Remove the outside tools that still have access to your organization's accounts but no longer do anything for you. This takes about twenty minutes and needs no technical skill. It is the last Saturday task of Security Month, and it closes a door most people do not know is open.
Why it matters: every time someone clicks "Sign in with Google" or "Connect your Facebook page" on a scheduling tool, a quiz app, or an analytics service, that tool receives a key to the account. The key keeps working after the password changes, and after the person who connected it has left. If that tool is ever breached or abandoned, the key can be used to post, read, or send as your organization without anyone touching the password. Hijacked social accounts often start exactly this way. Since it is Halloween, think of these as the zombie apps: nobody uses them, nobody remembers them, and they still have a key to the building.
Do this
Open the security settings of the organization's main email account (Google Workspace or Microsoft 365) and find the list of third-party or connected apps.
Do the same on each social account the organization runs. Look in settings for "apps and websites," "connected apps," or "business integrations."
If the website runs WordPress, check the users list for accounts created by plugins or past vendors, and any "application passwords" listed under each user.
For every entry, ask one question: does someone here use this, today, on purpose? If not, remove it. If you are unsure, remove it anyway; anyone who truly needs it can reconnect in two minutes.
Write the survivors in your inventory: the tool, the account it connects to, and who uses it.
Done looks like a short, dated list of the connected apps you kept, with an owner beside each one, and a longer list of the ones you removed.
Expect to find at least one tool from a campaign three years ago and one connected by someone who no longer works there. That is normal. Those are exactly the keys this check exists to collect.
Get one quick win like this every Saturday, plus the week's roundup the same day, with the weekly Web Managers letter. A free account at https://webmanagers.com/register signs you up and includes the chapter worksheets.