How to secure my Google account
Kahu team·Updated 2 Oct 2026·5 min read
Run Google's Security Checkup, add an up-to-date recovery phone and email, and turn on 2-Step Verification or sign in with a passkey. Then remove apps you no longer use from your account's third-party access and keep your browser and phone updated. It takes about 15 minutes.
Why your Google account matters so much
For many people and small businesses, one Google account holds email, documents, photos, contacts, passwords saved in Chrome and the login for other services. If someone gets into it, they can read your mail, reset other passwords and contact your customers as you. That makes it the first account worth protecting.
A 15-minute check
- 1Run Security CheckupGo to myaccount.google.com/security-checkup. Google gives personalised recommendations and shows devices, recent security events and connected apps in one place.
- 2Set recovery optionsAdd a recovery phone number and a recovery email you control. Google uses them to block unauthorised access and to help you get back in.
- 3Turn on 2-Step VerificationUnder Security, add a second step such as Google prompts, the Google Authenticator app, a security key or a text code. Save the backup codes somewhere safe.
- 4Create a passkeyA passkey lets you sign in with your fingerprint, face or phone screen lock. Google says passkeys cannot be shared or written down, which makes them more resistant to phishing.
- 5Remove risky app accessReview third-party apps connected to your account and remove anything you do not recognise or no longer use.
Which second step to choose
| Option | How it works | Worth knowing |
|---|---|---|
| Passkey or security key | Your device or a physical key confirms it is you | Google describes these as protecting against phishing |
| Google prompts | Tap to approve on your phone | Google says this is more secure than text codes. Only approve sign-ins you started. |
| Authenticator app | Generates a code on your phone | Works without signal |
| Text message code | A code sent to your phone | Better than a password alone |
| Backup codes | One-time codes you print or store | Your way in if you lose your phone |
Where Kahu fits
Two Thursday gaps at 11:00 and 14:30. Drafted messages to 6 waitlisted customers.
Updated the hours on your site and Google profile to Sat–Sun 8–2.
One post about the new hours, using your Sunday counter photo.Keep it secure
- Keep your browser, phone and apps updated, with automatic updates on.
- Use a screen lock on every device signed in to the account.
- Use Password Checkup in Google Password Manager to find weak, reused or exposed passwords.
- Remember Google never asks for your password or verification codes by email, phone call or message.
If you are at higher risk of targeted attacks, for example as a journalist or activist, Google offers a free Advanced Protection Program that uses passkeys or security keys and limits third-party access. Most small businesses do not need it, but it is there.
Frequently asked questions
What if I lose my phone with 2-Step Verification on?
Use a backup code, another second step you set up, or your recovery options. Set these up before you need them.
Can someone get into my Google account with just my password?
Not if 2-Step Verification or a passkey is set up and you only approve sign-ins you started.
How do I see where my account is signed in?
Security Checkup and the Security section of your Google Account list your devices and recent security events. Sign out of any you do not recognise.