Online reputation checklist for individuals

An online reputation checklist for an individual works when it runs in a fixed order: secure the accounts you control, record what search shows today, claim what is yours, shrink the personal data that is exposed, publish pages that answer for your name, set up monitoring, and write a response plan before you need one. Every item below carries a reason and an owner, because most reputation problems stall at one point: nobody knows who is actually able to fix the thing.

Most checklists on this topic are five to nine habits, such as search yourself and tighten privacy settings. They are correct and not enough, because they never say what "done" looks like, who holds the lever, or which task comes first. A locked-down profile means little if the email account behind it can be taken over in ten minutes.

Work through the phases in order, tick an item only when its test is met, and keep the baseline you record in phase two, since later phases are measured against it. It describes general practice. Where a rule differs by country or platform, the item says so, and the help pages named were read for this guide as of its date.

The short version

Run seven phases in order: secure, record, claim, reduce exposure, publish, monitor, plan.
Every item has an owner: you, a platform, a site owner, a search engine, a lawyer or your household. Do your own items first.
Removing a result from search does not remove the page it points to. Fix the source where you can.
A first pass takes a weekend. After that, the upkeep is a few short checks on a fixed calendar.
If an item needs a legal judgment or a platform refuses twice, that is the point to hand it over, not to try harder.

Why the order matters and who owns each fix

The order is security, baseline, ownership, exposure, publishing, monitoring, response, because each phase protects the next one and the owner of each fix changes along the way. An item you own can be finished today. An item owned by a publisher or a platform can only be requested, so it needs evidence, a clear ask and patience.

Six owners appear in the tables below. Knowing which one holds the lever decides whether an item takes an hour or a month, and whether a polite message or a formal request is the right tool.

Owner	Can change	Cannot change	How you reach them
You	Your accounts, settings, domain, bio, what you publish	What others publish about you	Directly, today
Platform	Accounts and posts that break its rules	Posts that are accurate and within its rules	Report forms, appeals
Site owner	Anything on its own pages	Copies on other sites	Contact page, hosting provider, a written request
Search engine	Whether a result appears for a query	The page itself	Its removal and personal information request forms
Household	What relatives post, tag and share	Anything they do not agree to change	A direct conversation
Lawyer or court	Legal claims, orders, formal notices	Anything outside the law of the place that applies	Your own counsel

One rule runs through every table that follows, and it decides the order of most requests.

Phase 1: Secure the accounts that can be taken from you

Secure accounts first, because an account taken over under your name creates a reputation problem that no later phase can fix. Impersonation, fraudulent messages and deleted content all start with a reset email that someone else received.

Start with the email account that receives password resets, then work outward to the phone carrier, the domain registrar and the social accounts that carry your name.

Item	Why it matters	Owner	Done when
Unique password on each key account	One breach of a minor site must not open your email	You	A password manager holds a different password for email, carrier, registrar and social accounts
A second step on your email first	Email resets everything else	You	Two-step sign-in is on, with a passkey or security key where offered
Current recovery options	An old recovery number locks you out and lets an attacker in	You	Recovery phone and backup email are current on each key account
Phone number protection	A hijacked number defeats text-message codes	You, carrier	You asked your carrier what port-out or SIM protection it offers and turned it on
Third-party access review	Forgotten apps keep permission to post or read	You	Connected apps you no longer use are removed from each main account

Google's own help page describes two-step verification as an extra layer of security in case your password is stolen, and says passkeys and hardware security keys protect an account from phishing attacks. Read the equivalent page for each service you rely on, since options differ. See Google's 2-Step Verification help for the exact wording.

The carrier and registrar rows are the desk's practice, not a rule taken from a source named here. Providers differ in what they offer, so ask each one what it provides and use it where offered.

Phase 2: Record what search and AI assistants show today

Record the baseline before you change anything, because without a dated record you cannot tell whether a later change helped, hurt or did nothing. This phase produces one document and no changes.

Recording your baseline

List every name you useFull name, name with a middle initial, former or maiden name, nicknames, handles, business names and common misspellings. Each is a separate search.
Search in a neutral setupUse a private window or another device, signed out. Results vary with time, location, language, device and signed-in activity, so one search is a sample, not the truth.
Capture the first two pagesFor each result record the address, the type (your own page, platform profile, news, directory, forum, review) and who owns it.
Widen the sweepRepeat in images, video and news, then ask two or three AI assistants who you are. Note the date, the assistant and the exact wording of your question.
Label every findingMark each as keep, correct (inaccurate or outdated), outrank (accurate but unwelcome) or request removal (it breaks a policy or a law).
Save it privatelyStore the file with the date in its name. The free page one score is a quick way to get a first reading.

Google's page on why results differ names time as a major factor: "Time may be one of the biggest reasons why results vary between people." It explains that new content is added soon after publication and that ranking changes reach data centers at different speeds. Location, language and device also tend to matter, which is why the log matters more than any single look.

The label step is where most people go wrong. Treat accurate, lawful, public-interest material as something to outrank or accept, not to remove. Removal is for content that is false, unlawful or in breach of a platform's rules, and a request for anything else usually fails and can draw attention to the page.

Phase 3: Claim the accounts, domain and bio that belong to you

Claiming what is yours comes before building anything new, because an unclaimed profile on a platform that ranks for your name can be created by someone else, including a namesake or an impersonator. This phase is entirely in your hands.

Item	Why it matters	Owner	Done when
Claim the platforms that already rank	Profiles appear for name searches; an empty slot invites a fake	You	Each platform from your baseline either has your verified profile or a conscious decision not to
Register your name as a domain	A domain you hold cannot be suspended by a platform	You, registrar	Auto-renewal is on, the registrar account follows phase 1, and contact details are hidden where the registrar offers it
One factual bio, three lengths	Search engines and AI assistants draw on several sources; mismatches can create doubt	You	A one-line, a paragraph and a long version agree on role, place and dates
Close dormant accounts	Old profiles rank, leak details and get hijacked unnoticed	You, platform	Every account on your list is either active, locked down or deleted
Set visibility on purpose	A default setting is not a decision	You	Each account is public for a reason or limited for a reason
Untag and ask	Old photos and tags sit under your name	You, then the poster	You removed what you can and sent a short, polite request for the rest

Build the account list from your inbox: search it for "welcome", "verify your email" and "confirm your account". It surfaces forgotten profiles. If a platform will not delete one, remove the personal details and set the strictest visibility it allows.

Phase 4: Reduce the personal data that is exposed

Reducing exposure matters because contact details and identifiers are what turn an unflattering result into a harmful one. This phase is mostly requests to third parties, so keep a log with the date, the recipient and the outcome of each.

Item	Why it matters	Owner	Done when
Set up Google's Results about you	It finds results that show your contact details and lets you ask for their removal	You, search engine	Your details are entered, notifications are on and the "To review" tab is empty or each item is marked
Search for your address, phone and email	Directories and people-search sites republish them	Site owner	Each listing has an opt-out or removal request, logged with a date
Read the public registers that name you	Company, property and professional registers can be lawful and searchable	Register office	You know which entries are public by law and which options your jurisdiction offers to limit them
Check what your photos reveal	Location data and backgrounds expose where you live or work	You	Location tagging is off by default and you checked what you post
Agree rules with relatives	Family accounts publish your details and your children's	Household	You agreed what is tagged, named and located, and you wrote it down

Google's help page for the tool says it checks whether personal information such as a home address, phone number or email address shows up in search results, and that you can opt in to email notifications. It also says some features are rolling out for users over 18 in certain markets, that Google treats some results, such as government, educational, newspaper or business pages, as valuable to the public and may not remove them, and that removing a result does not remove the information from the source page. Read the help page for the tool before relying on it, since availability and scope can change.

For a people-search site or data broker, the route in the desk's practice is that company's own opt-out. No source is named here for it, and any legal right to deletion depends on where you live.

Phase 5: Publish the pages that should answer for your name

Publishing is the fifth phase and not the first, because new pages only help when the accounts under them are secure and the facts on them are settled. The aim is a small set of accurate pages that agree with each other, not a large volume of content.

Item	Why it matters	Owner	Done when
One home page for your name	Gives search engines and AI assistants one description to quote	You	Name, role, location, short bio and links to your real profiles on one page you control
Link home page and profiles both ways	Reciprocal links help connect separate pages to one person	You	Each main profile links to the home page, and the home page links back
Correct third-party bios	Employer, event and directory pages often rank above your own	Site owner	Each wrong fact has a correction request with a source attached
Publish a piece of work on a schedule	Dated, accurate material keeps the results current	You, publisher	One item per quarter goes out under your name, such as a talk, article or project note

The method behind an owned page is covered on the personal brand page. Two limits apply. New pages move results only over weeks or months, and rarely those far ahead of yours. And shortcuts such as fake profiles, purchased links or invented reviews break platform rules and tend to produce a worse second story than the first.

Phase 6: Set up monitoring you will actually read

Monitoring is worth doing only if a named person reads the alerts, since an inbox filter that nobody opens is a log that nobody will see. Set up three layers, each of which catches what the others miss.

The first layer is Google Alerts, set up for each name variant from your baseline, typically in quotation marks as the desk's practice. Google's help page lists these options: how often you get alerts, the types of sites, the language, the region, how many results you see and which account receives them. It says alerts are emailed when new matching results appear in Google Search, so they only reflect what Google finds. The Google Alerts help page covers the setup.

The second layer is the notification setting inside Results about you from phase four, which watches for contact details rather than for your name.

The third layer is manual: the dated baseline search from phase two, repeated on a calendar, including the question you asked the AI assistants. A person who needs a watched feed rather than a self-run one can use the reputation monitoring service.

Alerts show what is indexed, not what is said. Private groups, messaging apps and posts behind a login do not appear in search, so a good setup tells you when something reaches search and leaves the rest to people you trust.

Phase 7: Write the response plan before you need it

A response plan is the last phase and the one that saves the most time, because the worst hours of a problem are spent deciding who to call. Write it while nothing is wrong. It needs four parts: an evidence folder, a named backup, a decision table for the common findings, and a rule about what you will not do.

Keep the evidence folder in a place you can reach if your email is locked. For each problem save a dated screenshot, the full address of the page and the account that posted it, since a page can be deleted before you can prove what it said. Name one trusted person who can act if you are unreachable, and note a lawyer you would call if one is relevant, since contact details are hard to find at the wrong moment.

Finding	Owner	First move	Avoid
A wrong fact on a third-party page	Site owner	Send a short correction request with a source	A public argument with the publisher
Your contact details exposed	Search engine, site owner	Results about you request, then the source site's removal route	Assuming that a removed result means a removed page
An account impersonating you	Platform	Report as impersonation with proof of identity	Contacting the impersonator
Private or intimate images posted	Platform, specialist	Preserve evidence, then use the leak removal route	Reposting to prove the point
A false statement that may be defamatory	Lawyer	Document it and take advice on the law that applies where you live	A counter-post that repeats the claim
Accurate but unflattering coverage	You	Decide whether to respond, add context, or outrank it with accurate pages	Pressing for removal of lawful reporting

If a problem spreads fast, the decisions change from days to hours, and the crisis management page explains how an urgent file is run. Your own rule list should include what you will not do, for example: no fake reviews, no pressure on a journalist or a complainant, no deleted posts before you have saved them.

A calendar that keeps the checklist alive

The checklist stays useful only if it recurs, so assign each item a rhythm. A first pass usually fills a weekend, and the upkeep afterward is a few short checks. The table gives a realistic first ninety days, with the output of each stage.

When	Work	Output
Week 1	Phases 1 and 2	Secured accounts and a dated baseline
Weeks 2 to 3	Phases 3 and 4	Account list, claimed profiles, a request log
Weeks 4 to 6	Phase 5	A home page, a bio and corrected third-party entries
Week 7	Phases 6 and 7	Alerts running, response plan written
Week 12	Repeat the baseline search	The first comparison with your record

After the first ninety days, keep a light rhythm. Monthly: skim the alerts and the Results about you review tab. Quarterly: repeat the baseline search, ask the AI assistants the same question again and compare the answers with the last record. Yearly: repeat phase one, check the domain renewal, update the bio and re-read the account list. Run the relevant phase early after any change of job, address or name, any new public role, or any incident.

The minimum version for one hour, and when to stop doing it yourself

If you only have an hour, spend it where the damage is largest and the effort smallest. Spend ten minutes on two-step sign-in and a unique password for your email. Spend twenty on one neutral search of your main name and a note of the first page. Use ten to claim the one profile that ranks for your name and is not yours yet, ten to switch on Alerts and Results about you, and ten to note who you would call and where evidence would go.

The minimum version is a floor, not a plan. It leaves open the exposure work in phase four and the owned page in phase five, which are the parts that change what a stranger finds.

Phases one to three and most of phase six are realistic to do yourself. Phases four, five and seven are where outside help earns its place, and a careful provider tells you which items are yours and which will not work.

Start this week: the first three items

Pick three items today and tick them before the weekend: put two-step sign-in on your email, record one neutral search of your name with the date, and turn on Results about you if it is available where you live. Those three give you security, a baseline and an early warning, and none of them depends on anyone else.

If you want the baseline done for you

Reputation Partners can run phases two and four as a private review of your name across search engines and AI assistants, with a written plan at the end. Start with the private audit.

Questions people ask

How often should an individual check their online reputation?

A short check every month and a full repeat of the baseline every quarter suits most people. Run it early after a job change, a move, a name change or any public attention. Someone with no public role can stretch the quarterly check to twice a year if the alerts stay on.

Does this checklist work if I share my name with many people?

Yes, with one change. In the baseline, record which results are about you, which belong to a namesake and which are mixed. Then lean on phase five: a home page that states your profession, place and links makes it easier for search engines and AI assistants to separate you from the others.

Should I delete my old social accounts or just make them private?

Delete accounts you will never use again, since a deleted account cannot be hijacked or leak. Keep and lock down an account if it holds something you cannot recreate, such as a long thread or a verified handle. Download your data first, and note the date you closed each one in your account list.

Does a private profile protect my reputation?

A private profile limits who sees new posts, but it does not change what is already indexed elsewhere, what others post about you, or what a screenshot carries out. Treat privacy settings as one layer of phase three, not a replacement for the baseline, the exposure work or monitoring.

What if a result about me is true but unflattering?

Accurate, lawful reporting is usually not removable, and a request to remove it can draw more attention. Choose between three paths: respond with context where that helps, add accurate material that answers the same query, or accept it. Which is right depends on how prominent the result is and who is reading it.