The five minute account audit every creator keeps putting off

Nobody gets into this because they were excited about password managers. You got into it because you wanted to make something, and then discovered that being a creator quietly came with a second job nobody mentioned at the interview: account security.

Here is the version I wish someone had handed me. It takes about five minutes, it is deeply unglamorous, and it prevents most of the things that actually go wrong.

The account security jobs, in order of how much trouble they save you

Almost every creator horror story I have heard started somewhere very boring. A password reused from an old forum. A recovery email that was also the family Gmail. Or a photo with the road name sitting in the file. None of it was clever hacking. It was just a small gap that stayed open.

1. Two email addresses, not one

One for the platforms you post on. A second, never shared anywhere, for account recovery and payouts. The second one is the important half, because it is the address someone would need to take an account off you, and if it is also the address on your Amazon deliveries then it is not really a secret.

2. A password manager, and unique passwords

This is the one people skip because it feels like a project. It is twenty minutes once, and then never again. The point is not that your password is clever. The point is that when some unrelated site gets breached, and it will, the leak does not also hand somebody your OnlyFans.

3. Two factor authentication, app based

Turn it on everywhere that offers it. Prefer an authenticator app over text messages, which is also what the UK’s National Cyber Security Centre recommends. SIM swapping is not a film plot, it is a thing that happens to people with public profiles and money attached to their name.

4. Check what your photos are saying

Cameras write data into image files. Device, time, and very often the exact spot you were standing. Some platforms strip it, plenty do not, and anything you send directly to a buyer almost certainly keeps it.

5. One page that lists your real creator accounts

Impersonators are common and they cost you money, which makes this part of creator account security too. Having a single page you control, listing every genuine account, gives people somewhere to check. It is half the reason my own homepage exists.

What account security cannot do

None of the above stops somebody who has already bought your content from reposting it. That is a different problem with a different answer, and pretending otherwise would be daft.

Do it badly rather than not at all

If you only do one thing for your creator account security today, do the second email address. It is the one that turns a bad day into a very bad month when it is missing, and it takes about ninety seconds to set up.

The rest will still be there tomorrow. So will I, probably complaining about my eyeliner.