Your inbox can be a recovery gateway
Many services send password-reset links and security notifications to your email. Access to that inbox may help someone interfere with other accounts. Protecting email is therefore a useful early step in improving your wider account security.
Use a unique password and stronger authentication
Choose a long password used only for your email account. Enable the provider’s supported passkey, security key or two-factor option. Complete the setup and keep a recovery route available. Do not assume that receiving email on a locked phone is the same as protecting the email account itself.
Check recovery details and sessions
Review your recovery addresses, phone numbers and signed-in devices. Remove details or sessions you do not recognize through the provider’s official security tools. Keep the recovery account protected too, so it does not become the weakest link.
Look beyond the sign-in screen
Check forwarding rules, filters, delegated access and connected applications. An unexpected forwarding rule could send copies of messages elsewhere even after you change a password. Review app passwords as well if your provider supports them; their access rules may differ from a regular interactive sign-in.
Respond to suspicious activity through the provider
If you see unexplained changes, open the official account-security page and follow its instructions. Review recent activity, change exposed credentials and revoke unwanted access. Notify affected services if your email was used to alter their accounts. Never send private inbox contents or recovery secrets to an unsolicited support contact.