How to Secure Your Email Account

Email is the most important account you own from a security perspective, and almost certainly the most vulnerable. It’s the recovery destination for every other account — your bank, cloud storage, social media, and password manager registration. Anyone who controls your email can reset and take over virtually everything else. Yet most people give their email account less security thought than their phone lock screen. If you want the full context, see our Complete Guide to Online Security and Privacy.

Securing your email account requires addressing four independent layers: the password, the 2FA method, the account recovery options, and the access controls (connected apps, active sessions, forwarding rules). You can secure one layer while leaving another completely exposed.

A strong, unique, memorable password

The email password must be strong enough to resist brute force, unique enough that a breach of any other service doesn’t expose the email login, and — uniquely for email — memorisable without relying on the password manager. If the password manager becomes inaccessible, email is typically the recovery path for the password manager account itself. A Diceware passphrase of five to six random words satisfies all three requirements.

Change the email password if any of these apply:

• It matches any password used on any other account
• It has ever been typed on a device you don’t fully control
• You can’t remember the last time you changed it

Check the specific password (not the email address) at Have I Been Pwned’s password checker — if it appears in breach databases, change it immediately regardless of which account it was originally associated with.

The recovery email address and recovery phone number on your account are secondary attack surfaces. An attacker who compromises the recovery email can reset the primary email’s password. An attacker who controls the recovery phone through a SIM swap can bypass SMS verification. The recovery email should have its own strong password and 2FA; the recovery phone should be a VoIP number that can’t be SIM-swapped rather than a mobile carrier number.

• Gmail: myaccount.google.com → Security → Ways we can verify it’s you
• Outlook/Microsoft: account.microsoft.com → Security → Update my info

Two-factor authentication — method matters significantly

SMS-based 2FA — a code sent to your phone number — is vulnerable to SIM swap attacks. For an account as valuable as email, SMS 2FA is meaningfully better than no 2FA but not sufficient for robust security.

Recommended 2FA setup for email:

1. Primary method: authenticator app (Google Authenticator, Authy, Microsoft Authenticator) — generates codes on the device without carrier involvement, eliminating SIM swap risk
2. Secondary method: backup codes — stored in password manager and physically printed, stored securely. Configure these before you ever lose access to the primary 2FA method.
3. Optional enhancement: FIDO2 hardware key (YubiKey, Google Titan Key) — cryptographically verifies the site’s identity before completing authentication, making it phishing-resistant as well as SIM-swap-resistant. The strongest available option for the account worth protecting most.

Verify the 2FA setup immediately after configuring it: log out, then log back in using the authenticator code. Confirming it works under a deliberate test is far better than discovering a configuration problem when locked out under real conditions.

Reviewing access and activity — the often-missed layer

Third-party applications with OAuth access to your email are one of the largest but least visible security exposures. Any app you connected through “Sign in with Google” or “Sign in with Microsoft” has ongoing access to your email — sometimes including reading all messages, accessing contacts, and sending on your behalf — that persists indefinitely after a single use.

Review and revoke quarterly:

• Gmail: myaccount.google.com/permissions — shows every app with access and what access level they have. Revoke any app you don’t recognise or no longer use.
• Microsoft/Outlook: account.microsoft.com → Privacy → App access

Email forwarding rules are the other persistent access mechanism that survives password changes. An attacker who briefly accessed your account may have created a forwarding rule that silently copies every incoming email to an external address — meaning they continue receiving your emails even after you regain control and change the password.

• Gmail: Settings → See all settings → Forwarding and POP/IMAP → confirm no forwarding is configured
• Outlook: Settings → Mail → Forwarding — confirm off, and check Rules for any that forward to external addresses

Active sessions show all devices and locations currently logged into the account. Review and end any sessions from unfamiliar devices or locations:

• Gmail: scroll to the bottom of the inbox → “Last account activity” → “Details” → shows all active sessions
• Microsoft: account.microsoft.com → Security → Review activity

Phishing and social engineering protection

The goal of most phishing attacks is to gain access to email specifically. Every phishing prevention habit applies with doubled intensity to the email account:

• Treat every email claiming you need to log in to verify your account, update payment information, or confirm a delivery as suspicious — navigate directly to the service’s official website, don’t click the link
• Your email provider will never ask for your password in an email
• Legitimate security alerts arrive from specific verified domains — configure a Gmail filter for “from:accounts.google.com OR from:google.com” → Star it → Never send to Spam, ensuring security notifications are always visible even during inbox flooding attacks

Inbox bombing is worth understanding: attackers sometimes deliberately flood an inbox with thousands of spam messages to bury legitimate security alert emails in noise — account access notifications, password reset confirmations, new device sign-in alerts. Configure spam filters at the highest sensitivity level and set up a priority inbox or label for security-related emails from your provider and financial services that is checked regardless of overall inbox volume.

Our guides on avoiding phishing scams and checking if your email was hacked cover the diagnostic steps for detecting compromise and the specific phishing patterns targeting email accounts. For end-to-end encrypted email for communications requiring content confidentiality beyond what standard email provides, ProtonMail’s security documentation covers their encryption implementation and threat model.

Ongoing monitoring and maintenance

Configure security alerts for your account to provide real-time notification of unusual access:

• Gmail: myaccount.google.com → Security → Security alerts → ensure “New device sign-in alerts” are enabled. The alert email must be sent to a secondary email address that is also properly secured — otherwise the alert is self-defeating.
• Microsoft: account.microsoft.com → Security → Security alerts → enable notifications for password changes, 2FA changes, and sign-ins from new locations

Check the account activity log quarterly. Look for sign-ins from unfamiliar locations, operating systems you don’t use, or times when you weren’t actively using the account. A sign-in from a country you’ve never visited is the most definitive signal of compromise.

An annual email security review (30 minutes) covers:

1. Rotate the email password using the Diceware method
2. Regenerate fresh backup codes
3. Review all connected applications and revoke any added in the past year that are no longer used
4. Check forwarding rules and active sessions
5. Verify that security alert notifications are still configured and going to an address you actively check
6. Review the past year’s account activity log for anything anomalous

Security layer	Gmail path	Outlook/Microsoft path	Frequency
Password	myaccount.google.com → Security → Password	account.microsoft.com → Security → Password	Annually or after compromise
2FA methods	myaccount.google.com → Security → 2-Step Verification	account.microsoft.com → Security → Advanced security options	Review annually; update backup codes
Connected apps	myaccount.google.com/permissions	account.microsoft.com → Privacy → App access	Quarterly
Forwarding rules	Gmail Settings → Forwarding and POP/IMAP	Outlook Settings → Mail → Forwarding	Quarterly
Active sessions	Gmail inbox → Last account activity → Details	account.microsoft.com → Security → Review activity	Monthly
Security alerts	myaccount.google.com → Security → Security alerts	account.microsoft.com → Security → Security alerts	Verify active monthly

Email account security is the single highest-leverage security investment most people can make, precisely because email is the recovery hub for every other account and therefore the highest-value target for anyone seeking maximum access from minimum effort. The four-layer approach — password, 2FA, access controls, and monitoring — is the comprehensive protection that a single attack vector this important deserves.

The email client security layer

The email client you use to access the account introduces additional security considerations beyond the account itself. A compromised email client application — particularly outdated versions of Outlook or third-party email clients without recent security updates — can intercept credentials or expose emails even when the account is correctly secured.

• Keep the email client updated — this is especially relevant for desktop Outlook, which has historically been a significant attack surface for malicious email attachment exploits
• Use the web interface (mail.google.com, outlook.com) for security-critical actions: changing passwords, reviewing security settings, responding to security alerts. The web interface benefits from Google’s and Microsoft’s continuous security monitoring in ways that desktop clients may not.
• Enable email client security features: Outlook’s Protected View mode for attachments, Gmail’s external image blocking (Gmail Settings → General → External images → Ask before displaying)

IMAP/POP3 app passwords deserve specific attention. If you’ve connected a third-party email client that doesn’t support OAuth (using your username and password directly rather than a token), that application-specific password is a potential vulnerability if the client is compromised. Review and revoke app passwords for clients you no longer use:

• Gmail: myaccount.google.com → Security → App passwords (only visible if 2FA is enabled)
• Microsoft: account.microsoft.com → Security → App passwords

Encrypted email for sensitive content

Standard email is not encrypted in transit between email servers in all configurations, and the email provider can read message content at rest. For most email, this is an acceptable trade-off. For communications requiring content confidentiality — legal matters, medical information, financial details, protected business communications — end-to-end encryption provides meaningful additional protection.

Options for encrypted email:

• ProtonMail (now Proton Mail): automatically end-to-end encrypts messages between ProtonMail accounts. Messages to non-ProtonMail recipients can be sent with password protection. The provider cannot read message content — the encryption happens at the device level.
• Tutanota: similar model to ProtonMail, open-source client, end-to-end encryption between Tutanota accounts with password-protected emails to external recipients.
• PGP/GPG with standard email: encrypts messages using recipient public keys, works with any email provider. More technically demanding to set up than dedicated encrypted email providers, but works with existing Gmail or Outlook addresses.

For most people, securing the standard email account with the four layers described in this guide — strong password, authenticator app 2FA, quarterly access review, and active monitoring — provides the protection appropriate for the threat level email accounts face in practice. Encrypted email is an additional layer for specific communications rather than a replacement for standard email account security.

What to do if your email is compromised right now

If you believe your email account has been accessed without your permission — unfamiliar sent messages, unexpected forwarding rules, password reset emails for accounts you didn’t request, friends reporting strange emails from you — the priority sequence: You might also run into Secure Home Office Setup.

1. Regain account access if locked out: use the official recovery process (accounts.google.com/signin/recovery for Gmail; account.live.com/acsr for Microsoft). Don’t click recovery links from emails received during the compromise — verify URLs manually.
2. Change the password immediately using the Diceware method if not locked out
3. End all active sessions except the current one — this removes any session tokens the attacker may be using
4. Enable 2FA if it wasn’t already active
5. Remove all unrecognised forwarding rules and revoke unrecognised connected applications
6. Change passwords on accounts using this email as the recovery address — specifically financial accounts, cloud storage, and the password manager registration email

Speed matters. An attacker with access to your email has the ability to reset passwords on every linked account — the longer access continues, the more damage can be done through the cascade of resets enabled by email control. Related: Secure Password Reset.