How to secure your Gmail account
Every password reset for every other account ends in your inbox. That makes email the account an attacker wants most, and the one worth protecting first.
The short version
- Run Google's own Security Checkup first — it finds most problems for you.
- Check forwarding and filters: that is how attackers stay in after a password change.
- Keep recovery email and phone current, or recovery becomes impossible.
- Use a passkey if you can — it cannot be phished.
Start with the Security Checkup
Open myaccount.google.com/security-checkup. Google will walk you through recent sign-ins, devices with access, third-party apps holding permissions, and any weak points it has already noticed. It takes a few minutes and does most of the audit for you, which is why it is the first step rather than a footnote.
Two-factor authentication, and preferably a passkey
Turn on 2-Step Verification at myaccount.google.com/security. Prefer a passkey or an authenticator app over SMS; passkeys are bound to Google's real domain, so a lookalike sign-in page cannot use one even if it fools you completely.
Save the backup codes Google offers. Email is the account where being locked out is worst, because it is the recovery route for everything else.
The checks almost everyone skips
Forwarding: Settings, See all settings, Forwarding and POP/IMAP. An address you do not recognise here means a copy of your mail — including password resets — is going to someone else, and it survives a password change.
Filters: Settings, Filters and Blocked Addresses. Attackers add filters that delete or archive security alerts so you never see the warnings. Delete anything you did not create.
Delegation and connected apps: check Accounts and Import for account delegates, and myaccount.google.com/permissions for third-party apps with Gmail access. Revoke anything unfamiliar or unused.
Recovery options: confirm the recovery email and phone number are yours and current. A recovery address you lost access to years ago is the reason many accounts are unrecoverable.
Advanced Protection, if you are a likely target
If you are a journalist, an activist, a business owner or anyone whose account would be worth real effort to steal, Google's Advanced Protection Program (g.co/advancedprotection) enforces hardware keys or passkeys and restricts third-party access. It is deliberately strict, and it is the strongest protection Google offers a consumer account.
Recognising a fake Google alert
Google will not ask for your password by email, and it will not ask you to "verify" your account through a link in a message. Check the domain of any sign-in page with care: accounts.google.com is real, and anything else — including a page that looks perfect inside a pop-up window — is not. You can also review every genuine security notification at myaccount.google.com/notifications.
Nothing on this site will ever ask for your password, OTP or recovery codes.
Related guides
Want this handled for you?
Our engineers do this work for businesses every day, on monitoring platforms built to catch it earlier. Describe your situation and we will tell you what would actually help.
Talk to Our Security Team