The most common order is still A+ first, then Network+, then Security+. That sequence works because it mirrors how technical understanding usually builds: devices and operating systems first, networking second, security third.
If you need more runway, ITF+ can come before A+. If your goal is deeper security analysis, CySA+ can come after Security+. If your goal shifts toward cloud, AZ-900 becomes a cleaner next move once A+ or Network+ has given you basic IT structure.
The biggest mistake is skipping fundamentals because security or cloud sounds more exciting. Foundations usually make those later exams easier, not slower.