How to secure your email account after a breach
2 min read · Updated October 15, 2026
Change your email password to a unique one, enable two-factor authentication, review recovery email and phone details, sign out other sessions, remove unknown forwarding rules and filters and revoke apps you do not recognise. Your email account unlocks every other account, so it deserves the strongest protection.
Start with the account itself
Set a new, long, unique password that you have never used elsewhere. If you cannot remember it, store it in a password manager. Then turn on two-factor authentication.
Check the doors an attacker would leave open
- ✓Recovery email and phone number: make sure they are yours and current.
- ✓Forwarding addresses: remove any you did not create.
- ✓Filters and rules: look for ones that delete or hide security alerts.
- ✓Connected apps: revoke apps and extensions you do not use or recognise.
- ✓Signed-in devices: sign out of any you do not recognise.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Strengthen recovery
Recovery options are what protect you if you are locked out, but they are also a common target. Keep recovery details up to date, store backup codes somewhere safe offline and avoid recovery questions with answers that can be found on your social media.
Keep it secure over time
Review account activity every few months, keep your devices updated and be careful about where you sign in with your email account. Re-run a breach check periodically to see if new exposures appear.
Email security checklist
- 1Set a new unique password.
- 2Enable two-factor authentication (authenticator app, passkey or security key).
- 3Verify recovery email and phone number.
- 4Sign out of all other sessions.
- 5Remove unknown forwarding rules, filters and app permissions.
- 6Save backup codes offline.
- 7Check the address again with a breach checker in a few weeks.
Frequently asked questions
Which two-factor method is best?+
Passkeys and hardware security keys are strongest, authenticator apps are a good default and SMS is the weakest of the common options.
Should I create a new email address?+
Only if the old one is heavily exposed and impractical to secure. Usually securing the existing account is enough.
How do I know if someone still has access?+
Check signed-in devices, recent activity and forwarding rules. Changing the password and signing out of all sessions removes most access.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.