Quick Answer: Secure the email account that can reset your other accounts first. Use a unique password or passkey, add the strongest multi-factor option the provider supports, confirm recovery details, then review sessions, delegated access, app passwords, connected apps, forwarding rules and filters. If access may already be compromised, use a clean device and follow the recovery order below.
Email is often the recovery channel for banking, shopping, social media and cloud services. Protecting it means securing both sign-in and the less visible ways mail can be read or redirected. This guide separates preventive setup from incident recovery so you can make changes without accidentally locking yourself out.
Strengthen the Way You Sign In
Protect sign-in, account recovery and access already granted to other devices or apps. A unique password with strong multi-factor authentication, or a supported passkey, improves sign-in security. It does not automatically revoke every session, remove delegated access or stop a mail-forwarding rule.
Use a Long, Unique Password
Length protects a password more than forced mixtures of character types. NIST SP 800-63B-4, published in 2025, requires at least 15 characters when a password is used alone and permits a shorter minimum when it is part of multi-factor authentication. It also tells service providers to allow password managers and not impose arbitrary composition rules.
Reusing a password across accounts creates a bigger risk. If one site is breached, criminals may try the same credentials on your email account. A password manager can generate and store a unique password for every account, so you do not have to remember them individually.
Do not change your password on a fixed schedule out of habit. NIST’s current guidance says verifiers should not require periodic password changes. Change an exposed or reused password promptly when there is evidence of compromise. The service may also require a reset after a security event; the point is to avoid routine changes that leave a reused or predictable password in place.
Choose the Strongest Two-Factor Method Available
Two-factor authentication (2FA), also called two-step verification, adds another barrier when a password is exposed. Prefer a provider-supported passkey or phishing-resistant security key where practical. An authenticator app is another useful option. SMS can still be better than a password alone, but it depends on control of the phone number and is more exposed to SIM-swap and message-redirection risks.
Do not treat a one-time code as proof that a login page is genuine. A phishing site can ask for a password and code in real time. Open the provider’s app or type the known account address yourself before approving a sign-in request.
Prefer an updated email app with the provider’s supported modern sign-in. An app password is an exception for an older app or device, where the provider permits it; it is not a second factor you type at every login. Google recommends modern sign-in instead in most cases and restricts app-password availability for some accounts. Revoke app passwords for apps you no longer use rather than leaving these extra credentials active.
Keep Backup Codes Somewhere You Can Access Without Your Inbox
Provider-issued backup codes can provide a recovery sign-in option if you lose access to an authenticator. Availability and use differ by provider; some codes are single use. Store them somewhere separate from your email account, such as a password manager or a printed copy in a secure location.
Storing backup codes only in your email defeats their purpose, since you cannot reach them if you are locked out of that account. Treat them with the same care as a spare house key.
Check Recovery Settings and Existing Access
Use This Recovery Order
| Situation | First safe action | What to verify next |
|---|---|---|
| You still control the account | Confirm recovery options from a trusted device | Password or passkey, MFA, sessions, app passwords, connected apps and forwarding |
| You see unfamiliar activity | Secure the device, then change sign-in credentials | Revoke sessions, remove unknown access and check sent, deleted and forwarded mail |
| You cannot sign in | Use the provider’s official recovery page | Restore recovery details, then review every persistence route before reconnecting other accounts |
| Your email reset another account | Secure email first | Reset the affected account and review its sessions, recovery methods and payment activity |
Recovery settings determine who can regain access to your account. Outdated or unfamiliar entries create a hidden way in for attackers. A password change means little if someone can still reset your account through an old phone number or a recovery email you no longer control.
Update Your Recovery Details Without Creating a Lockout Risk
Review the recovery methods your provider offers and keep the ones you control current. A recovery email should be a different account that you can still reach if this inbox is locked. Avoid a circular arrangement in which each inbox can be recovered only through the other. Google’s account help notes that changing recovery information can trigger verification codes sent to your previous recovery details for seven days afterward, according to Google’s recovery options support page.
Update these settings before you lose access to your old phone number or email, not afterwards. Google says you cannot add recovery information while locked out or during its account-recovery process. Other providers and managed work or school accounts have their own procedures; use the account’s official recovery route rather than assuming you can edit security settings while locked out.
Investigate and remove recovery methods you did not add, using the provider’s own account-security controls. Keep at least one usable, verified recovery method before removing your old one. If the change could alert someone who is monitoring you, consider personal safety and use a device they cannot access.
Review Signed-In Devices and Third-Party App Access
Check signed-in devices, recent security events and sessions through the provider’s official account page. Review anything you do not recognise, and sign out devices you no longer control. Most email providers show this list under account activity or security settings, along with the approximate location and date of each sign-in.
Third-party apps connected to your email, such as calendar tools or old services you tried once, can retain access long after you stop using them. Check the permissions, publisher and purpose of each app, then revoke grants you no longer need or did not approve. Removing a grant stops the access it authorizes; it cannot retrieve information already copied.
Check Forwarding Rules, Filters and Login Alerts
Attackers may use forwarding, filters or mailbox delegation to read messages or conceal security notices. Review forwarding addresses, filters that delete or archive mail, delegates and sending identities. Check sent, deleted and archived mail for activity you did not initiate. A legitimate forwarding address can still be inappropriate if you no longer control it.
Turn on login alerts if your provider offers them, so you get notified of sign-ins from new devices or locations. For example, Microsoft’s account activity page lets you review successful sign-ins and security challenges after you receive an unusual activity notice, according to Microsoft’s Outlook account protection guidance.
Avoid Scams and Protect the Devices You Use
Phishing emails and outdated software are two common ways attackers get into an email account that already has a strong password. Recognising scam messages and keeping your devices patched closes gaps that password strength cannot cover on its own.
How Can You Check a Suspicious Email Safely?
Treat unexpected links and attachments as hostile until proven otherwise. If a message claims to come from your bank, email provider or a service you use, contact that organisation through its official app or website. Do not reply to the email or click any link inside it.
Do not send passwords, backup codes or verification codes in reply to an email. Microsoft says it will not ask for your password by email. Open the provider’s app or known website independently when a message says your account needs attention.
Check the address bar before entering a password on any sign-in page you reached through an email link. If the URL does not match your provider’s genuine domain, close the page and navigate to the site directly instead. Some providers display a warning bar on messages containing blocked links or attachments, so check it rather than dismissing it.
Keep Your Email App, Browser and Device Updated
Outdated software has known vulnerabilities that attackers actively target through malicious attachments and links. Set your operating system, browser and email app to update automatically wherever possible.
Regular Windows 10 support ended on 14 October 2025. Some eligible devices can receive security updates through Microsoft’s Extended Security Updates programme; coverage depends on the edition, enrolment and current terms. Check the device’s actual support and update status rather than assuming an antivirus subscription replaces missing operating-system fixes. Microsoft explains the support and transition options.
What Changes When You Use Public Wi-Fi?
Public Wi-Fi does not automatically reveal an email password. Modern email websites normally use HTTPS, which encrypts the browser-to-provider connection even on an open hotspot. A VPN adds a tunnel for included traffic from the device to the VPN server; it does not make a fake login page or compromised device safe. The FTC’s public Wi-Fi guidance explains why widespread website encryption matters. Respect certificate warnings and use the genuine provider’s app or address.
Avoid signing in to your email account on a public computer, and never choose the option to save your password on a shared device. Signing out and closing the browser helps avoid leaving a session open, but private browsing or a VPN cannot make an untrusted computer safe from software that records what you type. Use a device you control for recovery or sensitive changes.
Do SPF, DKIM and DMARC Protect Your Inbox?
SPF, DKIM and DMARC help receiving systems assess whether mail is authorized and aligned with the claimed sending domain. They do not establish that the sender is honest or that a message is harmless. A personal Gmail or Outlook user relies on the provider’s domain configuration; someone who administers a custom email domain can configure authentication with the domain and email host. Google’s sender guidelines describe that domain-owner task.
These standards reduce the number of spoofed messages that reach you, but they do not stop every phishing attempt, particularly those sent from genuine but compromised accounts. You still need to watch for suspicious content, even when your account is protected by all three standards.
What Should You Do If Someone May Have Access?
Act as soon as you notice signs of unauthorised access. Delaying gives an attacker more time to lock you out permanently or use your account against your contacts. Check whether the event is a confirmed compromise or an unfamiliar but explainable occurrence before making irreversible changes.
Check for Signs of Access Without Assuming a Breach
Look for sent messages you did not write, password reset emails you did not request, or sign-in alerts from unfamiliar devices and locations. Google’s guidance on securing a compromised account lists unfamiliar activity in Gmail or other Google products as the main signal worth investigating, according to Google’s account security support page.
A single unfamiliar sign-in location may reflect a VPN or a family member using a shared device rather than an attacker. Check the details before assuming the worst, but do not ignore a pattern of repeated unfamiliar activity.
Secure the Account and Remove Unauthorised Access
Use a trusted device and follow the provider’s compromised-account process promptly. Change an exposed password and other reused copies, check recovery methods and MFA, then review sessions, delegates, app passwords and connected apps. Avoid a rigid universal order: if you cannot sign in, recovery comes first; if an attacker controls a recovery method, that path also needs urgent attention. For a managed account, contact its administrator.
Turn off any monitoring or forwarding rule you did not set up to stop further mail interception. If you share the account or device with someone whose access you are removing for personal safety reasons, be aware that this change may alert them. Consider your own safety before acting.
Use Official Recovery If You Cannot Sign In
Use your provider’s official account recovery process if someone has changed your password and you cannot sign in. Use Google’s compromised-account guidance or Microsoft’s account-security guidance to reach the appropriate recovery process. Available methods depend on the account and configured security options; successful recovery is not guaranteed.
Do not give a stranger your password, session cookies, recovery codes or remote access because they promise to recover the inbox. Use the provider’s official recovery and support channels. A paid recovery promise is not proof of privileged access to the provider.
Confirm Recovery Before Reconnecting Apps
Google documents exceptions to password-change sign-outs for some verification devices, third-party apps and home devices. Review remaining sessions and grants rather than treating the password-change confirmation as an all-access reset. Google app passwords are revoked after a password change; reconnect only the apps and devices you still trust.
Check whether the inbox was used to reset other accounts, send requests to contacts or access sensitive documents. Secure those services through their own official controls and warn affected contacts through a trusted channel where necessary. Removing a forwarding rule prevents that route from copying future messages; it cannot retrieve copies already taken.
Keep a brief record of unfamiliar access and the changes you made. Check activity again after recovery, and investigate recurring changes rather than repeatedly changing the password without addressing the remaining route.
Start with Your Sign-In and Recovery Settings
If you are working through this guide for the first time, begin with the sign-in and recovery changes covered above. They address important access paths, but sign-in changes must be paired with checking existing sessions, delegated access, connected apps and forwarding. A successful password change alone is not a complete incident response.
Set a reminder to review these settings every few months rather than treating them as a one-time task. New devices, forgotten connected apps and old recovery details tend to accumulate quietly, so a periodic check can catch what a single setup pass misses. Reviewing account activity for unfamiliar sign-ins during the same check takes little extra effort once the habit is in place.
Frequently Asked Questions
What is the best way to secure an email account?
Use a unique password or passkey, enable the strongest multi-factor option available, keep recovery methods current, and review sessions, app passwords, connected apps, forwarding rules and filters. These controls address different access paths, so one does not replace the others.
How can I tell if someone accessed my email?
Review recent sign-ins, sent and deleted mail, forwarding rules, filters, delegated access, app passwords and connected apps. An unfamiliar location alone is not proof because mobile networks and VPNs can change location signals.
Should I change my email password first after a suspected compromise?
Use a trusted device and follow the provider’s compromised-account process. Change exposed or reused passwords promptly, check recovery and MFA methods, then review sessions, delegates, app passwords and connected apps. If you cannot sign in, use official recovery first; managed accounts need their administrator.
Does public Wi-Fi expose an email password?
Modern provider apps and websites normally encrypt traffic with HTTPS, so public Wi-Fi does not automatically reveal a password. The larger risks are fake login pages, unsafe devices, ignored certificate warnings and accounts left signed in on shared equipment.
Does changing a Google password sign out every device and app?
Not necessarily. Google documents exceptions for some verification devices, third-party apps and home devices. Review signed-in devices and app grants separately. Google revokes app passwords after a password change, but that does not replace checking other access paths.
Sources and Image Credits
- NIST digital identity and authenticator guidance
- Google: secure a hacked or compromised account
- Microsoft: help keep an account secure
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.