How to secure your main email account

Before you change anything

Use a device you trust with current system and browser updates. Open your email provider's official app or a saved address you already trust, not a link in an unexpected warning. If you need practice choosing that route, try the free safe-browsing lesson.

Keep a working session open, but understand that security changes may require you to sign in again. Confirm you can use your existing sign-in and recovery methods before changing them. For a work or school account, follow your IT team's instructions instead of replacing organization-managed settings.

Already seeing activity you did not authorize? Use the provider's compromised-account process now. If you shared a password, code or account permission through a suspicious message, start with the scam-link account-response steps rather than treating this as ordinary maintenance.

1. Review access before adding another lock

Find the provider's account-security page. Review recent security events, signed-in devices, recovery details and connected apps. In the mailbox settings, also check forwarding, rules and delegated access where available. A changed password alone is not a substitute for checking who or what can still read your mail.

Investigate an entry you cannot explain using the provider's guidance; do not blindly remove every connection. An old mail app may be familiar, while an unfamiliar forwarding destination deserves prompt attention. For Google accounts, the official account-security review identifies the settings to inspect and the route for reporting unauthorized activity.

2. Use a unique password or a supported passkey

If your account uses a password, replace one that is reused, weak or exposed with a strong, unique password. Save it in a trusted password manager under the correct account and website. You can compare recovery and device support with the password-manager worksheet; buying another tool is not the first step. Google's security checklist explains unique passwords and keeping account devices updated.

A supported passkey lets you approve sign-in through a device unlock or security key instead of typing a reusable password. Do not add a password to an already passwordless account just to follow this guide. Create passkeys only on personal devices you control, and check where they are stored and how you would recover access. Adding one does not necessarily remove the account's other sign-in methods. See Google's passkey requirements and shared-device warnings; other providers may work differently.

3. Strengthen sign-in without removing your way back

For password sign-in, look for two-factor authentication, two-step verification or MFA. Prefer a supported passkey or security key where practical. An authenticator app is another option; its codes can still be stolen by a convincing phishing page. Never approve an unexpected sign-in prompt or give a helper a verification code.

Text-message verification is better than password-only sign-in when that is the available option, but it has additional risks, including phone-number takeover. Do not switch off working protection before a replacement is set up and tested. Follow the provider's instructions for retiring an old method afterward. The FTC compares authentication methods. Microsoft users should check its current two-step-verification guidance, including recovery requirements and changing SMS availability.

4. Make recovery independent of one phone

Confirm that recovery addresses and numbers still belong to you. Ask: if this phone disappeared, could I reach the recovery inbox, unlock my password manager and find the provider's recovery instructions? A second inbox helps only if you can access it without the same missing phone. Protect that inbox too.

If your provider offers backup or recovery codes, follow its storage instructions and keep them private somewhere you can reach without the protected account. These are secrets, not ordinary notes. Google's backup codes are single-use, and generating a replacement set invalidates the old set. Microsoft's recovery code has different handling instructions; a new code replaces the previous one. Do not assume one provider's format or procedure applies everywhere.

Recovery changes can have waiting periods. For example, Google's recovery-options guidance describes delays and account-specific limits. Check the displayed status before relying on a newly added method.

5. Verify carefully, then record what remains

After a change, check its confirmation in the official settings and try a fresh sign-in on another trusted device or a separate supported browser session. Do not sign out everywhere, erase your phone or remove your only working method to simulate a failure. Private browsing does not make an unsafe device trustworthy; some passkey setups do not work there. Use the provider's supported alternative if necessary.

If the test fails, stop guessing and consult official guidance while you still have access. If it succeeds, sign out of the test session, then close it. Make a private note of the review date, the methods checked, where recovery materials are kept and anything unresolved. Record locations, not passwords or codes. Revisit the plan when devices, phone numbers or recovery contacts change.

You can finish with one unanswered question rather than forcing an unfamiliar change. Never send GNS passwords, verification codes, recovery codes or account screenshots containing secrets. For guided practice, preview the account-protection chapter and MFA chapter. The free risk check can help choose your next everyday improvement; it does not inspect your inbox.