Make Your Google Account Seriously Secure

When it comes to digital security, some accounts are simply more critical than others. Your Google account unequivocally belongs in that top tier, warranting maximum attention and perhaps a few extra layers of caution.

Seriously, pause for a moment to consider the sheer volume of personal information tied to that single login: your email correspondence, vital documents, cherished photos, essential files, browsing history, and potentially even contacts, text messages, and detailed location data if you use Android. Describing it merely as a “sensitive account” barely scratches the surface. Regardless of whether you leverage Google for professional tasks, personal organization, or a blend of both, safeguarding all that data and retaining complete control is paramount.

Here’s the reality check: Relying on a password you hastily created years ago is no longer sufficient. When dealing with something as invaluable as your personal digital life, that lone key is merely the initial step in establishing robust security. In fact, even that single key might be due for a serious overhaul.

Dedicate just 10 minutes to follow these steps, and you can then relax, knowing your Google account is secured to the highest possible standard.

Part I: Fortify Your Account’s Primary Access Point

Step 1: Scrutinize Your Google Account Password

We’ll kick things off with a fundamental yet critically important element: your Google account password. Ask yourself these crucial questions:

• Is your Google password derived from personal information like your name, a loved one’s name, your birthdate, street address, or anything easily discoverable through a simple online search?
• Does your Google password consist of common words, dictionary terms, or predictable sequences?
• Is your Google password noticeably brief, specifically shorter than eight characters?
• Do you use this Google password (or any slight modification of it) for any other online applications, websites, or services?

If you answered yes to any of these, consider it a clear signal for immediate action. Navigate to this link and update your password without delay. Opt for a password that is lengthy, intricate, devoid of any easily guessable personal details, common words, patterns, or, critically, *any* repetition from your other online logins.

(It’s worth noting: This is precisely where a dependable password manager—whether Google’s integrated tool or a more robust third-party solution—can be incredibly beneficial.)

All set? Excellent. Now, let’s proceed:

Step 2: Implement a Secondary Security Layer for Your Google Account

Regardless of your Google account password’s strength, there’s always a theoretical possibility of it being compromised. However, you can dramatically diminish the chances of unauthorized access to your digital assets by activating two-factor authentication (2FA) on your account.

With two-factor authentication enabled, you’ll be prompted for a *second* verification method beyond your password. Ideally, this involves a physical item that is uniquely yours. In its most straightforward and effective iteration, this could be a push notification or a code generated on your smartphone. For those seeking enhanced security, it could involve pressing a button on a dedicated physical key you carry (which might be a specialized USB or Bluetooth security key or even a feature built into your phone itself)—sometimes referred to as a “passkey,” which essentially describes the same concept in a somewhat convoluted way. While an option to receive codes via text message exists, this method is comparatively vulnerable to interception and is generally not recommended.

Regardless of the specific approach you select, having this additional layer significantly complicates unauthorized entry into your Google account, even if your password were to somehow fall into the wrong hands.

JR Raphael / Foundry

If you haven’t yet configured 2FA, visit Google’s 2-Step Verification page to initiate the setup process.

Step 3: Confirm Your Identity Verification Pathways

Should Google detect any unusual or suspicious activity on your account, it may request identity verification before granting sign-in access. If you haven’t reviewed your account recovery settings recently (or ever), there’s a significant possibility that crucial information is either outdated or entirely missing.

Take a moment right now to open Google’s account security hub and navigate to the section titled “How you sign in to Google.” Here, among other settings, you should see two vital options:

• Recovery phone
• Recovery email

If the information listed for either of these options is not current and accurate, click to edit and update it immediately.

With those critical updates complete, we’re ready to advance to the next level of safeguarding your Google account.

Step 4: Enable Recovery Assistance from Trusted Contacts

Effective online security planning involves anticipating every “what if” scenario, and this next Google account security enhancement is no different. Now that you’ve confirmed your ability to recover your own Google account if you ever get locked out, it’s time to consider an additional safety net: empowering someone you trust to assist in such a predicament.

Specifically, if you ever find yourself locked out of your Google account and are unable to verify your identity through the email and/or phone number we just discussed, you can now designate a trusted friend or family member to step in and confirm your identity on your behalf.

This feature, recently introduced by Google, is called Recovery Contacts, and setting it up is remarkably simple:

• First, navigate to the official Google Recovery Contacts configuration page.
• You’ll be prompted to verify your password and authenticate your access.
• Then, click the button to add a new recovery contact to your account.

The individual you choose will need to acknowledge and accept your request within one week to become an active recovery contact. Once confirmed, if you ever lose access to your account, they’ll be able to confirm a unique, one-time recovery code on their secured device, thereby authenticating your login.

(To clarify: If you fail to sign in, Google would present you with the option to select a recovery contact. A random number would then appear on *your* screen. Concurrently, your chosen contact would receive three distinct numbers on *their* device. To complete the authentication, they would need to select the number that matches the one you’re seeing and relaying to them—ensuring communication with you to verify the request’s legitimacy and your initiation of it—thereby restoring your access.)

Again, this mechanism is designed for extreme scenarios where you are entirely locked out and cannot receive verification codes directly yourself. Importantly, your designated contact will never have direct access to your Google account information. They simply provide an alternative, secure pathway for you to confirm your identity and regain access to your account during a worst-case lockout.

It’s important to note that setting up a Recovery Contact is only available for individual Google accounts, not for corporate Google Workspace accounts. In the latter case, your organization’s administrator is typically equipped to assist with any account recovery needs.

Part II: Restrict External Connections

Step 5: Audit Third-Party Services Accessing Your Account

Whenever you integrate an application that interacts with Google—be it on your phone, computer, or even directly within a Google service like Gmail or Docs—that application is granted a specific level of access to your Google account data.

This access can vary significantly: it might allow an app to view some of your activity within particular Google services, grant it full visibility into your Gmail, Google Calendar, or Google Drive, or even provide comprehensive access across your *entire* Google account.

It’s alarmingly easy to consent to these permissions without thorough consideration. Now is the time to review precisely which applications have access to what categories of your information. Visit Google’s third-party app access overview and carefully examine the list of connected services. If you identify any entry that you no longer use or don’t recognize, click on that specific line, then select the option to revoke its access.

JR Raphael / Foundry

While granting access to familiar and trusted applications is perfectly acceptable, it’s crucial to regularly revisit this list and ensure it remains as current and minimal as possible.

Step 6: Examine Devices Linked to Your Account

Beyond applications, you’ve undoubtedly logged into your Google account from various physical devices over time. Often, once a device is signed in at the system level, it maintains its connection and access to your account, even if it hasn’t been actively used in a while.

To regain control and close potential security gaps, navigate to Google’s device activity page. If you encounter any device you no longer own, use, or recognize, click the three-dot menu icon within its listing and immediately sign it out of your account.

Step 7: Inspect App Permissions on Your Smartphone

Another crucial app-related security consideration: if you’re an Android user, certain system-level permissions—such as those linked to your contacts and calendar—can indirectly govern access to parts of your Google account data. This is because services like Google Contacts and Google Calendar synchronize that data between your phone and the cloud.

Go to the Security & Privacy section of your phone’s system settings and locate the entry labeled “Permission manager.” (On some devices, you might need to tap “Privacy controls” first.) If it’s elusive, try searching your system settings for the phrase permission manager.

Once you’re there, you can meticulously review each permission type and identify which applications are authorized to access it. With a few quick taps, you can revoke permissions from any app where that level of access seems unnecessary or excessive.

JR Raphael / Foundry

Step 8: Review Browser Extension Permissions

On your desktop, browser extensions—whether for Chrome or any other browser—can significantly expand your browsing capabilities. However, they also carry the inherent risk of compromising your privacy.

Extensions might demand access ranging from your full browsing history to your system clipboard. They often possess the ability to read and modify data on the websites you’re actively visiting—either across all sites or only specific, relevant URLs, depending on the permissions initially requested.

None of this is inherently *problematic*, provided the extension is trustworthy and only requests the permissions absolutely necessary for its stated function. Yet, even well-intentioned developers sometimes opt for overly broad permissions. In such cases, an extension designed for a simple task like enhancing Gmail or saving articles could gain access to *everything* you do in your browser. This could lead to broad data, typically safeguarded within your Google account, being shared with external entities without a valid reason.

So, let’s conduct a quick evaluation, shall we? If you’re a Chrome user, type chrome:extensions into your browser’s address bar. If you use a different browser, locate the equivalent option for managing extensions or add-ons within its main menu.

Once you’re viewing the list of all your installed extensions, click the “Details” or “Options” button for each one. Pay close attention to the “Permissions” section, and specifically, scrutinize the “Site access” area. Carefully consider if the granted level of access is genuinely required, or if it would be more prudent to reduce it to a more limited scope.

For Chrome and other Chromium-based browsers (like Microsoft Edge and Vivaldi), if an extension appears to only need access to a specific site or domain but is requesting access to your activity on *all* sites, click the dropdown menu in that section. Change its setting from “On all sites” to “On specific sites,” which enables you to provide a precise, limited list of URLs where the extension will have full visibility.

JR Raphael / Foundry

Always remember that many extensions legitimately require specific levels of access to function correctly. Therefore, implement these changes with caution and after thoroughly considering the potential ramifications. In a worst-case scenario, if reducing an extension’s access causes it to malfunction, you can always return to this section of your browser’s settings later and revert the changes.

Firefox, incidentally, does not offer this fine-grained control over permissions. If you find an extension in Firefox is accessing more data than you’re comfortable with, your most effective solution is to uninstall it entirely.

Which brings us to our next point…

Step 9: Remove Unnecessary Mobile Apps and Browser Extensions

While you’re already focused on third-party additions to your computer and phone, take a moment to survey all installed programs on both. Reflect on how many of these applications you genuinely still use. The fewer potential vulnerabilities (or “cracked windows”) you leave open to your Google account, the better. If you’re not actively using an application, there’s no compelling reason to maintain its connection.

And with that, we’re poised to explore the final two categories of account protection strategies.

Part III: Prepare for Unexpected Circumstances

Step 10: Establish or Verify Your Digital Google Will

Contemplating worst-case scenarios is rarely enjoyable—I’d personally prefer a leisurely tea time—but much like planning for your physical and financial assets, creating a digital will for your Google account will immeasurably simplify matters for your loved ones should you ever, shall we say, become indisposed.

For Google Workspace accounts managed by a company, a designated individual within your organization would be able to assume control of your account if you were no longer able to access it. However, no such inherent system exists for individual Google accounts to facilitate the transfer of access.

Google provides a straightforward system to address this: Access the Inactive Account Manager, where you’ll find tools to define precisely what should occur if your account becomes inactive for a specified duration. You can set the number of months without any detected activity, along with the email addresses and phone numbers Google should use to contact you for confirmation. Furthermore, you can provide Google with the email addresses of individuals you wish to be notified once it’s clear you’re no longer active.

From there, you can specify with precision which types of information your chosen contacts will be authorized to access. You even have the option to compose a personal message for these individuals and, if desired, create a general auto-reply that will be sent to anyone who emails you after your inactive period commences (a slightly eerie touch!).

JR Raphael / Foundry

Even if you’ve previously configured these settings, it’s wise to periodically revisit and review your preferences to ensure all information remains current and accurate. This includes verifying not only the specific contacts designated for notification but also the precise *areas* of your account these individuals will be able to access, should this situation ever arise.

For this latter aspect, be sure to click on the email address of each person you’ve listed, then select the “Edit apps & services” option on the subsequent screen. This will display a comprehensive list of account-related categories—ranging from Contacts and Calendar to Google Chat, Google Photos, and even your location history (if collected by a device you use)—allowing you to see currently selected areas and to add or remove any areas from the sharing list as needed.

Almost every time I’ve checked these settings, I’ve discovered several newer account-related areas that *weren’t* initially selected for sharing—likely because they didn’t exist during my last review. I’ve had to manually check each one to ensure they would be included in any post-event account sharing.

Part IV: Maximize Your Protection

Step 11: Consider Google’s Advanced Protection Program

Finally, we come to a step that isn’t universally suitable but could be profoundly impactful for specific categories of Google users. For individuals facing a heightened risk of targeted cyberattacks, Google offers an elevated tier of account security known as the Advanced Protection Program.

This program is specifically recommended for public figures, such as business leaders, IT administrators, activists, and journalists—anyone who might be a target for malicious actors. It imposes stringent restrictions on your Google account, making unauthorized access exceptionally difficult. However, this enhanced security also introduces some additional complexities for *you*.

A central tenet of the Advanced Protection Program is the mandatory use of a physical security key for the initial sign-in on any new device. This means that, in addition to your password, you will require this specific form of two-factor authentication—either a Google-approved key integrated into your phone or a separate hardware dongle—to access your email, documents, or any other component of your Google account.

As part of these elevated security measures, you will also be restricted from connecting most third-party applications to your Google account, including those that typically require access to your Gmail or Google Drive to function. This can lead to certain inconveniences (such as challenges with logging into an Android TV device, surprisingly) and necessitate compromises (like no longer being able to use many third-party email clients with Gmail). Furthermore, should you ever lose access to your account for any reason, you’ll be required to undergo a more involved, multi-day recovery process to regain entry. For a deeper understanding of what it’s like to use the Advanced Protection Program, you can refer to this insightful overview.

Ultimately, the decision rests with you as to whether these added inconveniences are outweighed by the significant boost in security. If unparalleled protection for your Google account is your priority—especially if you’re at an above-average risk of being targeted—it’s a consideration well worth making.

If you’re ready to embrace this formidable layer of security for your Google account, proceed to Google’s Advanced Protection Program website to begin. For personal accounts, you can typically complete the setup in minutes. For accounts under a paid company Workspace plan, your plan administrator must first enable Advanced Protection for the organization. Upon initiating the enrollment process, you’ll quickly ascertain if it’s already available for your account; if not, you can consult your company admin about activating this option.

And with that, a well-deserved pat on the back is in order! Having completed these 11 essential steps, your Google account security is officially optimized, meaning you won’t need to dwell on this aspect for quite some time.

Simply schedule a yearly reminder to revisit this page and re-evaluate its steps. (I will continue to update and enhance these instructions as needed over time.) Apply similar security best practices across other critical areas—like your Android security settings, if you use an Android device—and then rest assured that your most vital digital information is as protected as it can possibly be.

This article was initially published in February 2020 and saw its latest update in February 2026.