How to secure your email account (checklist)

This checklist hardens the account that protects all the others. Set aside 20 minutes and work from a computer you trust. It is part of our guide to securing your key accounts. To learn why this comes first, read why your email is the master key.

Step 1: Set a strong password

Use a generated password of 20 or more characters, stored in your password manager. If you must remember it, use a passphrase of random words. It should not be used anywhere else.

Step 2: Turn on strong two-factor login

Use the best option on offer:

1. A passkey or hardware security key.
2. An authenticator app.
3. SMS, if there is nothing else.

Gmail, Outlook, iCloud and others all have these settings under account security.

Step 3: Save your backup codes

Print them or write them down, and store them securely. Do not keep them only in your inbox. See backup codes.

Step 4: Check your recovery details

• Is the recovery email yours, and is it also secure?
• Is the recovery phone number up to date?
• Is SMS recovery weakening your strong two-factor login? See SIM swap attacks.

Step 5: Review forwarding and filters

Attackers often set up a rule that forwards your mail, or hides security alerts. Look under Settings for "Forwarding", "Filters" and "Rules", and delete anything that you do not recognize.

Step 6: Remove connected apps

Under "Third-party access" or "Connected apps", remove old or unknown services. An app with mailbox access can keep it even after you change your password.

Step 7: Check active sessions

Look through the list of devices and recent logins. Sign out anything you do not recognize, then change your password if you see a stranger.

Step 8: Reduce what is in there

• Delete old emails that contain ID scans or sensitive documents.
• Do not store passwords or recovery phrases in your inbox or drafts.
• Consider a separate address for your most important accounts.

Your email security checklist

If you find something suspicious, go to our hacked email recovery guide.