Home · Email · Last reviewed 2026-10-26

Gmail hardening checklist

A short list to lock down Gmail. Use the full guide (gmail-account-hardening) when you want the why and the click path. Domains: securewithgrok.com / securewithgrok.ai.

What you'll need

• About 15–20 minutes
• Your phone
• Optional: a second email address you check

Steps

1. Run Security Checkup (profile picture → Recommended actions).

2. Add a recovery phone (not Google Voice) and a recovery email.

3. Turn on 2-Step Verification; prefer Google prompts over text codes.

4. Create a passkey on a device you own (not a shared computer). Type g.co/passkeys yourself, never from a link or while someone is on the phone (Google).

5. Save backup codes somewhere private.

6. Review recent security events and sign out of old or unknown devices.

7. Remove unused apps and old app passwords.

8. Bookmark myaccount.google.com/notifications — check alerts there, not by clicking email links.

9. Know how to Report phishing in Gmail (More → Report phishing).

10. Set a PIN or password on your phone carrier account (FTC).

11. Google never calls about account security. Hang up, never read a code or tap Approve on the phone, and open Security Checkup yourself (Google). Unexpected "Trying to sign in?" → No, don't allow → review recent activity (Google).

Printable checklist

• Security Checkup done
• Recovery phone + email set
• 2-Step Verification on (prompts preferred)
• Passkey on my device
• Backup codes saved
• Devices and recent activity reviewed
• Unused apps cleaned up
• Notifications bookmark saved
• Know how to report phishing
• Carrier account PIN set
• I know: Google never calls; I never Approve or read a code on the phone

Also see: Full Gmail guide