- The whole routine in seven steps
- Reading the shield and the coloured icons
- Signed-in devices and how to read sessions
- Removing third-party apps: what it does and doesn't do
- Recovery phone and email
- Passkeys, 2-Step Verification and updates
- The Gmail settings Security Checkup won't show you
- What I'd do today
- Frequently asked questions
To run Google Security Checkup, sign in to your Google Account, click your profile picture and choose Recommended actions, which opens Security Checkup with personalised fixes. Google's 30 October 2026 advice boils it down to three quick checks: review your signed-in devices, remove old third-party app access, and confirm your recovery information.
That takes a few minutes. What it doesn't cover sits inside Gmail itself: forwarding, filters and delegate access live in Gmail settings, and no Security Checkup screen shows them. Here's the full run, in order.
The whole routine in seven steps
- Sign in to your Google Account and open Security Checkup from your profile picture, then Recommended actions.
- Open Security & sign-in, then Manage all devices, and sign out of anything you don't recognise.
- Open the linked apps page and remove access for apps you no longer use.
- Confirm your recovery phone number and email are yours.
- Create a passkey and turn on 2-Step Verification.
- In Gmail settings, check forwarding, filters and delegate access.
- Update Chrome, your operating system and your apps.
Reading the shield and the coloured icons
Security Checkup gives personalised recommendations for your account, such as adding or updating recovery options, creating a passkey, turning on 2-Step Verification and removing risky access to your data. The icons tell you how urgent each one is.
| What you see | What it means |
|---|---|
| An exclamation point next to Recommended actions | Google recommends you take active steps |
| A blue item | A security tip |
| A yellow item | An important step |
| A red item | An urgent notification |
| A green shield with a check mark | The account is healthy and no immediate action is needed |
| No Recommended actions option at all | Google has no security recommendations for you |
If Recommended actions doesn't appear, you can still go to your Google Account, then Security & sign-in. A green shield at the top there means every recommendation is resolved.
Signed-in devices and how to read sessions
Go to your Google Account, open Security & sign-in, and on the Your devices panel select Manage all devices. You'll see devices where you're signed in now or have been in the last few weeks. If you're not sure every session is yours, sign out of the ones you don't recognise.
Don't panic at a long list. A session is a period of time you're signed in from a browser, app or service on a device, and it's normal to have several on one device. A new session can start when you sign in on a new device, re-enter your password, sign in on a new browser or app, grant an app access to your account data, or sign in on a private window.
The time shown next to a device also trips people up. It's the last time that device or session talked to Google's systems, which can include automatic background syncing, so it can look more recent than the last time you picked it up.
Removing third-party apps: what it does and doesn't do
Open your Google Account's linked apps page, select the app, choose Remove access and confirm. That stops the app reaching your data from then on. It doesn't wipe what the developer already holds: data you gave it earlier may still be on their side, and you may need to contact the developer to ask them to delete it.
Sign in with Google links work the same way. Deleting one stops Google signing you in to that app automatically, but it doesn't delete your data on the app. Before you give any new app access, Google suggests reading its privacy policy and security disclosures.
Recovery phone and email
Your recovery phone number and email address do three jobs: they can block someone using your account without permission, alert you to suspicious activity, and help you get back in if you can't sign in. If you see recovery changes you didn't make, Google says to correct the setting immediately.
Passkeys, 2-Step Verification and updates
Passkeys are Google's simpler, more secure alternative to passwords. You sign in with a fingerprint, face scan or phone screen lock. Unlike passwords, passkeys can't be shared, copied, written down or handed to someone by accident, which makes them stronger against phishing. If passwords are still part of how your team works, a password manager for a small business is the next best habit.
2-Step Verification stops someone getting in even if they steal your password, and Google says to choose a stronger second step than text-message codes. In Google's own order:
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- Security keys are the most secure option.
- Google prompts are more secure than text codes.
- Text-message codes are the step Google suggests moving beyond.
People at risk of targeted attacks, such as journalists and activists, can enrol in the Advanced Protection Program, which uses security keys and blocks unsecure apps. And keep your browser, operating system and apps updated, with automatic app updates and Google Play Protect turned on for Android. To check Chrome on a computer, open More, then Help, then About Google Chrome. It checks for updates on that page, and you click Relaunch to apply one.
The Gmail settings Security Checkup won't show you
This is the part a green shield doesn't cover. Google's Gmail checklist points to these settings:
- In Gmail, open Settings, then See all settings.
- On Accounts and Import, check Send mail as for addresses you don't know.
- On the same tab, check Grant access to your account for people you don't know, and look over the POP3 account list.
- On Filters and Blocked Addresses, look for a Forward to filter pointing at an address you don't know, and for filters that delete messages that you didn't set up.
- On Forwarding and POP/IMAP, make sure messages aren't being forwarded to an account you don't recognise.
- Check your signature and vacation responder look right, and that the responder isn't switched on when you don't need it.
If you use forwarding on purpose, this guide to setting up Gmail forwarding shows where those settings live, which makes a rule you didn't create easier to spot. If you think someone has access they shouldn't, Google's Gmail guide says to reset your password immediately. And if a suspicious email asks for personal or financial information, don't reply or click its links.
What I'd do today
I'd do the Gmail settings check on the same day as Security Checkup, because the green shield doesn't cover forwarding, filters or delegates. I'd create a passkey and move your second step off text codes if you can. And I'd look at your recovery phone and email every time you change number or address, since they're what gets you back in when something goes wrong.
Frequently asked questions
How do I get to Google Security Checkup?
Sign in to your Google Account, click your profile picture and click Recommended actions. That takes you to Security Checkup.
What does the green shield mean in Security Checkup?
A green shield with a check mark means your account is healthy and no immediate action is needed.
Does removing an app's access delete my data?
No. Removing access stops the app reaching your data from then on, but the developer may still hold data you gave it earlier, so you may need to ask them to delete it.
Why does a device show a recent time when I haven't used it?
The time is the last time that device or session talked to Google's systems, which can include automatic background syncing.
Where do I check Gmail forwarding and delegates?
In Gmail, open Settings, then See all settings. Forwarding is on the Forwarding and POP/IMAP tab, forwarding filters are on Filters and Blocked Addresses, and delegates are under Grant access to your account on Accounts and Import.
