What are the top 3 most important things? Password security, 2FA, what would be third
That's an exhaustive list and more than most people will read, but it's got some good content. Looking forward to someone replying with a simpler version that we can pass on to friends who type google into the chrome address bar.
A longer one that I recommend (as well as EFF’s SSD): https://hackblossom.org/cybersecurity/
When they check emails, they should always double check who is sending it. One common question I get asked - "Is this email legit?", where the email claims to be Microsoft, Google, etc. saying they _need_ to click this link to do X for their account.