Lock Down Your Gmail: A Calm, Step-by-Step Guide
Your Gmail is often the key to everything else: password resets for your bank, shopping, and social accounts usually land there. The good news is that Google has built strong protections, and turning them on takes about 20 minutes. This guide walks you through them one at a time. Take it at your own pace.
What you'll need
- About 20 minutes.
- A computer or phone where you're signed in to Gmail.
- Your phone (the one you keep with you every day).
- Optional: a second email address you use, and a trusted family member or friend for account recovery.
Tip: If your Gmail comes from work or school, some steps may not work. Your IT administrator can help (Google).
Steps
Run Google's Security Checkup. Go to your Google Account, click your profile picture, and choose Recommended actions. It gives you a personal to-do list. A green shield means you're in good shape (Google).
Why it helps: It shows you exactly what's missing on your account, so you don't have to guess.
Add a recovery phone number. In your Google Account, open Security & sign-in, then Recovery phone. Use a mobile phone that's only yours and gets texts. Google says not to use a Google Voice number here (Google).
Why it helps: If you're ever locked out, Google can send you a code to get back in, and it can alert you to suspicious activity.
Add a recovery email. In the same section, choose Recovery email. Pick an address you check regularly that isn't your Gmail (Google).
Why it helps: It's a second way back in, and a second place for security alerts.
Optional: add a recovery contact. Under Recovery contacts, invite someone you know well and trust. They don't see your alerts or your email (Google).
Why it helps: A trusted person can help confirm it's you if you lose access.
Turn on 2-Step Verification. Go to Security & sign-in, then under "How you sign in to Google," choose Turn on 2-Step Verification and follow the steps (Google).
Why it helps: Even if someone learns your password, they still need a second step only you have. The FTC and CISA both recommend this for email (FTC, CISA).
Choose Google prompts as your second step. Google recommends tapping a "Yes, it's me" prompt on your phone over text-message codes. Prompts are easier and help protect against phone-number scams like SIM swaps (Google).
Why it helps: Text codes still work, but Google notes they can be weaker than prompts or passkeys (Google). The FTC also suggests setting a PIN or password on your mobile phone account with your carrier, which helps stop someone from moving your number to their phone (FTC).
Create a passkey. Type g.co/passkeys into your browser yourself and choose Create a passkey (Google). Only set one up when you decided to, not from a link someone sent you or while someone is on the phone with you. Google will never call and ask you to approve anything (Google). You'll then sign in with your fingerprint, face, or phone PIN. Only do this on a device you own and don't share. Anyone who can unlock that device can get into your account (Google, Google).
Why it helps: Passkeys can't be copied, written down, or typed into a fake website, so they protect you from phishing. Your fingerprint or face data stays on your device.
Save backup codes somewhere safe. In your 2-Step Verification settings, print or download your backup codes. Keep them somewhere private, like with important papers. Never share them (Google).
Why it helps: If you lose your phone, a backup code still gets you in.
Check your recent activity. In your Google Account, open Security & sign-in, then Review security events. If something wasn't you, choose No, it wasn't me and follow the steps (Google). In Gmail on a computer, you can also click Details at the bottom right to see recent sign-ins (Google).
Why it helps: You'll spot anything unusual early. Note: phone carriers can show a location far from you, and that's usually normal (Google).
Review your devices. In your Google Account, go to Your devices, then Manage devices. Sign out of any device you don't recognize or no longer use (Google).
Why it helps: Old phones and shared computers can quietly stay signed in.
Remove apps you don't need. Security Checkup lists apps that can use your account info. Remove any you don't use. If you once made an "app password" for an old mail app, remove it too. Google says app passwords are usually unnecessary; use "Sign in with Google" instead (Google, Google).
Why it helps: Fewer doors into your account means fewer ways in.
Learn the signs of a phishing email. Be careful with messages that ask for passwords, codes, or bank details, or that feel urgent or too good to be true. Check that the sender's name and address match. On a computer, hover over a link to see where it really goes (Google, FTC).
Why it helps: Google will never ask for your password by email, and won't call you to ask for a code. No matter who contacts you, don't give anyone remote access to your phone or computer (FTC) (Google, Google).
Report phishing in Gmail. On a computer, open the message, click More next to Reply, then Report phishing (Google).
Why it helps: It moves the message out of your way and helps Google protect others.
Know where real Google alerts live. If a "security alert" email looks off, don't click it. Go straight to myaccount.google.com/notifications to see your real recent security activity (Google).
Why it helps: You never need to trust a link to check on your account.
Printable checklist
Good habit: repeat the Security Checkup every few months (Google).
If something looks off
- Someone calls saying they're from Google Security: Hang up. Google will never call you about your account security. Never read a code or tap Approve on a prompt while someone is on the phone. Open Security Checkup yourself to check (Google).
- You get a "Trying to sign in?" prompt you didn't expect: Tap No, don't allow, then review recent sign-in activity in your Google Account (Google).
- You see a sign-in or device you don't recognize: Change your Google password, then sign out of the unknown device (Google, Google).
- Check your Gmail settings: Look for forwarding rules, filters, or people with access ("delegation") that you didn't set up, and remove them (Google).
- You used the same password elsewhere: Change it on those sites too (Google).
- You can't sign in: Use Google's account recovery page and answer as best you can, ideally from a device and place you usually use (Google).
- A new recovery phone, passkey, or recovery change isn't working yet: Google may wait up to 7 days before fully trusting a new option. Give it time, and keep an older recovery method available meanwhile (Google).
- You shared personal or bank info with a scammer: Visit IdentityTheft.gov for next steps, and you can report it at ReportFraud.ftc.gov (FTC).
Also see: Gmail quick checklist