SECURE YOUR YAHOO MAIL ACCOUNT

Protect the inbox that protects your other accounts.

Your Yahoo Mail account may contain password-reset messages, private conversations, documents and other information that could help someone access your other accounts.

Start with account access and recovery.

Yahoo's security controls help you protect sign-ins, recovery methods, connected devices and applications. Work through the checks below one at a time.

Yahoo may show slightly different options depending on your account, device, region and the sign-in methods currently enabled.

What should I never share?
Never give anyone your Yahoo password, verification code, recovery information or authentication approval. Yahoo states that it will not ask for your password through email or phone calls.
What if I no longer have my recovery phone or email?
Do not replace recovery information because someone claiming to help tells you to. Use Yahoo's official Sign-in Helper and follow the recovery options Yahoo provides for your account.
YAHOO ACCOUNT SECURITY

Protect the account, then protect the inbox.

Work through these checks one at a time. After each important change, use the VERIFY section to make sure the protection is actually active.

Turn on 2-step verification

Add another layer of protection so a stolen Yahoo password is less likely to be enough to access your account.

Click to see protection steps

Step-by-step

  1. Sign in to your Yahoo account.
  2. Open the Yahoo Account Security page.
  3. Find Ways of signing in.
  4. Select 2-step verification.
  5. Choose an available verification method, such as a phone, authenticator app or other supported method.
  6. Follow Yahoo's instructions to complete the verification setup.
  7. Complete the verification test if Yahoo asks you to confirm the new method.
  8. Return to Account Security and confirm that 2-step verification is active.

VERIFY: Confirm that 2-step verification is shown as enabled before relying on it to protect new sign-ins.

Keep your recovery information current

Your recovery phone number and alternate email can help you regain access when you forget your password or cannot sign in.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Review the recovery information associated with your account.
  3. Check the recovery phone number.
  4. Check the alternate or recovery email address.
  5. Make sure each recovery method belongs to you and is currently accessible.
  6. Replace information you no longer control using Yahoo's available account settings.
  7. Never add a recovery method because an unknown person tells you to.

VERIFY: Confirm that every recovery method belongs to you and that you can access it right now.

Use a strong, unique password

Your Yahoo password protects access to your email and other Yahoo services, so it should not be reused on other important accounts.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Under Ways of signing in, find the Password option.
  3. Choose the option to change your password.
  4. Create a strong password that you do not use anywhere else.
  5. Avoid passwords based on easily guessed personal information.
  6. Store the password securely, preferably in a reputable password manager.
  7. Never give your Yahoo password to someone claiming to be Yahoo support.

VERIFY: Confirm that the new password has been accepted and that you can sign in normally using it.

Review current sign-ins

Review the devices currently signed in to your Yahoo account and remove access you do not recognize.

Click to see protection steps

Step-by-step

  1. Open the Yahoo Account Security page.
  2. Find the Current sign-ins section.
  3. Review the devices currently signed in to your account.
  4. Check the device information and activity shown for each session.
  5. Investigate any device or session that you do not recognize.
  6. If a device is old, unused or definitely not yours, select it and choose Sign out.
  7. If you discover suspicious activity, change your password and review your other security settings.

VERIFY: Review Current sign-ins again and confirm that the remaining devices are ones you recognize and control.

Review recent account activity

Yahoo records important security changes and activity so you can investigate changes you did not make.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Find Recent account activity.
  3. Review the recent changes and security events shown.
  4. Look for changes involving your password, phone number, email address or sign-in activity.
  5. Pay particular attention to changes you do not remember making.
  6. If an activity was not yours, follow Yahoo's available security instructions.
  7. If necessary, change your password and review your recovery information.

VERIFY: You should be able to recognize the important recent security activity associated with your account.

Review connected apps and services

Third-party applications can connect to Yahoo through account permissions or app passwords. Remove access you no longer need.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Find External connections.
  3. Review the applications and services connected to your account.
  4. Identify anything you no longer use or do not recognize.
  5. Review the access method used by each connected service.
  6. If an application uses an app password and you no longer need it, remove that app password.
  7. Do not approve or maintain access simply because an application asks you to do so urgently.

VERIFY: Review External connections again and confirm that only services you recognize and still need remain connected.

Protect app passwords

Some third-party applications may use Yahoo app passwords instead of your normal Yahoo password. Treat them as sensitive credentials.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Find the section for External connections or app passwords.
  3. Review the app passwords currently associated with your account.
  4. Identify app passwords belonging to applications you no longer use.
  5. Remove an unnecessary app password using Yahoo's delete or remove option.
  6. If you see an app password you do not recognize, treat it as suspicious.
  7. Change your main Yahoo password if you believe someone else may have accessed the account.

VERIFY: Confirm that every remaining app password belongs to an application you recognize and still use.

Consider a passkey when available

Passkeys can provide passwordless sign-in using authentication built into your device, such as a fingerprint, face recognition or device unlock code.

Click to see protection steps

Step-by-step

  1. Open your Yahoo Account Security page.
  2. Look under Ways of signing in for passkey options.
  3. If passkeys are available for your account and device, choose the option to add a passkey.
  4. Follow Yahoo's instructions and complete the device's biometric or device-unlock verification.
  5. Give the passkey a recognizable name if Yahoo asks you to identify the device.
  6. Keep the device itself protected with a strong screen lock.

VERIFY: Confirm that the passkey appears as an active sign-in method and that you recognize the device associated with it.

Review important Yahoo Mail settings

An attacker who gains access to your mailbox may change forwarding, filters or other mail settings to hide messages or redirect information.

Click to see protection steps

Step-by-step

  1. Open Yahoo Mail and review your mail settings.
  2. Check for unfamiliar email filters.
  3. Check your forwarding or auto-forwarding settings.
  4. Review the reply-to address and send-only addresses where available.
  5. Check your vacation response or automatic replies.
  6. Review your email signature and sending information.
  7. If you find a setting you did not create, remove or correct it.
  8. If several settings were changed without your knowledge, treat the account as potentially compromised.

VERIFY: Confirm that your important Yahoo Mail settings match the way you intentionally configured the account.

Be careful with Yahoo verification requests

Verification codes and account-approval requests are security controls. Someone who obtains them may be able to bypass other protections.

Click to see protection steps

Step-by-step

  1. Never give your Yahoo verification code to another person.
  2. Do not approve a sign-in or verification request that you did not initiate.
  3. Be suspicious of messages asking you to provide a code, password or recovery information.
  4. Do not trust a message simply because it uses Yahoo branding or your name.
  5. Open Yahoo directly through a trusted route when you need to check your account.
  6. Remember that Yahoo says it will not ask for your password through email or phone calls.

VERIFY: Before approving a verification request or sharing information, confirm that you personally initiated the sign-in or account action.

Secure your account after suspicious activity

If you discover an unfamiliar sign-in, changed recovery information, unknown app connection or altered mail setting, treat the account as potentially compromised.

Click to see protection steps

Step-by-step

  1. Stop sending sensitive information while you investigate.
  2. Open the Yahoo Account Security page directly.
  3. Review Current sign-ins.
  4. Review Recent account activity.
  5. Review your recovery information.
  6. Review External connections and remove anything unfamiliar.
  7. Delete unfamiliar app passwords.
  8. Change your Yahoo password if you believe it may have been exposed.
  9. Check Yahoo Mail for changed forwarding, filters or other mail settings.
  10. If you cannot regain secure access, use Yahoo's official Sign-in Helper.

VERIFY: Do not return to normal account use until you have reviewed the suspicious activity and confirmed that your account, recovery methods and connected services are under your control.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Yahoo security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts