Accounts & devices
Secure the account that can reset everything else
A practical hardening checklist for your primary email account—the key to many other accounts.
Why email deserves first priority
Password-reset links, purchase receipts, identity documents and private conversations often pass through one inbox. If someone controls that inbox, they may be able to reset other accounts while deleting the warnings.
Treat your main email as a root account. Secure it before improving lower-impact services.
A fifteen-minute hardening pass
Open the security settings from the provider’s official app or a bookmarked address. Work through each item without following links from an unexpected message.
- Replace any reused password with a long, unique value stored in a password manager.
- Add a passkey or hardware security key when supported; otherwise enable multi-factor authentication.
- Confirm that recovery email addresses and phone numbers belong to you.
- Sign out unfamiliar devices and remove app passwords or connected apps you no longer use.
- Inspect forwarding, filters and mailbox delegation for changes you did not make.
- Save recovery codes offline in a place you can access if your phone is lost.
Do not confuse complexity with strength
Predictable substitutions and forced punctuation do not rescue a short or reused password. Length and uniqueness matter more. A password manager can generate and remember a different password for every service.
Passwords are still vulnerable to phishing. Where a provider offers passkeys or another phishing-resistant option, that can reduce the risk of giving a secret to a convincing fake page.
Further reading
Primary and authoritative external sources used to support the guidance and provide additional context. RightsRelay is not affiliated with them.