How to Secure Your Email Account Beyond a Strong Password
Protect an email account with multi-factor authentication, recovery checks, device review, forwarding rules, and a plan for suspicious activity.
Your inbox is often the key to everything else
Email is more than a place for messages. It may receive password reset links, invoices, travel details, work documents, and notices from services you use. If someone controls it, they can often take over other accounts even when those accounts have different passwords. Securing email deserves more attention than simply choosing a long password.
Start with a unique password that you do not use anywhere else. A password manager can create and store one that is difficult to guess. Then turn on multi-factor authentication, preferably with an authenticator app or security key when your provider supports it. Text messages are better than no second factor, but they can be exposed through phone-number attacks.
Review the quiet settings
Open the account security page and inspect signed-in devices, recent activity, connected applications, recovery addresses, and phone numbers. Remove devices you no longer recognize or use. Check mail forwarding and filter rules as well. An attacker may create a rule that silently sends messages to another address or hides security warnings.
- Use a separate recovery address with its own protection.
- Store backup codes somewhere safe and reachable when your phone is unavailable.
- Remove old third-party apps that no longer need inbox access.
- Check forwarding, filters, automatic replies, and delegated access.
Know what to do when something feels wrong
Unexpected password resets, unfamiliar sign-ins, missing messages, and new forwarding rules are useful warning signs. Change the email password from a trusted device, end other sessions, remove unknown access, and check recovery details. Then change passwords on important accounts that used the email address for recovery. Save evidence before deleting suspicious messages if you may need provider support.
Account security works best as a short routine. Review the account every few months, especially after changing phones or leaving a job. A few minutes of maintenance can protect the digital accounts that depend on your inbox.