 |
| Your phone is the key that locks and unlocks your Google Account |
Your Google Account is the master key to your digital life.
It opens Gmail, Google Photos, Drive, YouTube, and the passwords you saved in Chrome.
If a stranger gets in, they can read your email and reset the passwords of your other accounts.
The good news is that Google already gives you every tool you need to lock that door.
Most of the settings below take less than a minute each to change.
Work through all ten today and your account becomes much harder to break into.
Before You Start
You only need a few things ready before you begin:
- A device you already use — work from a phone or computer where you normally sign in.
- Your current password — Google asks for it before it allows sensitive changes.
- Your phone nearby — prompts and codes will arrive on it while you work.
- About fifteen minutes — the full list fits easily into one sitting.
10 Settings to Change Right Now
- Run Security Checkup
Open myaccount.google.com/security-checkup while signed in to your account.
Work through each section until every item shows a green check mark.
Security Checkup finds weak spots for you and walks you through fixing them one by one. - Turn on 2-Step Verification
Open myaccount.google.com/signinoptions/two-step-verification, or find 2-Step Verification under how you sign in to Google in the Security & sign-in tab.
Follow the steps and choose Google Prompts, an authenticator app, or a security key as your main second step.
Prompts and keys resist phishing better than codes sent by text message.
With this on, a stolen password alone is no longer enough to get in.
Text message codes are the weakest option because attackers can steal your number through SIM swapping and receive the codes themselves. - Create a passkey
Open myaccount.google.com/signinoptions/passkeys and choose Create a passkey.
You then sign in with your fingerprint, face scan, or device PIN instead of a typed password.
Passkeys cannot be phished, copied, or typed into a fake website.
Because a passkey only works on the real Google sign-in page, a look-alike phishing site gets nothing it can reuse. - Update your recovery phone and email
Open the Recovery phone and Recovery email pages from the How you sign in to Google section of Security & sign-in.
Make sure both still belong to you and that you can open them right now.
Correct recovery info is the difference between a quick reset and losing the account for good.
Attackers target outdated recovery details because the reset flow is often the easiest way around an otherwise strong password. - Review the devices signed in
Open myaccount.google.com/device-activity to see every phone, tablet, and computer on your account.
Sign out of anything you do not recognize and anything you no longer own.
This cuts off a lost or shared device before someone can use it against you.
A signed-in device holds an active session, so anyone holding it can open your account without ever needing your password. - Remove third-party access you no longer use
Open myaccount.google.com/connections to list the apps and services linked to your account.
Remove access for anything old, unknown, or no longer needed.
Every connected app is another door into your data, so keep the list short.
If one of those services is breached, its stored access token can become a silent back door into your files and email. - Run Password Checkup
Go to passwords.google.com and choose Password Checkup, then Check passwords.
Change every password it flags as compromised, weak, or reused.
A different password on every account means one leak cannot unlock the rest.
Attackers run leaked passwords through automated tools that try them on hundreds of other sites, a technique called credential stuffing. - Turn on Enhanced Safe Browsing
In your Google Account, open Security & sign-in and scroll to Enhanced Safe Browsing for your Account.
Choose Manage Enhanced Safe Browsing and turn the switch on.
Chrome and Gmail then warn you faster about dangerous sites, downloads, and extensions. - Turn on Find Hub and a strong screen lock
On your Android phone, open Settings, then Security, then Find Hub, and turn on Allow device to be located.
Set a PIN, pattern, or password lock if your phone does not have one yet.
If the phone is lost, you can ring it, lock it, or erase it from another device. - Keep Timeline off and turn off ad personalization
In Data & privacy, open Timeline under History settings and keep it off, or pause it if you once turned it on.
Then open Ad personalization under Ad settings and turn that off as well.
Timeline is off by default, so this step keeps your saved location history small and your ads less personal.
 |
| A code prompt like this one is the second step that stops password-only sign-ins |
Habits That Keep It Secure
Never share verification codes.
Google will never call, text, or email you to ask for a code or your password.
Anyone who asks for one is trying to take over your account.
A few steady habits on every device keep the account locked down
Use a password manager.
Let Google Password Manager or another trusted manager create and store a long, unique password for every site.
Then you only have to remember one strong password, the one for your Google Account.
Keep your software updated.
Turn on automatic updates for your phone, your browser, and your apps.
Many attacks only work because a known flaw was never patched.
Review security activity now and then.
Once a month, open Recent security activity in your Google Account and scan for sign-ins you do not know.
Catching a strange sign-in early makes recovery much easier.
Google Account Security FAQ
Can someone bypass 2-Step Verification?
Attackers cannot guess their way past it easily, but they sometimes trick people into approving a sign-in prompt or handing over a code.
That is why you should only approve prompts for sign-ins you started yourself and never share codes with anyone.
What should you do if you get a sign-in alert you do not recognize?
Do not approve the sign-in, and open your Google Account security page directly instead of tapping links in the alert.
Then change your password, check your signed-in devices, and remove anything you do not know.
How often should you repeat this security checkup?
Running through the list every three to six months is a sensible rhythm for most people.
Run it sooner whenever you replace a phone, see a strange sign-in, or hear that a service you use has been breached.
Most readers can finish all ten settings in about fifteen minutes.
Do it once today, and your Google Account stops being an easy target.
Comments
Post a Comment