Skip to content
TDACorpIDENTITYSign in

Security checkup

How your security score is made up, what each check looks at, and how to use the next actions to raise it.

On this page

The Checkup tab scores your account out of 100 and lists what to do next. It is titled Security checkup and says it shows how well your account is protected and what to do next. The same score appears as a ring on the account overview and as a row on the Security overview.

Unlike the other Security tabs, the checkup does not ask you to confirm with a second factor first. It is open to any signed-in session.

The page#

At the top three figures: Your score with out of 100 and a level, Checks that need attention, and Checks that are good. The level is one of Strong, Fair and Needs attention.

  • Do these in this order lists each check that needs attention, numbered, with what to do, how many points it would earn (for example +40 points) and an Open button that goes to the page where you fix it.
  • How the score works explains the rules in three short points, described below.
  • All checks is a table with the check, its status (Good, Needs attention or At risk), its points as earned out of possible (for example 0 / 40) and an Open button when there is something to do.

When everything is good, the list says Nothing to do right now. This page updates as your account changes.

The Security checkup: a score of 65 out of 100 marked fair, three checks that need attention and three that are good, then the steps to take in order, each with an Open link, and a short explanation of how the score works.
  1. Your score, out of 100, with its level.
  2. The first thing to do, with the points it earns.
  3. Open, which goes to the page where you fix that check.
Security checkup: how strong the account is, and what to do next. Sample data./account/security/checkup

The checks#

Each check is all or nothing: a good check earns all its points and one that needs attention earns none. That way you can always say exactly why you lost points.

CheckPointsGood when
Passkey40You have at least one passkey. Without one the status is Needs attention, or At risk if you also have no password and no authenticator app.
A way back in20You have a second passkey, or recovery codes you have not used, so losing one device cannot lock you out.
Password15There is no password, or the password has not been found in a known data breach. A password that appeared in a breach is At risk and the page says to change it now. A password that has not been checked against breaches is Needs attention.
Recovery codes10You have a few unused recovery codes left. With none issued, or only one or two left, the page tells you to generate a fresh set.
Sessions10No signed-in session has gone unused for a month. Otherwise it says how many have, and to sign them out.
Second email5You have a second verified email address.

The page also states what the score counts and what it does not: only things you can change on this account, and nothing about what you do in applications.

What each action does#

It is a guide#

The page says it plainly: a score of 100 does not mean you cannot be phished. The score counts how many ways in and ways back you have, not how careful you are with them. Keep passkeys on devices you control, keep recovery codes somewhere safe and separate from your password, and be wary of any page that asks you to sign in after a message you did not expect.

The names and explanations of the individual checks are shown in the language of the page. A check explanation the page does not have a translation for is shown in English. The names quoted here are the English ones. See Languages.

The score updates as your account changes, so there is nothing to refresh by hand beyond reloading the page.

Verified against commit ca26dec