How to Secure Your Gmail and Google Account
Your Google account is the key to Gmail, Google Photos, Drive, YouTube and your Android phone. It can also reset passwords for many other services. Securing it is one of the most important things you can do online.
Run the Security Checkup
Go to myaccount.google.com/security-checkup. Google checks your devices, recent security events, sign-in methods and third-party access, and shows recommended actions with yellow or red warnings.
Turn on 2-Step Verification
In Security → How you sign in to Google → 2-Step Verification, turn it on. Use Google prompts on your phone, an authenticator app, or security keys. See our 2FA guide.
Add a passkey
Passkeys let you sign in with your phone's fingerprint or screen lock, and they can't be phished. Add one in the same section. Learn more in passkeys explained.
Set recovery options
Add a recovery phone number and recovery email. Keep them up to date. They're essential if you ever lose access.
Check your devices
Under Your devices, review where you're signed in. Sign out of old phones, shared computers or anything you don't recognise.
Remove third-party access
Under Your connections to third-party apps & services, remove apps you no longer use or don't recognise.
Check Gmail settings for tampering
Hackers sometimes add hidden rules to forward your emails. In Gmail on a computer, open Settings (gear) → See all settings:
- Forwarding and POP/IMAP: remove unknown forwarding addresses.
- Filters and Blocked Addresses: delete filters you didn't create.
- Accounts: check "Send mail as" and "Grant access to your account".
Watch for alerts
Google sends security alerts for new sign-ins. Don't ignore them. If a sign-in wasn't you, secure your account immediately. Beware of fake "Google security alert" emails; check alerts directly at myaccount.google.com.
Advanced Protection
For journalists, activists or anyone at high risk, Google's Advanced Protection Program offers the strongest security.
Recognising fake Google emails
Scammers often send emails pretending to be Google security alerts. Check carefully:
- Real alerts come from
no-reply@accounts.google.com, but sender names can be faked, so don't rely on this alone. - Instead of clicking links, go directly to myaccount.google.com and check Recent security activity. If the event isn't listed there, the email was fake.
- Be suspicious of urgent threats like "your account will be deleted in 24 hours".
- Google never asks for your password by email.
If you get locked out
- Go to the Google Account recovery page and follow the steps.
- Use a device and location where you've signed in before.
- Answer questions as accurately as you can; approximate answers are better than skipping.
- Use your recovery phone or email to receive codes.
Recovery succeeds far more often when recovery options are up to date, which is why the Security Checkup matters.
Plan for the unexpected
Google's Inactive Account Manager lets you choose what happens to your account if you stop using it for a long period, such as sharing certain data with a trusted person. It's worth setting up for important accounts containing family photos and documents.
Frequently asked questions
How do I see if someone else accessed my Gmail?
At the bottom of the Gmail inbox on a computer, click Details under "Last account activity".
What if I lose my phone with 2-Step Verification?
Use backup codes or your recovery options to sign in.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
SIM Swap Scams: How Criminals Steal Your Phone Number
Learn how SIM swap fraud works, the warning signs, and how to protect your bank and accounts that rely on SMS codes.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.