Your Google Security Checkup - 20 Minutes to Lock It Down

Where the Security Checkup Lives

Everything in this guide starts from one place: your Google Account page. Once you know how to get there, the rest is just reading and tapping.

• On a computer: open a web browser and go to myaccount.google.com. Sign in if it asks. Then click Security on the left.
• On a phone: open the Gmail or Google app, tap your picture in the top corner, then tap Manage your Google Account, then Security.

Which Phones and Computers Are Signed In

Google keeps a list of every device that is signed in to your account. Old phones you sold, a computer at a library, a tablet you gave the grandkids. Any of them could still have a way in. Time to tidy up.

• In the Security page, find Your devices and click Manage all devices.
• You will see each phone, tablet, and computer, often with the city and the last time it was used.
• Look for anything you do not recognize, or a device you no longer own.

Recent Security Activity: A Log of What Happened

Google keeps a diary of important events on your account: new sign-ins, password changes, and new devices. Reading it takes two minutes and can catch trouble early.

• On the Security page, look for Recent security activity.
• Click it to see a list, newest at the top, with dates and locations.
• Each entry says what happened, such as 'New sign-in' or 'Password changed.'

Your Recovery Phone and Email

If you ever forget your password or get locked out, Google uses your recovery phone and recovery email to prove it is really you and let you back in. If these are old or wrong, you could get stuck. If they belong to someone else, that is a serious problem.

• On the Security page, find How you sign in to Google or Ways we can verify it's you.
• Click Recovery phone and make sure it is a number you still have.
• Click Recovery email and make sure it is an address only you can open.

2-Step Verification: The Best Thing You Can Turn On

2-Step Verification means that even if a thief learns your password, they still cannot get in without a second step, usually a prompt on your phone or a code. It is the single strongest protection for your account, and it is free.

• On the Security page, click 2-Step Verification.
• Click Get started and sign in again if asked.
• Choose how you want the second step. A prompt on your phone that you just tap is the easiest for most folks.
• Follow the steps to the end, until it says it is on.

App Passwords and Authenticator Apps

Once 2-Step is on, you may run into two extra terms. Let me explain them plainly so they do not trip you up.

• An app password is a special one-time password for an older program that cannot handle the tap-on-your-phone step, such as an old email program on a computer.
• Most people never need one. If you do, you create it under 2-Step Verification, then App passwords.
• Review the list there once in a while. If you see an app password you do not recognize or no longer use, remove it.

Apps and Websites Connected to Your Account

Over the years you probably clicked 'Sign in with Google' on various apps and websites. Each one got some access to your account. Cleaning out the ones you no longer use is smart housekeeping.

• On the Security page, scroll to Your connections to third-party apps & services.
• Click See all connections to view every app and website you gave access to.
• Each one shows what it can see or do, such as read your calendar or your contacts.

The Old 'Less Secure App Access' Setting

For years Google had a setting called Less secure app access. It let older programs sign in with just your password, no second step. Crooks loved it. Google has been shutting it down, but it is worth understanding.

• If you ever turned this on for an old email program or device, turn it back off.
• The safer replacement is an app password, which we covered a couple of pages back.
• On most accounts today this option is already gone, which is a good thing.

Hidden Gmail Forwarding and Filters

This is one of the sneakiest tricks. If someone gets into your Gmail even briefly, they can set it to secretly forward copies of your mail to themselves, or to hide certain messages, and then leave. Even after you change your password, the trap stays. So let us check.

• In Gmail on a computer, click the gear in the top right, then See all settings.
• Click the Forwarding and POP/IMAP tab.
• Make sure no forwarding address is set that you do not recognize. Remove any you did not add.

Saved Passwords and Password Checkup

Google can save your passwords and, better yet, tell you which ones are weak, reused, or caught up in a known data breach. This is like a free health check for every password you use.

• Go to passwords.google.com, or on the Security page look for Password Manager, then Password Checkup.
• It shows three things: passwords that were found in a breach, passwords you reused across sites, and passwords that are weak.
• Start at the top with any marked as breached; those are the most urgent.

Security Alerts: Let Google Warn You

Google can send you a message the moment something important happens, like a new sign-in or a changed password. These alerts are your early warning system, so make sure they are turned on and going to the right place.

• Confirm your recovery email and phone are current; that is where many alerts go.
• Keep the Gmail app on your phone; critical alerts show up there too.
• When you get an alert, read it calmly. It will tell you what happened and what to do.

Fake 'Your Account Was Hacked' Emails

Crooks send emails and texts designed to scare you into acting fast. 'Your Google account was hacked. Click here now.' The message itself is the trap. Let me show you how to tell the fakes from the real thing.

• It creates panic and rushes you: 'act within 24 hours or lose your account.'
• It has a link or button that goes to a web address that is not google.com.
• It asks you to confirm your password, or read back a code, or call a phone number.
• The sender's address looks almost right but is a little off.

Passkeys: Signing In Without a Password

A newer option called a passkey lets you sign in with just your phone or computer's own lock, your fingerprint, your face, or your PIN. There is no password for a crook to steal or guess. It sounds fancy, but it is genuinely easier once it is set up.

• Nothing to remember and nothing to type.
• A thief cannot phish a passkey out of you, because there is no code or password to hand over.
• It uses the same fingerprint or face unlock you already use on your phone.

If Your Phone Is Lost or Stolen

Your phone is often the key to your whole Google account. If it goes missing, a few quick steps protect you, and you can do them from any other computer or phone.

• Go to myaccount.google.com and sign in.
• Open Your devices, find the lost phone, and choose Sign out.
• That cuts the missing phone off from your account until it proves your password again.

What Google Records, and Dialing It Back

Separate from security, Google keeps a record of your searches, the places you go, and the videos you watch, to tailor its services and ads. You can review this and turn much of it down.

• Go to myactivity.google.com to see and delete your history.
• Find Web & App Activity and turn on auto-delete after 3 or 18 months so nothing lingers for years.
• Review Location History and turn it off if you do not use it.

Backup Codes: Your Spare Key

The one thing that scares folks about 2-Step is the fear of being locked out. Backup codes are the answer. They are a set of one-time codes that get you in even if your phone is dead, lost, or has no signal.

• On the Security page, open 2-Step Verification.
• Find Backup codes and choose to Get or Show them.
• You will see a list of about ten codes. Each one works only once.

Family, Helpers, and Your Account

Many folks want a trusted family member to be able to help, without simply handing over the keys. Google has safer ways to share than giving out your password.

• Never give your Google password to anyone, even family. There are better tools.
• For photos, calendars, or documents, use Google's sharing options to give access to a specific item, not your whole account.
• A Family group lets you share things like a subscription or a calendar without sharing your sign-in.

Make It a Yearly Habit

You do not need to fuss over this every week. Once a year, pour a cup of coffee and run this short checkup. Everything stays locked down with very little effort.

• Run the Security Checkup and clear any yellow or red marks.
• Sign out old phones and computers you no longer use.
• Confirm your recovery phone and email are still correct.
• Confirm 2-Step Verification is on and you know where your backup codes are.
• Check Gmail forwarding and filters for anything you did not set.
• Run Password Checkup and fix reused or breached passwords.

What's in the 27-page PDF

• How to open Google's Security Checkup and read it like a report card
• Removing old phones and computers that are still signed in
• Checking recent security activity for anything you did not do
• Making sure your recovery phone and email are correct
• Turning on 2-Step Verification, the single best protection there is
• Finding sneaky Gmail filters and forwarding a hijacker may have left
• Cleaning up apps and websites connected to your account
• Spotting the fake 'your account was hacked' emails

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill