How to Secure Your Email Account Step by Step
Your email is the key to your other accounts. A step-by-step checklist to secure it: a strong unique password, two-step verification, recovery details, sessions, forwarding and connected apps.
If someone gets into your email, they can reset the passwords of your bank, social media, shopping and cloud accounts, read years of private messages, and impersonate you to your contacts. That makes your email account the most important one to protect. This checklist takes about 20 minutes and works for any major email provider.
The checklist
1. Use a strong, unique password
A long passphrase or a password generated by a password manager, used nowhere else. See how long a password should be.
2. Turn on two-step verification
Use an authenticator app, passkey or security key if you can; text codes if not. The UK's National Cyber Security Centre calls this one of the most important things you can do. See what is two-step verification.
3. Check your recovery details
Make sure the recovery phone number and email are yours and up to date. Remove old numbers you no longer use. See email recovery settings explained.
4. Save backup codes
Keep them in your password manager or printed at home. See backup codes.
5. Review devices and sessions
Look at the list of devices and places signed in. Sign out of anything you do not recognise. See checking email sessions and connected apps.
6. Check forwarding and filters
Attackers add hidden rules that forward your mail or delete security alerts. Remove any you did not create. See malicious email rules.
7. Review connected apps
Remove third-party apps and services you no longer use or do not recognise.
8. Turn on security alerts
Make sure sign-in and security notifications are enabled, and read them when they arrive.
Where to find these settings: look for "Security", "Sign-in and security" or "Account settings" in your email provider's account page, which you reach by signing in yourself, not through a link in an email.
Everyday habits
- Never share codes from your email provider with anyone.
- Be suspicious of emails asking you to "verify" or "upgrade" your mailbox.
- Sign out on shared or public computers.
- Keep your phone and computer updated.
Signs something is wrong
Unexpected password resets, messages you did not send, missing emails or unfamiliar sign-in alerts. See signs your email has been hacked, and if you are locked out, how to recover a hacked email account.
Received a "mailbox full" or "verify your account" email? Paste it into CyberWatch AI Scan for a free check.
Your email is at the centre of identity theft and account security. Read the complete guide for the rest.
Frequently asked questions
What is the most important step to secure my email?
A unique password plus two-step verification. Together they stop the vast majority of account takeovers.
How often should I review my email security settings?
A quick check every three months is a good habit, and always after a suspicious sign-in alert or data breach.
Do I need to secure old email addresses too?
Yes, if they are still linked to other accounts. Secure them or move those accounts to your main address and close the old one.
Sources
- Activate 2-step verification on your email, UK National Cyber Security Centre
- Turn on 2-Step Verification, Google Account Help
- How To Recover Your Hacked Email or Social Media Account, US Federal Trade Commission
