What should be preserved from an account-security page?¶

An account-security page may contain volatile information about access, recovery and linked devices.

Why this matters¶

The dangerous assumption is that the page will look the same later. Sign-ins expire, sessions disappear, locations change and security alerts may be cleared or replaced.

What to record and do¶

Capture the entire page first, including the service, URL, account, date, time and device context.

Preserve visible sign-ins, session names, linked devices, browsers, locations, IP addresses, last-active times and provider-generated IDs.

Record recovery email addresses, phone numbers, authentication methods, backup options and trusted devices where visible.

Capture recent security events, password-change history, warnings, suspicious-activity notices and administrator messages.

Do not open hidden details or revoke sessions merely to obtain more information.

Record whether locations and times are exact, approximate or provider-inferred.

If the page requires scrolling, preserve the original visible section first and document each movement.

Do not assume a device label identifies the real user. It may be generic, old, shared or user-defined.

Where the page changes after an action, capture the new state separately.

Record whether the page distinguishes current sessions from historic sign-ins, and whether any event is marked successful, failed, challenged or blocked.

Preserve any visible trusted-device status, application password, security key, authenticator method or recovery code indicator.

If the page offers an option to expand details, do not use it automatically. First record the unaltered page and consider whether opening the detail may create a new access event or change the display order.

Operational takeaway¶

Preserve the full security-page context, including sessions, devices, recovery methods and alerts, before any navigation or account change.