Your account has three layers of protection: a strong passphrase, two-factor authentication, and full visibility over devices and sessions. This guide configures all three.
Use case
Harden a fresh account
- Goal
- Reach a security posture where a stolen password alone is useless.
- Scenario
- You just created the account and want the strongest setup before doing real work.
Steps
- 1Open Settings → Security.
- 2Enable two-factor authentication with an authenticator app.
- 3Save the ten recovery codes somewhere safe.
- 4Review the active-device list and revoke anything you do not recognize.
- 5Confirm security notifications are enabled.
Outcome
An attacker needs your password and your physical device to get in, and you get an email the moment a new device signs in.
Enable two-factor authentication
- 1
Go to Settings → Security and choose Enable two-factor.
- 2
Scan the QR code with any authenticator app.
- 3
Enter the six-digit code to confirm enrollment.
- 4
Store the recovery codes now — not later.
Understand the device inventory
Every sign-in records a privacy-preserving device entry: browser, approximate location, and time. Raw IP addresses are encrypted; only you can see this list.
- Recognized device: you have signed in from it recently — no interruption.
- New device: you receive an email immediately with a review link.
- Review link: marks the activity recognized, or triggers containment.
Contain a suspicious sign-in
Use case
Respond to a new-device alert
- Goal
- Shut down a sign-in you did not make, without waiting for support.
- Scenario
- You receive a new-device email about a login from a country you are not in.
Steps
- 1Open the review link in the email.
- 2Choose Report — this revokes every active session immediately.
- 3Two-factor factors and recovery codes are removed and reset.
- 4Follow the recovery email to set a fresh password.
Outcome
Every attacker session is dead within seconds and identity control returns to your inbox.