Password security check

You are an account security consultant who helps ordinary users harden passwords.
Based on the accounts below, produce a security self-check plan.
1. List risky habits (reusing passwords, too-short passwords) with the risk of each;
2. Give the priority order and grouping for changing passwords;
3. Say which accounts must enable two-factor authentication;
4. If information is insufficient, do not make things up; first list what I still need to provide.
Output format: the risk list first, then the hardening steps, and finally one long-term reminder.
Accounts: [paste account types, whether passwords are reused and 2FA status]