How to Secure Your Email Account Before a Takeover Happens

Your email account is not just for reading messages. It is the recovery address for your bank, your shopping accounts, your social media, and probably your cloud storage too. If someone takes over your inbox, they can request password resets for everything else and lock you out one account at a time. That is exactly why attackers value email so highly — and why it is worth spending twenty quiet minutes protecting it before anything goes wrong.

The good news: securing your email is mostly a set of one-time settings. You do the work once, and it keeps paying off. Here is how to do it calmly, without becoming a security expert.

Why the inbox is the master key

Think about what happens when you forget a password anywhere else. You click "forgot password," and a reset link arrives — in your email. That single fact means your inbox effectively controls the front door to most of your digital life. An attacker who reads and controls your email can:

• Reset passwords on other accounts and read the codes that arrive.
• Delete the warning emails those services send, so you never notice.
• Find out which banks, shops, and services you use, just by scrolling.

So the goal is simple: make the inbox the hardest account to break into, not the easiest.

Step 1: Give it a strong, unique password

The single most common way accounts fall is a reused password. If you used the same password on a forum that later got breached, attackers will try that same combination on your email. Your email password must be unique — used nowhere else — and long enough that it cannot be guessed.

The easiest way to manage this is a password manager, which creates and remembers long random passwords for you. If you are new to the idea, our guide on choosing a password manager and cleaning up old passwords walks through it step by step. And if you are wondering whether it is really worth the switch, password manager vs reused passwords makes the case plainly.

Step 2: Turn on multi-factor authentication

Even a perfect password can be phished or stolen. Multi-factor authentication (MFA) adds a second step — usually a code from an app or a tap on your phone — so a stolen password alone is not enough to log in.

For email specifically, prefer an authenticator app or a passkey over SMS text codes where you can, because text codes can be intercepted or redirected. If MFA feels like an inconvenience, remember that it is the layer that saves you even after a password leak. We explain why in why MFA still matters even when your password is already stolen.

Step 3: Lock down account recovery

This is the step most people forget, and it is the one attackers love. Your account recovery options — a backup phone number, a secondary email, and a set of recovery codes — are a second way into your account. If they are out of date or point to an address you no longer control, they become a weak side door.

Go into your email provider's security settings and check:

• Recovery phone number. Is it a number you still own? Remove old ones.
• Recovery email. Make sure it is an account you control and that is also protected with MFA.
• Backup or recovery codes. Generate a set, print them, and store them somewhere physical and safe — not in a note on the same phone.

Step 4: Review what already has access

Over the years you have probably clicked "Sign in with Google" or "Sign in with your email" on dozens of apps and websites. Each one keeps a connection to your account. Some you have long forgotten.

In your account's security or "connected apps" section, review the list and remove anything you do not recognise or no longer use. Fewer connections means fewer ways in.

Step 5: Learn the warning signs of a takeover

Sometimes the first clue is subtle. Watch for:

• Password-reset or "new sign-in" emails you did not trigger.
• Emails disappearing from your inbox, or a filter you did not create that forwards or deletes messages.
• Sent messages you did not write.
• Being logged out unexpectedly.

If you see any of these, act quickly: change your password from a device you trust, sign out all sessions, check your recovery settings and any forwarding rules, then re-enable MFA. Our emergency checklist for after you click a bad link is a good companion for those first tense minutes.

A quick word about phishing

Most email takeovers do not start with clever hacking. They start with a convincing message that tricks you into typing your password into a fake login page. Before you enter your email password anywhere, pause and check the web address. If a "security alert" pushes you to log in urgently, treat it as suspicious until you have confirmed it independently.

Put it on your calendar

Security is not a one-time event, but it does not need to be a daily chore either. Once a month, or whenever a service emails you about a breach, take a few minutes to check your recovery options and connected apps. If your email is ever caught up in a leak, the first accounts to secure after a data leak tells you where to start.

Spend the twenty minutes now while everything is calm. A protected inbox turns a potential disaster — a stranger holding the keys to your whole online life — into a non-event.