Harden your main email - the account that protects all the others
Your email is the master key. Anyone who gets into it can reset the password on almost everything else - your bank, your shopping, your social accounts - because that’s where the “reset my password” links land. So of everything you could do today, ten minutes here is worth the most. One thing first: have a password manager set up, because the opening move is giving your email a password nothing else shares.
Give it a password nothing else uses
If your email password is one you’ve ever used anywhere else, treat it as already known - leaked passwords from old website breaches are exactly what gets tried first. Change it to a long, unique one straight from your password manager. This is the single most useful change on the page.
Add two-step sign-in - an app, not a text
Turn on two-step sign-in for your email first, before any other account. Use an authenticator app rather than a texted code where you can - texts can be redirected by a SIM-swap, an app code can’t. We walk through this properly in its own guide.
Close the back door: your recovery details
Most accounts aren’t broken into through the front door - they’re reset through the back one. Check the recovery email and recovery phone number on your account are current and still yours, and delete any old ones you no longer control. If there are security questions, treat the answers like passwords: the real answer to “mother’s maiden name” is often a quick search away, so put a made-up answer in your password manager instead.
Sign out anything you don’t recognise
Your email settings have a list of devices and sessions currently signed in. Open it, look down the list, and sign out anything you don’t recognise - an old phone, a strange location. That boots out anyone already in, which a new password alone doesn’t always do.
Google · Security Checkup → Microsoft · account security → Apple · appleid.apple.com →
Know the one trick that beats all of the above
Once your email is hardened properly, the realistic way in isn’t cracking it - it’s getting you to open the door. A message or call, often looking like it’s from the provider, asks you to approve a sign-in, tap a link, or read out a code “to verify you.” Two rules cover it: never approve a sign-in prompt you didn’t start, and never read a code out to anyone- a real company never asks.
“What if I’m already locked out?”
If you can’t get into your own email - or you think someone else is in it - this is the one time you start here rather than with the password manager. Use the provider’s account-recovery page (the links above), and move quickly: an attacker’s first act is usually to change the recovery details so you can’t undo it. Once you’re back in, do steps 1-4 the same hour.
Last checked: 19 October 2026. Providers move their menus around - if a setting isn’t where we say, tell us.