Then click in the address bar at the top, type edge://settings/passwords and press Enter.
    2. Fix your most important accounts first. Any time you reuse a password, change it to a new one the password manager makes.

    Never paste a password into a chat with Claude or anyone else.

    That's not what I see
    I don't have a Passwords app.
    It comes with newer versions of macOS. On older Macs, your saved passwords are in System Settings, under Passwords.Windows doesn't have one by that name. Use the one built into Microsoft Edge, or the one in Chrome if that's what you use every day. If you already use another password manager you trust, keep using that one.
    I use the same password in lots of places.
    You and most of the people you know. Fix the important accounts first: email, bank, and anywhere you pay for things. Let the password manager make a new one for each, and it remembers them for you.

  3. Start Claude Code in your Backyard

    If you own a domain, can check the public half of its security without signing in to anything. No domain yet? Skip this step and the next one.

    1. Open (Cmd+SpaceWindows key, type Terminal, press Enter).

    2. Go to your . Type this and press Enter:

      cd ~/Backyard

      cd ~\Backyard

    3. Check the says Backyard.

    4. Start Claude Code. Type this and press Enter:

      claude

    5. If Claude Code shows "Quick safety check", check that the under Accessing workspace ends in Backyard. Then press the down arrow to Yes, I trust this folder, and press Enter.

    Claude Code Claude, working inside Terminal. It can make files and run things on your Mac, with a safety checker watching what it does. All wordsTerminal An app on your Mac where you type instructions instead of clicking on things. Claude Code works inside it. All wordsBackyard The folder right inside your home folder where everything you build in these lessons lives. All wordsprompt line The line in Terminal that ends with a % sign. The word right before the % is the folder you're in. All wordsfolder A place on your computer that holds files and other folders, like a drawer in a filing cabinet. All words

    You should see:

    Claude Code's name and version at the top, a line starting with ❯ where you type, and ⏵⏵ on in the bar at the bottom.

    auto mode Claude works without asking, and a separate safety checker blocks anything risky. All words
    That's not what I see
    It says "cd: no such file or directoryCannot find path … because it does not exist".
    Your Backyard isn't there yet, or the name was spelled differently. Type ~/Backyard~\Backyard and press Enter, then ~/Backyard~\Backyard and press Enter.mkdir The command that makes a new folder. Type mkdir, a space and the new folder's name. It's short for make directory. All wordscd The command that moves Terminal into a folder. Type cd, a space and the folder's name. It's short for change directory, an old word for folder. All words
    It says "zsh: command not found: claudeThe term 'claude' is not recognized".
    This Terminal window doesn't know about Claude Code. Close the window with Cmd+WCtrl+Shift+W, open a new one and try again. If it still says that, go back to Claude Code and .install Put a new program on your computer so you can use it. All wordssign in Tell Claude Code which Claude account is yours, so it knows you've paid for it. All words
    The folder it asked me to trust doesn't end in Backyard.
    Choose No, exit. Type cd ~/Backyard~\Backyard, press Enter, check the prompt line says Backyard, then type claude again.

  4. Check your domain from the outside

    This asks Claude to look up your domain's public records and explain each one: email, the settings that stop faked email, when the domain expires, and the website's certificate. Your domain goes at the end.

    1. Copy the prompt below.
    Check my domain using only public records. Do not sign in to anything. Tell me: 1. Can it receive email? 2. Does it have SPF, DKIM (try the common selectors) and DMARC records, and what does each one do, in plain words? 3. When does the domain expire, and is it locked against being moved to another company? 4. Does the website load on https, and when does its certificate expire? For each one, say what you found, what it means for me, and what I should do about it. List anything you couldn't check. My domain is:
    1. Paste it into Claude Code with Cmd+VCtrl+V.
    2. Type a space, then your domain, like gethomebydark.com.
    3. Press Enter.

    Fixing anything it flags happens in the website of the company you bought the domain from. Claude can walk you through it, but you make the change yourself.

    prompt What you type to Claude. A good one says what you want, how to work and what never to do. All words

    You should see:

    Lines with BashBash or PowerShell while Claude looks up your domain's public records. Then it goes through the four checks in plain words, and lists anything it couldn't check.

    That's not what I see
    I don't have a domain yet.
    Skip this step. Come back to it the day you buy one. That's the best day to set all of this up.
    Claude says it can't find dig or whois.
    That happens on Windows, which doesn't come with those tools. Tell Claude: Use Resolve-DnsName in PowerShell for the records, and look up the expiry date and lock on the web instead.
    Claude says something is missing and I don't know how to fix it.
    Ask it: Walk me through fixing this one step at a time, at the company where I bought my domain. Wait for me to say done before the next step. Changes to a domain's settings are something you make yourself, in that company's website. In auto mode, Claude Code's safety checker blocks it from changing records for you.DNS The settings that tell the internet where your domain's website and email live. All words

  5. Check your computer is locked down

    None of this is technical. It's the same as checking the windows are locked before you go to bed.

    1. Click the Apple menuStart button, then System SettingsSettings.
    2. Click GeneralWindows Update, then Software UpdateCheck for updates. Install anything waiting. Then click theclick ⓘAdvanced options next to and turn on Automatic updatesReceive updates for other Microsoft products and turn everything on.
    3. Click Privacy & Securitysecurity and scroll down to, then Device encryption, the Windows version of . Turn it on if it's off. No Device encryption there? Press the Windows key, type BitLocker, choose Manage BitLocker and click Turn on BitLocker. If neither one is there, your edition of Windows doesn't offer it, so skip this one.
    4. Click Lock ScreenAccounts, then Sign-in options, and set the setting that starts Require password after screen saver begins or display is turned offIf you've been away to ImmediatelyEvery Time.

    Your phone counts too. Make sure it has a passcode and is up to date.

    FileVault A Mac setting that scrambles everything on your disk, so nobody can read it if your Mac is lost or stolen. All words
    That's not what I see
    FileVaultDevice encryption says it will take a while.
    It works in the background while you use your MacPC. Keep it plugged in and let it finish. Save the recovery key in your password manager when it offers one.
    There's an update waiting but I'm in the middle of something.
    Pick a time tonight. Updates fix security holes that are already known, so the sooner the better, but not in the middle of your work.
×

Your challenge

By the end of the week, every account that could cost you money or your business if someone else got in has two-step sign-in on, and its password lives in your password manager. Write the list down as you go.

Last checked 2026-10-17

Start