Google and Apple Account Security Checklist: 12 Steps

Your main cloud or device account, whether from a search company, a phone maker, or a similar provider, is a master key to your digital life. It often holds your email, contacts, photos, backups, and the ability to reset other logins, so it deserves the strongest protection you can give.

The steps below apply to any major account of this kind, regardless of provider.

1. Use a unique, long password

Make this password different from everything else. A random password from your manager or a long passphrase of random words both work.

2. Add a passkey or security key

If the service supports passkeys or hardware keys, enable them. They resist phishing far better than passwords or codes.

3. Turn on two-step verification

If you cannot use passkeys everywhere, enable an authenticator app. Avoid relying only on SMS.

4. Save backup codes

Download or print the codes and store them offline, away from your phone.

5. Review recovery email and phone

Confirm both are current. The recovery email should itself be strongly protected. Remove old numbers and addresses.

6. Check signed-in devices

Open the security page and look at the list of devices and sessions. Sign out any you do not recognize or no longer use, such as an old laptop or a phone you sold.

7. Review third-party access

Over the years you may have granted apps and websites access to your account, sometimes through a “sign in with” button. Remove anything you no longer use, and review what each remaining app can see or do. Prefer apps that ask for minimal permissions.

8. Audit email forwarding and filters

For email-based accounts, check the settings for forwarding rules, delegated access, and filters that automatically delete or hide messages. Attackers often add these to monitor a mailbox without you noticing.

9. Enable login alerts

Turn on notifications for new sign-ins and security changes, and send them to a channel you will notice.

10. Tighten device security

Your phone is often the second factor, so lock it with a strong PIN or passcode, enable biometrics as a convenience, and turn on find-my-device features. Keep operating systems and browsers updated.

11. Use any advanced protection mode carefully

Some providers offer a stricter mode for high-risk users that requires keys and limits third-party access. It is powerful, but make sure you have backup keys and recovery steps before turning it on.

12. Set up emergency or legacy access

Choose a trusted person who can access your data in an emergency, if the service offers this, and understand how it works.

Threats this checklist reduces

• Credential stuffing: unique passwords and second factors stop reused logins.
• Phishing: passkeys and security keys defeat fake pages.
• Stolen phone: device locks and remote sign-out limit damage.
• Silent mailbox snooping: forwarding and filter checks reveal tampering.
• Lockout: recovery options and backup codes keep you in control.

Habits that keep the account safe

• Do not sign in on shared computers, and sign out if you must.
• Be wary of messages claiming your account is suspended. Visit the service directly instead of clicking.
• Never share one-time codes with anyone, including people claiming to be support.
• Keep the account’s email address private where you can.
• Review the security page a couple of times a year.

If you suspect a compromise

Change the password from a trusted device, sign out of all sessions, review recovery settings and forwarding, re-enable strong two-factor authentication, and check connected apps. Then change passwords on other accounts that rely on this one.

Why order matters

Start with the steps that block the most common attacks: unique password, strong second factor, and recovery details. The later steps, such as app permissions and forwarding rules, address quieter threats that appear after someone has already had brief access. If time is short, complete the first six steps today and the rest within the week.

Keeping other accounts in line

Your main account is often the recovery path for others. After securing it, review the accounts that use it for sign-in or password resets, such as shopping, travel, and financial sites. A secure hub does little good if the spokes still use reused passwords.

When something looks wrong

If you see an unfamiliar device, a login alert you did not expect, or settings you did not change, treat it as real until proven otherwise. Change the password from a trusted device, sign out everywhere, and walk back through the checklist. Early action is far cheaper than cleanup after an attacker has used the account.

Frequently asked questions

Which account should I secure first?

Your primary email and your main cloud or device account, since they can reset many others. Next come banking and your password manager.

Do I need a security key for my main account?

Not strictly, but it offers the strongest protection. If you are a likely target or hold valuable data, it is worth it. Otherwise, passkeys or an authenticator app are a good level.

How often should I review these settings?

Every six months is a good rhythm, and after any lost device or suspicious activity.

Key takeaways

• Treat your main account as the master key and protect it first.
• Prefer passkeys or security keys, with authenticator apps as a backup.
• Audit devices, app access, and email forwarding regularly.
• Keep recovery details current and codes stored offline.