This checklist is brought to you by Forward To Safety — cybersecurity built for real life.
Whether it’s a phishing scam, a stolen device, or a compromised account, Forward To Safety gives your family the tools and knowledge to recognize threats, respond with confidence, and recover fully.
Three capabilities. One trusted platform.
- Craig AI Library — Plain-language cybersecurity education for every age and tech level, built by Craig Peterson
- Website Safety Checker — Check any link or website against threat intelligence and blocklists before anyone in your family clicks it
- Forward To Safety Assure — Security visibility and compliance reporting for family members who also run or manage a small business
Security experts agree: Every household will eventually face a cyber incident. Whether it’s a phishing scam, stolen device, compromised account, or malware infection — having a plan NOW protects your family, finances, and personal information.
□ Create a Family Digital Asset List
□ Assign Family Roles
□ Password Management
□ Backup Critical Data
NOT SURE HOW TO SET UP BACKUPS — OR WHETHER YOURS ARE ACTUALLY WORKING?
The steps above tell you what to do. But the “how” can feel overwhelming if you’ve never set it up before. Which cloud service is right for your family? How do you know if your backup actually completed? What does “test restoring from backup” mean in practice — and how do you actually do it?
The Craig AI Library answers those questions in plain language — walking you through what good backups look like for a household, how to verify they’re running, and what to check so you’re not discovering a problem for the first time during a crisis.
Explore the Craig AI Library at forwardtosafety.com
□ Update Contact Information
□ Enable Device Protection
□ Hold a Family Cyber Safety Meeting (30 minutes, quarterly)
□ Establish Family Rules
KNOWING THE RULES HELPS — UNDERSTANDING WHY MAKES THEM ACTUALLY STICK
Most families have some version of “don’t click suspicious links” as a household rule. It’s a good starting point. The challenge is that “suspicious” is hard to define when you’ve never actually seen what a convincing scam looks like.
A teenager who’s never encountered a real phishing email doesn’t have the experience to recognize one when it lands in their inbox. A grandparent who sees a familiar logo has no way of knowing it took a scammer minutes to copy it. And a parent who says “just use common sense” is giving advice that’s genuinely hard to follow without some context for what the threats actually look like.
The Craig AI Library gives your family that context — clearly, without jargon, in a way that makes sense for every age group.
Built by cybersecurity expert Craig Peterson, it explains how real scams and threats work, what they look like, and what makes them convincing — so that the rules your family follows actually connect to something they understand.
Use it to:
- Show your family what a convincing phishing email actually looks like — and what gives it away
- Help everyone understand why certain rules exist, so they’re easier to remember when it matters
- Prepare for your quarterly family safety conversations with current, real-world examples
- Answer “is this real?” or “should I click this?” questions as they come upUnderstanding turns rules into habits. Explore the Craig AI Library at forwardtosafety.com
□ Run a Family Drill (Twice Yearly)
□ Immediately investigate if you notice:
Device/Account Issues:
Financial Red Flags:
Communication Anomalies:
Physical Security:
WHAT MOST FAMILIES DON’T KNOW — AND HACKERS COUNT ON
How Legitimate Websites Get Infected Without Anyone Knowing
Here’s something that surprises almost everyone: you don’t have to visit a suspicious website to get hit by malware. You can visit a website you’ve used for years — a local news site, your child’s school portal, a favorite retailer, a recipe blog — and still get infected. Not because you did anything wrong, but because that website was quietly compromised without the owner ever knowing.
This is one of the most common — and least talked about — ways families get hurt online.
How It Happens: The Invisible Takeover
Websites are built with layers of software — plugins, themes, advertising systems, and third-party tools that all work together in the background. Hackers exploit weaknesses in any one of those layers to sneak malicious code into an otherwise legitimate site. The site continues to look and work exactly as it always has. The owner sees nothing wrong. Visitors have no idea.You Don’t Have to Click Anything Suspicious
Once malicious code is hidden inside a legitimate site, it can activate the moment the page loads — before you’ve clicked a single link. It can silently download malware onto your device, capture login credentials, or redirect you to a fake version of a page you trust, all while the real website appears completely normal.Your Favorite Sites Can Become Traps
Hackers specifically target popular, trusted websites because that’s where they find the most victims. A compromised local news site. A hacked school resource page. A poisoned ad running on a major platform. The more trustworthy the site appears, the more effective the attack — because people let their guard down on sites they recognize.The Ads Are Sometimes the Problem
Even websites that haven’t been directly hacked can unknowingly serve malicious content through their advertising. Attackers inject malware into legitimate ad networks, which then silently deliver it to visitors through ads on reputable websites. The site owner has no idea. The visitor sees a normal ad. The damage happens in the background.Why “Just Be Careful Online” Isn’t Enough Anymore
Teaching kids (and adults) to “avoid shady websites” is well-meaning but outdated advice. Today, threats come from websites everyone considers safe. Relying on how a site looks or how familiar it feels is no longer a reliable way to stay protected.Your family needs a tool-assisted check — not just good instincts.
WHEN SOMEONE IN YOUR FAMILY ISN’T SURE ABOUT A LINK — WHAT DO THEY ACTUALLY DO?
Read the section above. Now think about this: when a family member gets a link they’re unsure about — in an email, a text, a social media message — what’s their real next step?
For most families, the options are click it and find out, or skip it entirely. “Use common sense” is the usual advice — but as you just read, a website that’s been quietly compromised looks exactly like the safe version. Same name, same look, same content. There’s nothing to see that would tell you something is wrong.
The Forward To Safety Website Safety Checker gives your family a simple, practical way to check before clicking.
Anyone in your family can run a link through a quick check — the tool looks at the site’s history, reputation, security certificate, and whether it appears on any known lists of harmful sites. Takes about 10 seconds. Free with no account needed.
Paid accounts add checks across 35+ additional security sources and AI-powered review of the page content.
Build it into a family habit:
- Check any link before entering a password or payment information
- Verify a website when something about it feels a little off
- Run a quick check on sites your kids mention visiting
- When you’re not sure — it only takes a moment to checkYou can also forward anything suspicious — an email, a text, a PDF, a QR code, even a voicemail — to [email protected] for a full analysis and a verdict in less than 30 seconds.
Free to use, no account required. Try it at forwardtosafety.com/check
□ Don’t Panic — Act Methodically
□ Alert the Incident Leader immediately
□ Document everything:
For Compromised Accounts:
□ Change passwords immediately (on a DIFFERENT, clean device)
□ Enable/verify 2FA
□ Check account recovery settings (phone, email)
□ Review recent account activity
□ Log out of all devices/sessions
For Lost/Stolen Devices:
□ Use “Find My Device” to locate or lock device
□ Display a message with contact info on lock screen
□ If device cannot be recovered, initiate remote wipe
□ Contact phone carrier to suspend service
□ File police report (required for insurance claims)
For Suspected Malware:
□ Disconnect device from internet (Wi-Fi and ethernet)
□ Do NOT turn off the device (preserves evidence)
□ Isolate from other devices
□ Scan with updated antivirus on another device if possible
For Financial Fraud:
□ Call bank/credit card company IMMEDIATELY (24/7 fraud lines)
□ Request card replacement and account monitoring
□ Dispute unauthorized charges
□ Request a fraud alert or credit freeze
□ Document all fraudulent transactions
□ Create an Incident Log:
□ Check All Family Accounts:
□ Preserve Evidence:
□ Internal Notifications:
□ External Notifications:
□ Legal/Regulatory (If Applicable):
□ Secure All Accounts:
□ Clean Infected Devices:
□ Replace Compromised Hardware:
□ Monitor Financial Accounts:
□ Credit Monitoring:
□ Restore Data:
□ Update Security:
□ Ongoing Monitoring:
□ Document Costs:
FOR FAMILIES WITH A HOME BUSINESS: HAVING SOMEONE HANDLE YOUR IT IS NOT THE SAME AS HAVING CYBERSECURITY
If someone in your household runs or manages a small business, there’s a good chance they handle their own tech setup — or rely on a general IT provider who keeps things running. That covers a lot. What it often doesn’t cover is a deliberate look at cybersecurity specifically.
IT support and cybersecurity are different things. An IT provider is focused on keeping systems operational. Cybersecurity requires a different kind of attention: looking for software that hasn’t been updated and is leaving a known opening, settings that were configured incorrectly and are quietly exposing more than intended, user accounts with access that was never removed, or areas where the business doesn’t meet compliance requirements it’s expected to follow.
These things often go unnoticed — by IT providers and business owners alike — until something goes wrong and the source becomes clear in hindsight.
And when your home and business share a network, a device, or an email account, a compromise that starts personally can reach the business side faster than most people expect.
Forward To Safety Assure gives business owners a plain-language picture of where they actually stand — without needing a technical background to read it.
Assure shows you what’s going on across your business systems: software that needs updating, settings that are open when they shouldn’t be, access gaps, and where you stand against compliance requirements — with a quarterly action plan to address what matters most, using tools you already have.
If your family includes a business owner, this is worth a conversation. Learn more at forwardtosafety.com
□ What Happened?
□ What Went Well?
□ What Needs Improvement?
□ Strengthen Weak Points:
□ Revise Family Plan:
□ Schedule Next Steps:
□ Within Your Family:
□ With Your Network:
Immediate Actions:
Before clicking any link in an email — even one that looks legitimate — use the Forward To Safety Website Safety Checker at forwardtosafety.com to verify it first.
Immediate Actions:
Immediate Actions:
Immediate Actions:
Immediate Actions:
Print and Post in Visible Location
Incident Leader Name: ____ Phone: ______
Website/Notes: __________
Tech Contact Name: ____ Phone: ___
Website/Notes: __________
Forward To Safety Support: forwardtosafety.com
Primary Bank: ____ Phone: ________
Website/Notes: __________
Secondary Bank: ___ Phone: ___
Website/Notes: __________
Credit Card 1: ____ Phone: ________
Website/Notes: __________
Credit Card 2: ____ Phone: ________
Website/Notes: __________
Phone Carrier: ____ Phone: ________
Website/Notes: __________
Email Provider: ___ Phone: ________
Website/Notes: __________
Local Police (non-emergency): ___ Phone: _______
Website/Notes: __________
Insurance Agent: ___ Phone: ___
Website/Notes: __________
Equifax: 800-685-1111 | www.equifax.com
Experian: 888-397-3742 | www.experian.com
TransUnion: 800-916-8800 | www.transunion.com
FTC Identity Theft: 877-438-4338 | https://www.identitytheft.gov/
IC3 (FBI): Phone: N/A | www.ic3.gov
Set calendar reminder for the 1st of each month:
□ Update all device software/apps
□ Review bank and credit card statements
□ Check credit monitoring alerts
□ Verify backup systems are working
□ Test one device’s “Find My” feature
□ Change 2-3 passwords (rotating through accounts)
□ Review family social media privacy settings
□ Check for suspicious emails in spam/trash
□ Update emergency contact list if needed
□ Brief family on any new scams in the news
Monthly check-in tip: Most families talk about security after something happens — not before. The Craig AI Library at forwardtosafety.com covers the scams targeting families right now. Use it to make your monthly conversation specific to current threats, not just a general reminder to “be careful.”
PREPARATION IS EVERYTHING: The time to prepare is NOW, not during a crisis.
NO BLAME, JUST ACTION: Create a family culture where reporting incidents quickly is rewarded, not punished.
DOCUMENT EVERYTHING: Good records protect you legally, financially, and emotionally.
SECURITY IS A FAMILY SPORT: Everyone plays a role. Everyone stays safe.
Cyber incidents are stressful, but having a plan transforms chaos into coordinated action. Review this checklist with your family quarterly, practice your response, and update your preparations as your family’s digital life evolves.
Your family’s cybersecurity isn’t a one-time project — it’s an ongoing commitment to protecting what matters most.
You just put together a family incident response plan. Before you file it away, consider three things:
Does your family understand the threats well enough to actually recognize them — or do they know the rules without the context that makes those rules useful?
When a family member gets a link they’re not sure about, do they have a tool to check it — or just their own judgment?
If someone in your household runs a business, do they have a clear picture of their security status right now?
If any of those feel like open questions, this checklist prepares you for when something goes wrong — but it doesn’t close the gaps that let things go wrong in the first place.
That’s what a Forward To Safety subscription is for.
START YOUR FORWARD TO SAFETY SUBSCRIPTION
When something looks suspicious — an email, a text, a PDF, a QR code, a voicemail, or anything else sent through technology — forward it to [email protected] and get a detailed threat verdict in less than 30 seconds. No software to install. Works for every member of your family.
Plan Price Best For Individual $269/year One person Household $468/year Couples, roommates Family Shield $966/year Families with kids Business From $1,962/year Small businesses Subscribe now at forwardtosafety.com
Forward anything suspicious. Get a verdict in less than 30 seconds.
The core of Forward To Safety is simple: when something looks off — an email, a text, a PDF, a QR code, a voicemail, or anything else sent through technology — forward it to [email protected]. Forward To Safety runs a 6-tier analysis and tells you exactly what it found, in plain language. No software to install. Works for the whole family.
Cybersecurity education that actually makes sense.
Craig Peterson has spent decades making cybersecurity understandable for everyday people. The Craig AI Library puts that expertise at your fingertips — any time you need to understand a threat, answer a question, or prepare for your next family safety meeting.
Check any link before your family clicks it.
Run any URL through Forward To Safety’s Website Safety Checker — 10 checks across DNS, SSL, blocklists, threat feeds, and redirect chains. Free, no account required. Takes seconds. Install the bookmarklet for one-click checking on any page.
Paid accounts add 35+ security engine analysis and AI-powered page content scanning.
For family members who run or manage a small business.
Having someone handle your IT is not the same as having cybersecurity covered — and many small business owners don’t realize there’s a difference until something goes wrong. Forward To Safety Assure gives business owners a plain-language picture of where their business actually stands: software that needs updating, settings that are open when they shouldn’t be, access that was never properly removed, and compliance areas that need attention. No technical background required to read it. Quarterly reports include a clear, prioritized action plan using tools the business already owns.
Ready to protect your family?
Visit forwardtosafety.com to get started today.
Cyber incidents happen. Chaos doesn’t have to.
Brought to you by Forward To Safety — Protecting families from the threats that matter.
Join thousands of security professionals who receive Craig Peterson's Insider Show Notes and cybersecurity updates.
Tagged with:
Join 10,000+ cybersecurity professionals