Your inbox holds the reset link for your bank, your password manager, your cloud storage, everything. Lose it and you lose them all. I run AliasFleet, an email-alias service built on one address per site, and this guide locks the inbox down in the order that matters: passkey, unique password, app audit, recovery options. Then it shrinks what any single site can do with it.
Order is the point: a strong password means little once it leaks, and a second factor means little if losing your phone locks you out for good.
| Step | What it stops |
|---|---|
| Step 1: Passkey or second factor | A password stolen and used alone |
| Step 2: Unique password | One leak spreading to every account |
| Step 3: App-access audit | Forgotten apps and sessions reading your mail |
| Step 4: Per-site aliases | One breach exposing your real address |
| Step 5: Mail-rule check | An intruder silently copying your mail |
| Step 6: Recovery options | Losing access to your own account |
Fix the sign-in first
Passwords fail one way: someone tricks you into typing one, guesses one, or finds one in a leak. A passkey fails differently, because there is nothing to type. It lives on your device, unlocked by fingerprint, face, or PIN, and a lookalike login page gets nothing from you. Google's wording is that passkeys cannot be written down or passed to a bad actor by mistake, and signing in with one proves the device is in your hands (Google 2-Step Verification).
- Create a passkey on the phone or computer you use. On a Microsoft account the path runs through Advanced Security Options, then Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key (Microsoft passkey setup).
- No passkeys on offer? Switch on two-factor authentication. Google calls its version 2-Step Verification, Microsoft's is two-step verification, Apple's is built into the Apple Account (Microsoft two-step verification, Apple two-factor authentication).
- Take the strongest second step on offer: a passkey or security key beats an authenticator app, an app beats a texted code, which Google warns can be vulnerable to phone-number-based hacks. A texted code still beats nothing.
- Keep your backup codes offline. Google hands you a set of 8-digit backup codes for the day you lose your phone. Print them and store them somewhere safe, never as a note on that same phone.
One trap: never set up a passkey on a shared or borrowed device, because whoever can unlock it can sign in as you.
One password, one inbox, nowhere else
Take a forum you joined in 2019 and forgot. Its leak pairs your email with the password you used there. If that password is also your inbox password, the forum leak just became an inbox takeover, and that becomes everything else, because every password reset flows through the inbox. Attackers run this play at scale, feeding leaked pairs into software that tries them site after site.
The fix is boring and it works: generate a long, random password for the inbox in a password manager, store it there, and never type it anywhere else. Not the same one with a different number at the end. NIST's current guidance, SP 800-63B-4, published July 2025, puts phishing-resistant authentication at the top of the scale. A password alone is the floor. Not the plan.
Skip scheduled rotation: changing the inbox password every few months pushes people toward weaker passwords with predictable tweaks, and current guidance no longer treats forced rotation as the answer. Change it when something happens: a breach, a strange sign-in, a lost device.
Google will never ring you to verify a code. Anyone who asks for one, by phone, email, or message, is mid-takeover. Hang up. Delete the message. Check the account yourself.
Audit what already has access
People skip this step, yet it finds the oldest mess. Over the years you signed in with Google on apps you forgot, handed mail access to a tool you used once, and left sessions running on devices you sold. Each one is a door left open.
- Third-party connections. Open your Google third-party connections and drop anything unfamiliar or unused. Removal stops the app reading your account from that moment, though it does not delete data the app already took. Watch Gmail access hardest: that permission matters most.
- Devices and sessions still signed in. In your Google Account, open Your devices and sign out anything unfamiliar, then repeat the pass in your Microsoft and Apple accounts.
- Run the checkup. End with Google's Security Checkup, covering devices, recent events, and third-party access in one pass.
Make every site's copy of your address expendable
Locking the inbox down is half the job. The other half is what other sites hold about you. Mostly, your address. When a site gets breached, the address it held goes with it. If that address is the one you use everywhere, the breach follows you everywhere. Have I Been Pwned lists 1,046 pwned websites and over 17.8 billion pwned addresses. Yours is probably in there already.
The fix: one alias per site, a separate forwarding address for each signup, all landing in your real inbox. Give the shop one alias, the forum another, your bank its own. When one site leaks, only that site's address goes. Pausing that alias stops the leak spreading. Your real address plus every other alias keep working. Our guide to which website leaked your email shows how the To line names the source; the set-up guide takes about two minutes.
An alias is no help against someone taking over the inbox itself. What aliases do is hold the damage: one site's breach cannot hand attackers the address you use for everything else. Containment, not prevention.
Begin with the accounts that matter most: email, banking, password manager, cloud storage, social accounts, then work outward. The free tier of AliasFleet covers 10 active aliases, enough for the accounts that matter most while you learn whether the habit suits you. Our guide to hiding your email address online covers the other half: removing the real address from places you already published it.
Check the rules an intruder would leave
An attacker inside your inbox does not always change the password. Sometimes they leave a rule quietly forwarding your mail to them, or a filter hiding password-reset emails from you. It survives a password change, so check anyway.
In Gmail, open Settings, then See all settings, and check two tabs:
- Forwarding and POP/IMAP. Forwarding on without your say-so gets switched off. Google's own forwarding help says a forwarding notice you did not set up means change your password at once and switch forwarding off. Gmail displays that notice for the first week, so a rule you did not set is hard to miss once you look.
- Filters and Blocked Addresses. Remove any filter you did not create. Above all, one that forwards, archives, or deletes mail. Check delegation too, under Accounts, for anyone else able to send or read your mail.
In Outlook, look through Rules in settings for anything you did not create. Google's hacked-account guide names the warning signs: you stop receiving emails, friends get spam from you, your username changes, emails vanish, or sent mail appears that you did not write. See any of those and treat the account as compromised.
Set recovery options while you still can
Recovery options decide whether you ever get your account back. Set them before you need them. Google states it plainly: no adding recovery info while locked out or mid-recovery (Google recovery options).
Set these three:
- Recovery phone. A number that belongs only to you, one you use regularly and keep with you. Note the lag: changes can take up to 7 days to take effect, and codes may still reach your previous info during that window, which gives you time to catch a change you did not make.
- Recovery email. An address you check often, different from your sign-in address. A recovery email identical to the account being recovered recovers nothing. Skip Google Voice: locked out, the code goes to a number you cannot reach.
- A second recovery method on top. Microsoft advises three pieces of security info, with good reason: lose one method and the password alone will not get you back in, and regaining access can take 30 days.
Check the recovery options for anything you did not add. An intruder who got in once usually adds their own phone or email first, so the next recovery goes to them. Found one? Remove it, then change the password.
Five minutes a month keeps it done
None of this stays done. The whole checklist shrinks to a five-minute monthly pass:
- Open Security Checkup and clear anything it flags.
- Look over devices and third-party connections for anything new.
- Eyeball forwarding and filters in Gmail, plus Rules in Outlook.
- Confirm the recovery phone and email are still yours.
That covers the maintenance. The setup above is one-off work, worth an hour, because the inbox behind it holds the keys to the rest. With the inbox locked down, the next job is the address itself: stop handing out the real one, hand each site its own alias, and turn the next breach into a pause instead of a crisis. Our breach-response guide covers the steps when a breach notice lands.
Top comments (0)