Set up two-factor protection for email
Short answer
Turn on the provider’s current two-factor method and store backup methods securely. First verify that your recovery contacts still belong to you.
What you need to know
Add a second barrier to account sign-in.
-
Set up protection while access is stable
Check that your existing sign-in and recovery methods are still yours. Configure a supported second factor according to the provider, test it and store any issued backup material securely outside the account it protects.
-
Protection is not incident cleanup
Adding another sign-in factor does not inspect forwarding, filters or delegated access. If you are responding to suspicious activity, review those separate controls too; do not describe enrollment as proof that all access is gone.
Check, act, and the limit
-
Start by checking
Review existing sign-in methods for unfamiliar entries.
-
Then act
Choose a supported method, test it, then store recovery options offline.
-
Know the limit
Two-factor protection does not remove already-authorized forwarding or connected apps.
Next guide: Passkeys for email accounts
Official sources
Provider security pages this guide is based on. Product details change, so check them before acting.
- Google Account Help: secure a compromised account support.google.com
- Google Account Help: 2-Step Verification support.google.com
HackEmail is an independent guide. We never ask for your password or verification codes, never read messages and never access anyone’s inbox. Not affiliated with Google, Microsoft, Apple or Yahoo.