How to Secure Your Email Account: A 15-Minute Checklist

By the MailGenerator Team · Updated November 8, 2026

Your main email account is the master key to your online life. Almost every other account, from banking to social media, lets you reset its password by email. Whoever controls your inbox can take over the rest. The good news: securing it takes about fifteen minutes, and you only have to do it once.

Do these steps for your primary email, the one your bank and important accounts use. Gmail and Outlook.com both keep these settings on a single security page in your account settings (Google Account → Security; Microsoft account → Security).

1. Use a long, unique password (2 minutes)

Your email password should not be used anywhere else, ever. If any site where you reused it gets breached, attackers will try it on your email first. A good password is long rather than complicated: four or five random words, or a random string generated by a password manager.

2. Turn on two-factor authentication or passkeys (5 minutes)

This is the single most effective step. Even if your password leaks, an attacker can't sign in without the second factor.

• Best: a passkey, stored on your phone or computer and unlocked with your fingerprint, face or PIN. Google and Microsoft both support passkeys. They can't be phished because they only work on the real website.
• Very good: an authenticator app or the provider's own sign-in prompts on your phone.
• Acceptable: text-message codes. Better than nothing, but vulnerable if someone convinces your phone carrier to move your number to their SIM.

3. Save your backup codes (1 minute)

When you turn on 2FA, you can generate one-time backup codes. Print them or save them in your password manager. They're how you get back in if you lose your phone.

4. Check recovery email and phone (2 minutes)

Make sure the recovery phone number and recovery email are yours and current. An attacker who adds their own recovery details can lock you out later. Never use a temporary or disposable address as a recovery email; it will expire, and your recovery route goes with it.

5. Review signed-in devices (2 minutes)

Look at the list of devices and recent sign-ins. Sign out anything you don't recognise: old phones, a friend's laptop, a library computer. If you see a sign-in from a place you've never been, change your password immediately after signing out all other sessions.

6. Check forwarding and filters (2 minutes)

A favourite attacker trick is to quietly add a rule that forwards copies of your mail elsewhere or deletes security alerts. In your email settings, check:

• Forwarding: should be off, or only go to addresses you set up yourself.
• Filters / rules: nothing that deletes, archives or forwards mail you didn't intend.

7. Remove apps you don't use (1 minute)

Over the years you may have given apps permission to read your email or calendar. In your account's third-party connections or apps with access page, remove anything you don't recognise or no longer use.

Ongoing habits

• Be wary of sign-in prompts you didn't trigger. If your phone asks "Is this you trying to sign in?" and it isn't, tap no and change your password.
• Never share a verification code. No real company will call or message you asking for the code they just sent.
• Learn the signs of phishing. Most account takeovers start with a fake sign-in page. Our guide How to Spot a Phishing Email covers the ten most common signs.
• Keep your real address off low-value sites. The fewer places hold your main address, the less it appears in breaches and spam lists. Use a temporary email for one-time sign-ups and an email alias for accounts you keep.
• Get breach alerts. If your address shows up in a leak, follow our data breach checklist.

If you think your email is already compromised

1. Use your provider's official account recovery page to regain access if you're locked out.
2. Change the password and sign out all other sessions.
3. Remove unknown recovery details, forwarding rules, filters and connected apps.
4. Turn on 2FA if it wasn't on.
5. Change passwords on important accounts that use this email, starting with banking.
6. Tell your contacts, since attackers often send scams from hijacked accounts.

Frequently asked questions

Is SMS two-factor really that risky?

For most people it's a big improvement over a password alone. If you're a likely target (you hold cryptocurrency, run a business, or have a public profile), switch to passkeys or an authenticator app.

Do I need to change my password regularly?

Not if it's long, unique and not involved in a breach. Change it immediately if you suspect any compromise.