Locking down your accounts

Password manager first. Let it generate everything; you should not know your own passwords.
Start with your email password. Email is the master key that resets everything else.
Two-factor auth everywhere it's offered. Authenticator app as the baseline, hardware key for your most important accounts.
Store recovery codes offline. Losing them locks you out as hard as an attacker would.
Check your addresses at haveibeenpwned.com and rotate anything listed.
Treat urgency as a warning sign. Never log in via a link in an email — type the address yourself.
Answer security questions with random strings stored in your manager. Your mother's real maiden name is public record.

Next