Your email account is the most valuable thing you own online, and most people protect it less carefully than their bank.
The reason is simple: almost every other account you have can be reset through it. An attacker who controls your email does not need your passwords, because they can request new ones. That makes it the first thing worth securing and the thing worth spending the most effort on.
Long, unique, random passwords for every account. There is no way to do that in your head, so use a password manager and let it generate and remember them.
The reason unique matters more than complicated is credential stuffing. When any site is breached, the leaked username and password pairs get tried automatically against everything else. One reused password turns a stranger’s bad day into yours.
We recommended LastPass in the original version of this article. We would not now. It suffered a series of breaches culminating in attackers obtaining encrypted customer vaults, which means anyone whose master password was weak was exposed, and the incident handling was poor. There are several well-regarded alternatives, including open source options you can host yourself. The important thing is that you use one, that it supports two factor authentication on the vault itself, and that your master password is long.
Two factor authentication is the single most effective control available. Not all of it is equal:
If your provider supports passkeys, use them. If not, use an app rather than SMS where you have the choice.
Check your account for things an attacker may have left behind. This matters because a competent intruder does not just read your mail, they arrange to keep reading it after you change your password.
Forwarding rules. A rule quietly copying everything to an outside address survives a password change entirely. Check them, and delete anything you did not create.
Filters that hide things. A common trick is a rule that files anything mentioning “password”, “invoice” or “bank” straight into the archive, so you never see the alerts.
Connected apps and third party access. Anything you granted access to years ago still has it. Revoke what you no longer use.
App passwords. These bypass two factor authentication by design. If you have old ones from a mail client you no longer use, remove them.
Recovery details. Confirm the recovery email and phone number are still yours. Changing these is a standard step in an account takeover.
Do this now even if you have no reason to suspect anything. It takes five minutes and it is the check that finds a compromise nobody noticed.
Every major provider shows recent sign-in activity, including location, device and whether it succeeded. Look at it occasionally. You are watching for logins from places you have never been, or successful logins you cannot account for.
Turn on alerts for new sign-ins if the option exists, so you hear about it without having to remember to check.
Delete what you do not need, and remember that deleted and sent items are part of the mailbox too.
The point is not tidiness, it is reducing what an intruder gets. Years of archived mail typically contains account details, scanned documents, addresses, and messages from sites that still email credentials in plain text. If it is not there, it cannot be taken.
The same applies to attachments. Scanned passports and bank statements sitting in a mailbox from 2016 are a data breach waiting for an opportunity.
Most account compromises do not involve anyone breaking anything. They involve you being asked to log in.
The current standard is a convincing message about a failed delivery, a shared document, an unpaid invoice or a security alert, linking to a login page that looks exactly right. You type your password, and increasingly you type your two factor code too, which the attacker relays to the real site in real time.
The defence is a habit rather than knowledge: never sign in from a link in a message. Navigate to the site yourself. Passkeys handle this for you, which is why they are worth adopting, but the habit protects you everywhere else.
Be sceptical of urgency. Every one of these messages is designed to make you act before you think.
Have I Been Pwned will tell you which known breaches include your address, free. It is worth doing for every address you use, and worth registering for notifications so you hear about future ones.
If your address appears in a breach, change that site’s password and anywhere you reused it.
Everything above applies, plus a few things that are yours to get right rather than your provider’s.
Secure the control panel and the registrar account with the same care as the mailbox, because control of your DNS means control of your mail regardless of your mailbox password. Use IMAP over TLS rather than anything unencrypted. And publish SPF, DKIM and DMARC records, which stop other people sending mail that appears to come from your domain, and are the reason your own mail arrives rather than landing in spam. When a message does land in spam, or one turns up claiming to be from you, reading the headers tells you which of those checks failed and where the message really came from.
Two factor authentication on your main email account, then check the forwarding rules and connected apps. Those two steps take ten minutes and cover most of the realistic risk.
If you host with us and want help checking your mail setup or your authentication records, just ask.