Secure Your Email Account

Email is the master key to your entire digital life. Fortify it first before securing your social media, school portals, or shopping accounts.

Why email security comes before everything else

Every single online service you use (Amazon, TikTok, Roblox, PayPal, PlayStation, and school portals) connects directly back to your email inbox. If someone hacks an individual social account, they can only cause trouble on that single app. But if they break into your main email, they can click "Forgot Password?" on every website you own and take over your entire life in minutes.

1. Unique Passphrase A long 4-word password you do not use anywhere else.
+
2. Live 2FA / Passkey Verification codes from an authenticator app, not text messages.
+
3. Clean Recovery Hub Only your personal phone and emergency offline backup numbers.
Rule for All Providers: Whether you use Gmail, Microsoft Outlook / Hotmail, or Apple iCloud Mail, the step-by-step principles are identical: establish a unique passphrase, turn on 2-step verification, remove unfamiliar devices, and ensure nobody has added a secret forwarding rule.

Choose your device walkthrough

Select the device you are currently using to secure your email profile:

1. iPhone / iPad 2. Android 3. Windows PC 4. Mac
1. APPLE IPHONE & IPAD ROUTE

How to Secure Your Email on iPhone or iPad

Follow these exact steps to lock down your email account from an iOS or iPadOS device:

Email App / Settings → Account Profile → Security → Update Password & 2FA
  1. Open your official email application:
    • For Gmail: Open the Gmail app, tap your circular profile picture in the top-right corner, and tap Manage your Google Account. Then tap the Security tab.
    • For Outlook: Open Outlook, tap your profile icon at top-left, tap the Settings gear > tap your email address > Account settings.
    • For Apple iCloud Mail: Open iPhone Settings > tap your Name at the very top > Sign-In & Security.
  2. Create a brand-new, unique password: Tap on Password. Enter your current credentials, then type a completely fresh passphrase consisting of 4 random words (for example: OceanBicycleRocketPencil88!). Never reuse a password from your school login or gaming accounts.
  3. Turn on Two-Factor Authentication (2FA) or Passkeys: Tap on 2-Step Verification or Two-Factor Authentication. Select Authenticator App (e.g. Google Authenticator) or Passkey. Avoid relying on simple SMS text messages whenever possible.
  4. Verify your recovery phone and recovery email: Look closely at the numbers and fallback emails displayed. Confirm that every character belongs to you or a trusted parent. If you see an outdated phone number you no longer own, delete it immediately.
  5. Review signed-in devices and sign out strangers: Scroll down to Your Devices. Inspect the list. If you see an old phone you traded in, a friend's iPad, or a location in another country, tap that device and select Sign Out (or Remove from Account).
  6. Lock your email app with Face ID: Return to your iPhone Home Screen. Press and hold your finger on the Gmail or Outlook app icon for 1 second. When the menu pops up, tap Require Face ID. Now nobody who borrows your phone can open your mail without your face!
✓ Done: Your email is secured with a fresh passphrase, two-factor authentication, verified recovery contacts, and Face ID app lock.
2. ANDROID STEP-BY-STEP ROUTE

How to Secure Your Email on Android

Android devices integrate directly with your primary Google Account and Gmail:

Gmail App → Profile Picture → Manage your Google Account → Security Tab
  1. Open your account control panel: Launch the official Gmail app on your Android phone. Tap your circular profile picture or initials in the top right corner. Tap the blue button labeled Manage your Google Account.
  2. Navigate to Security: Swipe across the horizontal menu bar at the top (Home, Personal info, Data & privacy) and tap on Security.
  3. Change your password: Scroll down to How you sign in to Google and tap Password. Enter your current code, then type your strong new passphrase. Tap Change Password.
  4. Set up 2-Step Verification and Passkeys: Tap directly on 2-Step Verification. Confirm that Authenticator app is added. If you have not already, tap Passkeys to bind your phone's fingerprint scanner directly to your account.
  5. Save offline emergency backup codes: Scroll down to Backup codes, tap Get backup codes, and write the 10 emergency numbers down on paper with a pen. Keep them inside a safe drawer in your bedroom.
  6. Review connected hardware: Scroll down to Your devices and tap Manage all devices. Look through every listed phone, tablet, and computer. If you see an unrecognized device or a machine from an old school, tap it and select Sign Out.
  7. Ensure Android operating system is up to date: Go to phone Settings > System > System update. Because Android generates account verification prompts, keeping the operating system updated prevents security bypasses.
✓ Done: Your Android email hub is fortified with multi-factor authentication, verified devices, and offline recovery keys.
3. WINDOWS PC ROUTE

How to Secure Your Email on Windows PC

Using a desktop web browser (Microsoft Edge or Google Chrome) makes reviewing settings and connected devices fast and clear:

Browser → Type official address → Profile Avatar → Manage Account → Security
  1. Open your web browser cleanly: Launch Chrome or Edge. Do not click search engine links that say "Ad". Type the official address yourself: myaccount.google.com for Gmail, account.microsoft.com for Outlook/Hotmail, or icloud.com for Apple Mail.
  2. Sign in safely: Enter your email and current password. If using a shared family laptop, never check the box that says "Remember me on this computer".
  3. Open Security settings: Click your profile picture in the top-right corner and select Manage your Google Account (or Security Dashboard).
  4. Change your password: Set a strong, unique password. If your web browser asks "Save password for this site?" on a public or shared computer, always click Never.
  5. Configure 2-Step Verification: Select Authenticator App. A square black-and-white QR code will appear on your Windows monitor. Pick up your mobile phone, open Google Authenticator, tap +, scan the computer screen, and type the 6-digit confirmation number into Windows.
  6. Purge stale sessions: Look under Your Devices. Click Sign out of all sessions to disconnect any background connections that may have been left open on other computers.
✓ Done: The Windows computer is authorized and your email is protected against unauthorized web logins.
4. MAC (MACOS) ROUTE

How to Secure Your Email on a Mac

Follow these steps using Safari or your preferred macOS browser:

Safari → Official Email Web Portal → Account Profile → Security Dashboard
  1. Open Safari: Launch Safari from your Dock. Type your provider's web address directly into the address bar (e.g. mail.google.com or outlook.live.com).
  2. Access the account security menu: Click your circular profile icon at the top right of the mailbox and click Manage Account > Security.
  3. Update your master passphrase: Change your password to a long, memorable 4-word phrase. Store it safely in your encrypted Apple Keychain or Bitwarden password manager.
  4. Enable Passkeys or Authenticator: Click Passkeys or Two-Step Verification. You can use your phone to scan the QR code, or use Touch ID on your Mac keyboard to create a local biometric passkey.
  5. Review recovery channels: Ensure your recovery phone number and backup email address are completely accurate.
  6. Audit authorized third-party apps: Look for a section titled Third-party apps with account access. Revoke permission from old games, third-party mail tools, or websites you no longer use.
✓ Done: Your Mac email portal is guarded with strong credentials and biometric access controls.

The hidden hacker trap: Auto-forwarding rules

A sneaky tactic used by cyber criminals is setting up secret email forwarding. If an intruder managed to break into your account in the past for even two minutes, they might have created an automatic rule that quietly sends a copy of every single email you receive straight to their own private inbox without you ever knowing!

How to check Gmail

1. Open Gmail on a laptop or desktop computer.

2. Click the gear icon in top-right > click See all settings.

3. Click the Forwarding and POP/IMAP tab.

4. Check the top line. If it says "Forwarding a copy of incoming mail to..." with an email address you do not recognize, click Remove immediately!

How to check Outlook

1. Open Outlook.com in a web browser.

2. Click the gear icon (Settings) in the top-right corner.

3. Click Mail > Forwarding (and also inspect Rules).

4. Ensure Enable forwarding is turned OFF, and delete any suspicious forwarding filter rules.

Zero-Tolerance Alert: Never approve an unexpected login prompt! If you are sitting on the sofa watching TV and your phone suddenly beeps with a notification asking: "Did you just try to sign in from Leeds?" or "Is this you signing in on Windows?", tap NO / DENY immediately! An attacker has your password and is trying to get you to let them in. Change your password right away.

Essential email security checklist

  • Use a long, unique passphrase (never reused on gaming, shopping, or social accounts).
  • Turn on Two-Factor Authentication using an authenticator app (Google or Microsoft) or a passkey.
  • Print or handwrite your 10 emergency recovery codes and store them safely offline.
  • Confirm your secondary recovery phone number and backup email are active.
  • Regularly review "Your Devices" and sign out of unknown computers, phones, or old sessions.
  • Inspect your mailbox forwarding settings to ensure no hidden rules copy your messages.
  • Lock your mobile email app with Face ID, Touch ID, or fingerprint lock.