Google WorkspaceAdvanced

How to Secure Gmail and Google Workspace Email Accounts: Complete Security and Recovery Guide

Quick Answer To secure a personal Gmail account or a Google Workspace email account, enable 2-Step Verification (2SV) or use a passkey, configure recovery in...

Bison Technical Team Enterprise IT specialists

Updated 15 Oct 2026 27 min read 1 total views

Structured technical guidanceSafety notes included where requiredSources listed below

Quick Answer

To secure a personal Gmail account or a Google Workspace email account, enable 2-Step Verification (2SV) or use a passkey, configure recovery information, secure every device that can access the account, review connected applications, and regularly check Google's security recommendations. For stronger protection against phishing, prefer passkeys or hardware security keys over SMS verification codes.

For a personal Google Account, open Google Account Security and review the available settings. For Google Workspace, users can configure the options permitted by their administrator, while administrators should enforce appropriate sign-in policies, protect administrator accounts, review suspicious activity, and prepare account-recovery procedures.

1. Understanding Gmail and Google Workspace Security

Gmail is Google's email service. It can be used through a personal Google Account, such as a Gmail.com address, or through a managed Google Workspace account, such as name@company.com.

Both account types use Google's authentication and security infrastructure, but some settings, recovery methods, and administrative controls differ.

Feature	Personal Google Account	Google Workspace account
2-Step Verification	Available, subject to account eligibility	Available, subject to organizational policies
Passkeys	Available on supported devices and browsers	Availability and passwordless sign-in behavior depend on account and administrator settings
Recovery phone and email	Available as supported by the account	Personal recovery options and administrator-assisted recovery depend on the organization's configuration and Google policies
Recovery contacts	Available for eligible personal accounts	Workspace accounts cannot add recovery contacts as a recovery feature
Recovery selfie video	Available only for eligible accounts, regions, and devices	Not available for Workspace accounts
Security policy management	Managed by the account holder	Managed partly by the Workspace administrator
Advanced Protection	Available to eligible individual users	Workspace uses its own administrative security controls and policies

Feature availability can change and may depend on region, device, account type, administrator settings, and Google's current policies.

2. Understand the Different Types of Security Controls

Not every security option serves the same purpose. Some verify your identity during sign-in, some help you recover access, and others reduce the risk of an attacker abusing an already signed-in session.

Security control	Main purpose
Strong password	Protects the account's primary sign-in credential.
Passkey	Provides phishing-resistant authentication using a device or security key.
Hardware security key	Provides a physical authentication method with strong phishing resistance.
Google Prompt	Lets you approve or deny a sign-in request on a trusted device.
Authenticator app	Generates time-based verification codes.
SMS or voice verification	Provides a code through a phone number, but is more exposed to phone-number attacks.
Backup codes	Provides one-time backup verification codes when other methods are unavailable.
Recovery phone and email	Help verify account ownership and restore access.
Recovery contacts	Let eligible personal-account users receive assistance from trusted people during recovery.
Security Checkup and device review	Help identify suspicious activity, unsafe settings, and unfamiliar devices.
Administrator controls	Allow Workspace administrators to manage organizational sign-in requirements and respond to incidents.

3. Use a Strong, Unique Password

A strong password remains important when password-based sign-in is available. Reusing a password across email, shopping, social media, and banking accounts creates a serious risk: a password stolen from one service may be tried against other services.

How to create a stronger password

Use a long password that is unique to your Google Account.
Consider a password manager to generate and store strong passwords.
Avoid names, birthdays, company names, phone numbers, and predictable patterns.
Never share your password through email, messaging applications, or telephone calls.
Change it immediately if you suspect it has been exposed or used without permission.

How to change your Google Account password

Open Google Account Security.
Under the sign-in section, open Password. You may be asked to sign in again.
Follow the instructions to set a new password.
Review your devices, recent security activity, and connected applications if the change was prompted by a suspected compromise.

For a managed Workspace account, the administrator may control password requirements or the account's authentication policy. Follow your organization's procedures if the option is unavailable.

4. Enable 2-Step Verification

2-Step Verification (2SV), also called two-factor authentication (2FA), adds an additional identity check to password-based sign-in. If someone steals your password, the additional verification requirement can prevent them from signing in.

Google chooses the sign-in challenge based on the account, device, authentication methods, and security signals. Depending on your setup, you may be offered a passkey, Google Prompt, security key, authenticator code, or another supported method.

How to enable 2-Step Verification for a personal Gmail account

Open Google 2-Step Verification settings.
Sign in to the correct Google Account.
Select the option to turn on 2-Step Verification.
Complete the verification steps shown on screen.
Add more than one suitable authentication method where possible.
Generate backup codes and store them securely if that option is available.
Test a sign-in from a browser or device you control before relying on the new configuration.

Benefits

Reduces the risk of unauthorized access when a password is stolen.
Provides additional verification for unfamiliar or suspicious sign-ins.
Allows several authentication methods to be configured for different situations.

Important: 2-Step Verification is not a guarantee against every attack. An attacker may still exploit a compromised device, a stolen authenticated session, malicious application access, or a user who approves a fraudulent sign-in request.

5. Passkeys: A Strong Alternative to Password-Based Sign-In

A passkey is a cryptographic sign-in credential associated with a service and an authenticator. It can be used with a device's fingerprint reader, facial recognition, screen-lock PIN, or another supported device-unlock method.

Passkeys are designed to resist phishing because authentication is tied to the legitimate website or service. Unlike a password, a passkey is not a reusable secret that you type into a fake login page.

How to create a passkey

Open Google Passkeys settings.
Sign in to your account and complete any requested verification.
Select the option to create a passkey.
Follow the instructions to create it on the current device or another supported authenticator.
Use your device's screen lock, biometric authentication, or other supported confirmation method.
Review the passkey list afterward to understand which devices or authenticators are associated with your account.

Benefits of passkeys

Strong resistance to phishing and fake sign-in websites.
No need to type a password for supported passkey sign-ins.
Authentication can use a familiar device-unlock method.
A passkey can provide protection equivalent to the first and second authentication factors, so a separate second step may not be requested for that sign-in.

Important limitations

Passkey availability and synchronization depend on the device, operating system, browser, credential provider, and account configuration.
Protect the device's screen lock and keep its operating system updated.
If you lose a device, review your Google Account and remove passkeys associated with devices you no longer control.
For Workspace accounts, administrators may need to enable or permit the relevant passkey and passwordless sign-in behavior.

Creating a passkey can also enable a passkey-first sign-in experience. Review the available preferences if you want to continue using password-first sign-in where Google supports that choice.

6. Hardware Security Keys

A hardware security key is a physical authentication device that connects through USB, NFC, or another supported interface. Many keys support FIDO2 and WebAuthn standards. Supported keys can be used for passkeys or as a second authentication step, depending on the account and configuration.

Hardware security keys are particularly valuable for administrators, finance staff, business owners, and other users whose email accounts could expose sensitive business information.

How to add a security key

Open Google 2-Step Verification settings.
Complete the sign-in verification required to manage security settings.
Choose the security key option if it is available.
Connect or tap the key as instructed and follow the registration steps.
Register a second compatible key if permitted and practical, and store it in a separate secure location.
Test the key before relying on it as your only authentication method.

Benefits

Strong protection against phishing when used through supported FIDO authentication.
Does not depend on receiving an SMS message.
Can provide a reliable alternative when a phone is unavailable.

Important: Keep the key physically secure. If a key is lost, use another registered method to sign in, remove the lost key from your account, and register a replacement. Advanced Protection may impose stricter recovery requirements, making a backup key especially important.

7. Google Prompt

Google Prompt sends a sign-in notification to a supported phone that is signed in to your Google Account. You can review the request and approve it if you initiated the sign-in, or deny it if you did not.

How to use Google Prompt

Sign in to your Google Account on a supported Android device or a supported Google application on iPhone.
Open your Google Account's security settings and check that your device and sign-in configuration support Google Prompt.
When a sign-in prompt appears, check the displayed information and approve only a request you recognize.
Tap the option to deny or reject a request you did not initiate.

Google Prompt may be offered automatically when you sign in with a password and 2-Step Verification is enabled. It is not necessarily presented as a separate manual switch on every account.

Benefits

Convenient approval without manually typing a code.
Can help protect against attacks based on taking over a phone number.
Lets the account holder reject unexpected sign-in attempts.

Security rule: Never approve a prompt just to make a notification disappear. Repeated unexpected prompts may indicate that someone has your password. Deny them and investigate the account immediately.

8. Authenticator Apps and Verification Codes

An authenticator app, such as Google Authenticator, can generate time-based one-time passwords (TOTP). These codes usually change every 30 seconds and can work without a mobile network connection after the account has been configured.

How to configure Google Authenticator

Open your Google Account Security settings.
Open 2-Step Verification and complete any required verification.
Select the authenticator app option if available.
Follow Google's instructions to link the authenticator, which may involve scanning a QR code or entering a setup key.
Enter the code generated by the app to complete setup.
Secure the phone and the authenticator app, and understand how you will restore access if the phone is lost.

Benefits

Works when SMS delivery is unavailable, provided the authenticator has already been configured.
Does not require mobile network service to generate a code.
Offers an alternative to phone-based verification.

Limitations

Authenticator codes can still be stolen through phishing or social engineering. Enter them only on Google's genuine sign-in pages. Never send a code to someone claiming to be Google support, your IT administrator, or a colleague unless your organization's verified process explicitly requires a legitimate authentication action through an official interface. Google will not call you and ask you to disclose a verification code.

9. SMS and Voice-Call Verification

Google may offer a six-digit verification code sent by text message or delivered through an automated phone call. This can be easier to use than an authenticator or hardware key, but it is generally less resistant to attack.

How to configure phone verification

Open Google Account Security.
Open 2-Step Verification.
Choose the phone-based option if offered.
Enter the phone number and verify it using the instructions shown.

Security limitations

SIM-swap attacks may allow an attacker to take control of your phone number.
SMS messages may be exposed through compromised devices or messaging services.
Mobile coverage, roaming, carrier restrictions, and delayed messages can prevent timely delivery.

Use SMS as a supplementary option rather than your only backup when stronger methods are available. Secure your mobile carrier account with a strong password and any available account PIN or port-out protection.

10. Backup Codes

Backup codes are one-time codes that can be used to complete 2-Step Verification when your normal verification method is unavailable. They are particularly useful when you lose your phone or cannot access your authenticator.

How to generate backup codes

Open Google 2-Step Verification settings.
Find the backup codes option, if available.
Complete any requested verification.
Generate the codes and store them in a secure location that is separate from your everyday phone.
Use a code only when required during sign-in.
Generate a new set if your codes are lost or you suspect someone has accessed them. Generating new codes invalidates the previous set.

Google's standard backup-code workflow provides a set of 8-digit codes. The number of codes and availability can depend on account eligibility and security-program restrictions.

How to store backup codes safely

Use a reputable password manager or keep a printed copy in a locked, secure place.
Do not store them in the same email account they protect.
Do not upload an unprotected copy to shared cloud storage.
Never send them to another person or enter them into a link received in an unexpected message.

Backup codes may not be available for accounts enrolled in Google's Advanced Protection Program. Configure the recovery and backup methods permitted by that program instead.

11. Recovery Phone Number

A recovery phone number helps Google verify account ownership, deliver security-related messages, and assist with account recovery. It is distinct from a phone number configured specifically as a 2-Step Verification method, although the same number may be used in supported configurations.

How to add or update a recovery phone

Open Google recovery options.
Sign in and locate the recovery phone setting.
Add or update a number that you control and can access reliably.
Complete the verification requested by Google.
Confirm that the displayed number is correct and keep it updated if you change your mobile number.

Benefits

Can help restore access if you forget your password.
Can help Google verify that you own the account.
May help you receive security alerts or recovery challenges.

Do not use a number that belongs to a former employee, a temporary SIM, a public service, or someone who may lose access to it. If you change numbers, update the recovery information and test your remaining sign-in methods first.

12. Recovery Email Address

A recovery email is a separate email address that Google can use to help verify your identity, send security alerts, or assist with account recovery. It should be an address you regularly access and can keep secure.

How to add or update a recovery email

Open Google recovery options.
Find the recovery email setting.
Enter an email address different from the account you are protecting.
Complete the verification steps, if requested.
Sign in to the recovery email account and secure it with its own strong authentication and recovery methods.

Benefits

Provides another route for account recovery.
Can help you receive alerts about suspicious activity.
Reduces dependence on a single phone or device.

Important: A recovery email is only useful if you can still access it. If the recovery email is compromised, an attacker may gain additional opportunities to target your primary account. Avoid making two accounts dependent on the same weak password or the same single recovery device.

13. Recovery Contacts

Google recovery contacts allow eligible personal Google Account users to designate trusted people who can assist when the account holder is locked out. A recovery contact is different from a recovery email: the contact helps with a recovery process but does not receive the same account security alerts as the recovery email.

How to add a recovery contact

Open your Google Account and select Security & sign-in.
Under the sign-in options, open Recovery contacts if the feature is available.
Select Add recovery contact.
Enter the email address of someone you know and trust.
Verify the address carefully and send the request.
Ask the person to review and accept the invitation through Google's official interface.

The invitation expires after seven days. After acceptance, Google applies an additional waiting period before the contact can be used for account recovery. When recovery is needed, the contact may have to confirm a time-limited number through Google's process.

Important restrictions

Google Workspace accounts cannot add recovery contacts using this feature.
Accounts enrolled in the Advanced Protection Program cannot use recovery contacts as a recovery feature.
Child accounts have restrictions on adding or acting as recovery contacts.
Only select people you know personally and trust. Ignore unsolicited requests to become a recovery contact.

For business accounts, establish an administrator-assisted recovery procedure instead of relying on personal recovery contacts.

14. Selfie Video for Account Recovery

For eligible personal Google Accounts, Google may allow a user to save a selfie video in advance. If the user later loses access, Google may offer a new selfie video challenge and compare it with the previously saved video to help verify identity.

How to configure it

Open your Google Account and select Security & sign-in.
Look for Selfie video under the available sign-in options.
If the feature is offered, select the option to add a selfie video.
Follow the on-screen instructions and allow camera access when required.
Keep your saved video current if your appearance changes significantly.

Limitations and privacy

The feature is not available in every region or for every account or device.
Google Workspace accounts, child accounts, and accounts enrolled in the Advanced Protection Program cannot currently add selfie videos for sign-in recovery.
Having a saved selfie video does not guarantee that Google will offer or approve this recovery method in every situation.
Review Google's current information about how the video is used and retained before enabling it.

Do not confuse this feature with a general-purpose account PIN, security question, or a video verification request that Google may present for a different service or policy-related purpose.

15. Google Account PIN and Device Screen-Lock PIN

The phrase "Google Account PIN" can refer to different things. It is important to distinguish a device's screen-lock PIN, a PIN used by a passkey authenticator, and a PIN requested for a particular Google service or verification flow.

Device screen-lock PIN: Unlocks a phone or computer locally. A supported device may use its screen lock to authorize a passkey.
Passkey authentication: Uses the device's supported unlock method to authorize cryptographic sign-in. The device PIN is not simply sent to Google as your account password.
Service-specific PIN: Some Google services or verification processes may request a PIN for their own purpose. It is not a universal substitute for Gmail's password or 2-Step Verification.

There is no single universal Google Account PIN that replaces the password, 2-Step Verification, recovery phone, and recovery email for every Gmail account. Use the exact PIN only for the service or device that requested it, and never disclose your device-unlock PIN to someone claiming to provide support.

Recommended action

Enable a strong screen lock on every phone or computer used to access Gmail. Use a passkey where supported, and keep the device updated. For Windows computers, secure the Windows sign-in as well; however, a Windows PIN and your Google Account password are separate credentials.

16. Security Questions

Traditional security questions ask for answers such as a childhood nickname or the name of a first school. These answers can often be guessed, found on social media, or obtained through social engineering.

Google does not provide a general user-configurable list of traditional security questions as a standard Gmail account security setting. Google may ask account-specific questions or request other evidence during a recovery process, but these should not be confused with a permanent security-question feature that every user can enable.

Do not follow third-party guides that claim you can enable a universal Google security-question option through an unsupported settings page. Instead, configure the recovery methods that are actually available in your account.

17. Advanced Protection Program

Google's Advanced Protection Program is designed for people at increased risk of targeted online attacks, such as some journalists, activists, public-facing professionals, and administrators of sensitive accounts.

The program applies stronger account-protection requirements, including supported phishing-resistant authentication and restrictions on certain access and recovery methods. The exact requirements and available options depend on Google's current program rules and the account type.

How to review or enroll

Read the official Google Advanced Protection Program information.
Check the requirements for your account and devices.
Prepare the required authentication method or security keys and a backup plan before enrolling.
Follow Google's enrollment instructions and review any restrictions that may affect your applications or recovery methods.

Advanced Protection is not necessary for every user. Before enrollment, understand its recovery limitations and the effect it may have on applications or sign-in methods you use.

18. Review Devices, Recent Security Activity, and Active Sessions

Even a strong password and 2-Step Verification cannot fully protect an account if an attacker has access to a signed-in device or a stolen session. Review account activity regularly and after any suspected compromise.

Check devices and security events

Open Google Account Security.
Review recent security activity and investigate events you do not recognize.
Open the section showing your devices or devices where you are signed in.
Inspect unfamiliar devices, locations, and sign-in sessions. Location estimates may be imprecise, so consider the full context rather than location alone.
Sign out of devices you no longer own or trust.
Change your password and review authentication methods if you suspect unauthorized access.

What to do if an unfamiliar device appears

Use Google's official security settings to secure the account.
Remove unknown passkeys or security keys if they were added without your permission.
Review recovery phone numbers, recovery email addresses, and recovery contacts.
Review third-party applications and revoke access you do not recognize.
Check Gmail settings for unauthorized forwarding, filters, delegated access, and other changes.

19. Review Third-Party Apps and Connected Services

Third-party applications may request access to Google Account data, including email-related permissions. An application with inappropriate or unnecessary permissions can create risk even when your password is strong.

How to review application access

Open Google Account connections.
Review applications and services connected to your account.
Check what information or permissions each application can access.
Remove access for applications you no longer use or do not recognize.
For applications that you still need, verify that they are legitimate and request only the permissions necessary for their purpose.

Removing access can interrupt a legitimate application or integration. If an application is used for business operations, confirm its purpose with your administrator before revoking access.

For Workspace accounts, administrators can review and control certain third-party application access through the Admin console, depending on their edition and permissions.

20. Secure Gmail Settings Against Account Abuse

An attacker who gains access to Gmail may create settings that silently expose future messages or hide security notifications. After a suspected compromise, review Gmail itself in addition to the main Google Account security page.

Check forwarding and filters

Open Gmail in a web browser.
Open Settings and select See all settings.
Review the Forwarding and POP/IMAP section for forwarding destinations or access settings you did not configure.
Review Filters and Blocked Addresses for unfamiliar rules that forward, delete, archive, or mark messages as read.
Review Accounts and Import for unfamiliar delegated access or send-as settings.
Remove unauthorized settings and save any required changes.

Available options may differ by account type and administrator policy. Do not remove a legitimate company integration without checking its purpose.

Check for suspicious sent messages

Inspect Sent, Trash, Spam, and other relevant folders for messages or activity you do not recognize. Inform affected contacts if your account sent fraudulent messages. If this is a Workspace account, notify your administrator so the organization can assess the scope of the incident.

21. Protect Your Computer and Phone

Your email account is only as secure as the devices and browsers used to access it. Malware, malicious browser extensions, stolen cookies, and an unlocked device can undermine account protections.

Install operating-system and browser security updates.
Use a screen lock and enable device encryption where supported.
Remove applications and browser extensions you do not trust.
Install software from official or otherwise trusted sources.
Use reputable endpoint protection and keep it updated.
Avoid signing in on shared or public computers whenever possible.
Sign out of shared devices and do not save passwords on devices you do not control.
Never approve unexpected sign-in prompts or scan a QR code from an untrusted message to authenticate your account.

Do not disable security software or browser protections simply to resolve a sign-in problem. Diagnose the actual cause first.

22. Recognize Phishing and Fake Google Sign-In Pages

Phishing is an attempt to trick users into revealing credentials or approving an unauthorized action. Attackers may imitate Google, send fake storage warnings, claim that a mailbox will be disabled, or impersonate a company manager.

Practical precautions

Check the actual website address before entering credentials.
Open Google Account settings by typing the official address or using a trusted bookmark.
Be suspicious of unexpected messages asking you to sign in, approve a prompt, share a code, or install remote-access software.
Do not trust a message simply because it contains the Google logo or uses professional language.
Use passkeys or supported hardware security keys to reduce phishing risk.
Report suspicious messages through the available Gmail reporting options.

Google support will not ask you to disclose your password, backup codes, or one-time verification codes in an unsolicited phone call or message.

23. Additional Protection for Google Workspace Administrators

Workspace administrators should protect both their own administrator accounts and the organization’s user accounts. A compromised administrator can potentially change security policies, reset users' credentials, or alter access to business data.

Recommended administrator actions

Open the Google Admin console using an authorized administrator account.
Review the organization's 2-Step Verification policies and enforce suitable requirements for administrators and users according to the organization's risk and operational needs.
Prefer phishing-resistant methods, such as passkeys or security keys, for privileged accounts where supported by the organization's policy.
Maintain at least two appropriately protected administrator accounts when operationally suitable, with documented ownership and recovery procedures.
Keep backup authentication methods available for authorized administrators without weakening the organization's security policy.
Review available audit logs, security alerts, and account activity to identify unusual behavior.
Restrict third-party application access according to business requirements and the organization's Google Workspace edition.
Remove access promptly when an employee leaves or no longer needs it, following the organization's offboarding process.
Document how to respond if an administrator loses a phone, security key, or access to their account.

Understand Workspace policy differences

Workspace administrators can configure 2-Step Verification enforcement and related settings, but the available controls depend on the organization's edition, administrative privileges, and Google's current policies. Some features available to personal accounts, including recovery contacts and recovery selfie videos, are not available for Workspace accounts.

Do not assume that a user's personal Google Account recovery settings or enrollment options will be identical to those of a managed business account.

24. App Passwords and Older Email Applications

Some older applications or devices may not support modern Google sign-in methods. Google has historically provided app passwords for certain accounts and situations, but availability depends on account security settings and policy restrictions.

An app password is a separate credential for a compatible application, not a replacement for your main account password. Treat it as sensitive because it may allow an application to access account data within its permitted scope.

Prefer applications that support Google's modern sign-in flow.
Use app passwords only when the feature is available and genuinely required.
Never create one in response to an unsolicited request from an unknown person.
Revoke an app password if the application is retired, the device is lost, or unauthorized access is suspected.
Workspace administrators may restrict app passwords or older authentication methods.

For current eligibility and restrictions, consult Google's app password documentation.

25. What to Do If Your Gmail Account Is Hacked or Compromised

If you can still sign in, secure the account immediately. If you cannot sign in, use Google's official account recovery process rather than a third-party recovery service.

If you can still access the account

Open Google Account Security from a trusted device.
Change the password if it may have been exposed.
Review recent security activity and remove unfamiliar devices.
Review passkeys, security keys, phone numbers, recovery email addresses, and other authentication methods.
Remove unauthorized third-party access.
Check Gmail forwarding, filters, delegation, and send-as settings.
Secure the devices used to access the account.

If you are locked out

Visit Google Account Recovery.
Use a familiar device, browser, and location when practical.
Follow the verification options Google offers for your account.
Use a registered passkey, security key, authenticator, backup code, or other supported method if available.
If the account belongs to an organization, contact the Google Workspace administrator through a verified channel.

Do not pay strangers who promise guaranteed account recovery or share verification codes with them. Google may apply additional security checks or waiting periods, and no recovery method guarantees immediate access.

26. Troubleshooting Common Security Problems

Problem	What to check	Recommended action
Google Prompt does not arrive	Internet connectivity, signed-in devices, Google app notifications, and the selected account	Use another available sign-in method and verify the account on the phone.
Authenticator code is rejected	Correct account entry, device time settings, and whether the code has expired	Use a fresh code and check that the authenticator is linked to the correct account.
SMS code does not arrive	Phone number, mobile coverage, carrier restrictions, and message delivery	Try another offered method rather than repeatedly requesting codes.
Passkey is unavailable	Correct device, screen lock, browser support, credential provider, and account policy	Choose another supported sign-in method and review the passkey settings after regaining access.
Security key is lost	Availability of another registered key or alternative method	Sign in using an available method, remove the lost key, and register a replacement.
Backup codes are missing	Secure storage locations and whether a newer set was generated	Use another verification method or account recovery. Generate a fresh set after signing in.
Recovery phone or email is outdated	Whether you can still access the old recovery method	Update the information while signed in. If locked out, use the official recovery process.
Workspace user is locked out	Organization policies, authentication methods, and administrator access	Contact an authorized Workspace administrator for policy-compliant recovery.
Unexpected approval requests appear	Possible password exposure or attempted unauthorized sign-in	Deny the requests, secure the account, change a potentially exposed password, and inspect recent activity.

27. Recommended Security Setup for Different Users

User type	Recommended configuration
Everyday personal Gmail user	Strong unique password, passkey, updated recovery phone and email, device screen lock, and regular Security Checkup.
User who frequently travels	Passkey or security key, an additional available authentication method, updated recovery information, and securely stored backup codes if supported.
Business owner	Passkey or hardware security key, secure recovery arrangements, connected-app review, and regular account activity checks.
Google Workspace administrator	Phishing-resistant authentication where supported, enforced organizational policy, backup administrator access, audit-log review, and a documented recovery procedure.
High-risk individual	Consider Advanced Protection, suitable hardware security keys or supported passkeys, secured devices, and carefully planned recovery arrangements.

28. Security Verification Checklist

Use this checklist after configuring the account.

Confirm that the account password is unique and strong, if password-based sign-in is used.
Confirm that 2-Step Verification is enabled where appropriate and permitted.
Confirm that a passkey or another strong authentication method is registered.
Confirm that a backup authentication method is available.
Confirm that recovery phone and email details are correct.
Store backup codes securely if the account supports them.
Review recovery contacts or selfie video only if the personal account is eligible and you choose to use these features.
Review devices, recent security events, and third-party connections.
Inspect Gmail forwarding, filters, delegation, and other sensitive settings.
For Workspace, confirm the administrator's policies and recovery procedures.

How to verify the result

Return to Google Account Security and review the available security recommendations and configured methods. For Workspace, verify the settings that users are permitted to manage and confirm relevant policies with an authorized administrator.

Do not test recovery by deliberately locking yourself out of your only account. Instead, confirm that your registered devices and backup methods are accessible, that recovery details are current, and that any organization-specific recovery procedure is documented.

Frequently Asked Questions

Is 2-Step Verification enough to secure Gmail?

It significantly improves security, but it is not sufficient on its own in every situation. Use strong authentication, keep recovery details current, protect devices, review connected applications, and investigate suspicious account activity.

Which is safer: Google Prompt, SMS, or an authenticator app?

Passkeys and supported hardware security keys provide strong phishing resistance. Google Prompt is generally preferable to SMS when using password-based sign-in. Authenticator apps are useful when phone service is unavailable, but codes can still be phished. SMS is more exposed to phone-number attacks.

Can I use a passkey instead of a password?

Google supports passkey-based sign-in, including passwordless experiences for supported accounts and configurations. The options available depend on the account and administrator policies. Keep your device secure and maintain suitable recovery options.

Does a Google Account PIN replace 2-Step Verification?

No universal Google Account PIN replaces all authentication and recovery methods. A device screen-lock PIN may authorize a passkey locally, while other PINs may belong to specific services or verification flows.

Can I enable security questions for Gmail?

Google does not offer a general configurable set of traditional security questions as a standard Gmail security setting. Use the recovery methods displayed in your account.

Can I add a recovery contact to Google Workspace?

No. Google's recovery-contact feature is not available for Workspace accounts. Organizations should establish administrator-assisted recovery procedures.

Can I use a selfie video to recover a Workspace account?

No. Google's selfie-video sign-in recovery feature is not available for Workspace accounts. Follow your organization's recovery process or contact an authorized administrator.

What happens if I lose my phone after enabling 2-Step Verification?

You may be able to sign in with a registered passkey on another device, a hardware security key, an authenticator on another device, a backup code, or another method Google offers. Recovery depends on what you configured before losing the phone.

Should I store backup codes in Gmail?

Avoid storing unprotected backup codes in the same account they protect. Use a secure password manager or a protected offline copy that remains accessible if you lose access to Gmail.

Can a Google Workspace administrator enforce 2-Step Verification?

Yes. Workspace administrators can configure and enforce supported 2-Step Verification policies for their organization. Available controls and rollout behavior depend on the organization's configuration and current Google policies.

Will recovery information guarantee that I can recover my account?

No. Recovery information helps Google assess account ownership, but recovery is not guaranteed. Keep the information current and configure multiple supported authentication methods before you lose access.

Conclusion

Securing Gmail or Google Workspace requires more than a strong password. Start with a passkey or another strong authentication method, enable 2-Step Verification where appropriate, maintain current recovery information, and secure the devices that access the mailbox. Store backup methods safely and regularly review connected applications, account activity, and Gmail settings.

For Google Workspace, administrators should additionally enforce appropriate authentication policies, protect privileged accounts, monitor security events, and document recovery procedures. The strongest practical setup is one that combines phishing-resistant sign-in, carefully maintained recovery options, secure devices, and a clear response plan for suspected compromise.

Sources

YOUR FEEDBACK

Was this guide useful?

Your answer helps us keep BISONKB accurate and practical.