Recommended Free Tools
Secure your primary email and cloud-storage accounts first: turn on the strongest phishing-resistant multifactor authentication (MFA) they support, replace reused passwords with long unique ones stored in a password manager, review recovery methods, and stop signing in through unexpected message links. Then apply the same controls to other high-value accounts and ask a workplace administrator to protect privileged access.
Why email and cloud accounts need priority protection
Your email account is often the reset channel for banking, shopping, social-media and work accounts. A cloud-storage account may contain documents, photos, customer data and shared files. If a phisher captures either account, they can read messages, impersonate you, reset other passwords, share malicious files or use your identity to target colleagues.
As an Amazon Associate I earn from qualifying purchases.
Phishing-resistant MFA reduces the chance that a stolen password alone will work. Password hygiene, cautious link handling and controlled recovery options close other routes. No single setting makes an account invulnerable, so use the controls as layers.
The prioritized account-hardening checklist
- Secure your primary email account. It is commonly the recovery path for other services.
- Secure cloud file-storage accounts. Protect personal drives and any account that can access shared workspaces.
- Enable the strongest MFA available. Prefer FIDO/WebAuthn or a physical security key; use an authenticator-app method when those are unavailable.
- Change every reused or exposed password. Give each account a long, unique password and store it in a password manager.
- Review recovery methods and active sessions. Keep recovery email addresses, phone numbers and backup codes under your control, and remove devices you no longer use.
- Change your sign-in behavior. Treat unexpected links, attachments and urgent requests as suspicious; open the known service address or app yourself.
- Ask an employer’s administrator for stronger controls. Privileged accounts should use phishing-resistant MFA and limited permissions.
Step 1: Turn on MFA, starting with email and cloud storage
Cybersecurity and Infrastructure Security Agency (CISA) guidance recommends MFA broadly, including email and file storage. CISA states, “Any form of MFA is better than no MFA,” while advising phishing-resistant MFA whenever it is available.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Provider labels and menu locations change, so use the current security or sign-in settings for the specific service rather than relying on a universal path. Look for labels such as multifactor authentication, two-step verification, security key, passkey or authenticator app.
- Sign in by typing the provider’s known address into your browser or by opening its official app. Do not begin from an unexpected email or text link.
- Open the account’s security, privacy or sign-in settings.
- Find the MFA or two-step-verification section and review every method offered.
- Enroll the strongest practical method, then add a backup method or recovery option before signing out.
- Complete a test sign-in from a device you control. Confirm that the prompt, key or passkey works and that you can reach your recovery method.
- Record recovery codes in a secure offline location if the provider supplies them. Do not store them in the same account they are meant to recover.
What phishing-resistant MFA does
FIDO and WebAuthn authentication uses a credential bound to the legitimate website or app. If a user is tricked into visiting a lookalike site, the credential is designed not to authenticate to that different origin. This is why CISA recommends FIDO/WebAuthn when a service supports it.
A passkey may use a device’s screen lock or biometrics to unlock a cryptographic credential. A physical security key is another hardware option. The key or passkey does not transmit a reusable one-time code that a fake site can simply ask you to type. Support varies by provider, browser, operating system and account type, so verify compatibility before making it your only method.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If phishing-resistant MFA is not available
Use an authenticator app rather than leaving MFA disabled. Number-matching approval is generally preferable to an app-generated one-time code because it can give you more context about the sign-in request, but neither option provides the same origin protection as FIDO/WebAuthn. SMS and email codes are weaker because a phisher may redirect, intercept or socially engineer the code. They are still usually better than no MFA when no stronger method is offered.
MFA methods compared
The hierarchy below reflects CISA’s small-business guidance as a broad comparison, not a guarantee that every provider supports every method. Account recovery, device support and usability can change the practical choice.
| MFA method | Phishing resistance | Support and recovery considerations | Practical use |
|---|---|---|---|
| FIDO/WebAuthn security key | Strongest common option in CISA’s hierarchy; designed to prevent authentication to a fraudulent site | Requires a compatible service, browser and device; enroll a backup key or another recovery method | Best default for high-value and privileged accounts when supported |
| Passkey using a device | Phishing-resistant when implemented through FIDO/WebAuthn | Usually tied to a device or synchronized credential system; plan for lost-device recovery | Convenient everyday sign-in on supported devices |
| Authenticator-app number matching | Better than a code for reducing some approval mistakes, but not equivalent to phishing-resistant MFA | Requires a registered phone or tablet; protect against unwanted prompts and enroll a backup | Good fallback when keys or passkeys are unavailable |
| Authenticator-app one-time code | Not phishing-resistant; a phisher can ask for the current code | Codes depend on the enrolled device and account recovery process | Useful fallback when supported and carefully verified |
| Biometrics | Usually device-specific; strongest when used to unlock a FIDO/WebAuthn credential rather than as a standalone remote factor | Depends on the device’s sensor and recovery settings; a biometric cannot simply be replaced like a password | Convenient local unlock paired with another account method |
| SMS or email code | Weakest common options in CISA’s hierarchy | Dependent on phone-number, mailbox and provider recovery security | Use only when stronger methods are unavailable, and replace it if the service adds better choices |
How to choose and enroll a security key or passkey
Check compatibility first
- Confirm that the email or cloud provider supports FIDO2, WebAuthn, passkeys or security keys for your account type.
- Check whether your computers and phones have the required USB, NFC or Bluetooth connection, or whether they support a platform passkey.
- Verify that the browsers and operating systems you use are current enough for the provider’s implementation.
- Check whether administrators have restricted key enrollment on a work account.
Enroll a backup before relying on the first credential
Register a second physical key, a passkey on another controlled device or a provider-approved recovery method. Keep a spare key in a safe place separate from the one you carry. Test the backup while you are still signed in and can correct a setup mistake. A security key that is your only factor can become a lockout risk if it is lost, damaged or left behind.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect the recovery path
Recovery can be weaker than normal sign-in. An attacker who controls a recovery email address, phone number or unprotected backup code may bypass the protection you just added. Use a recovery address that has its own strong password and MFA. Keep codes private, and remove old phone numbers, alternate addresses and devices that you no longer control.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStep 2: Replace reused passwords with unique, long credentials
MFA is an additional layer, not permission to reuse passwords. If one site is breached or a password is phished, attackers will try the same credential against email and cloud services.
- List your email, cloud-storage, password-manager and other high-value accounts.
- Change the primary email password first, followed by cloud storage and accounts that can reset other services.
- Generate a different password for every account. Let the password manager create and store random credentials where the provider allows them.
- Never paste a password into a page reached through an unexpected message. Navigate to the known service address or open the app yourself.
- Update passwords again if you entered them into a suspected phishing page, received a breach notice, or shared them with anyone.
A password manager helps create and remember unique passwords, but it does not determine whether a website or message is genuine. You must still verify the destination before signing in.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 3: Review account recovery, sessions and connected apps
Exact recovery workflows differ by provider and can change. Use the current account-security settings and read the provider’s instructions for your edition, region and account type.
Recovery review
- Confirm that the recovery email address belongs to you and is protected by a separate strong password and MFA.
- Confirm that the recovery phone number is current and that your mobile account has protections against unauthorized number changes.
- Generate new backup codes after a suspected exposure and store them outside the account.
- Remove recovery contacts, addresses and numbers that you no longer control.
- Understand the provider’s waiting periods or identity checks before you need them in an emergency.
Session and device review
- Sign out devices, browsers and sessions you do not recognize.
- Remove old phones, tablets, computers and security keys from the account’s registered-device list.
- Revoke third-party applications and integrations you no longer use. An app with mailbox or cloud-file permission may remain useful to an attacker even after you change the password.
- Check forwarding rules, mailbox delegates, shared-drive members and file-sharing links for changes you did not make.
Step 4: Recognize and avoid phishing
Phishing messages try to make a dangerous action feel urgent: signing in, opening an attachment, approving an MFA prompt, changing payment details or sharing a code. Suspicion should increase when the request is unexpected or when the sender pressures you to bypass normal procedures.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWarning signs
- The sender’s address is similar to, but not the same as, a real organization’s address.
- The displayed link text and the actual destination do not match, or the destination uses a misspelled domain, unfamiliar subdomain or shortened URL.
- The message creates urgency, threatens account closure or promises an unexpected refund, delivery or document.
- An attachment is unexpected, especially a macro-enabled document, executable file, archive or HTML file that asks you to sign in.
- The sender asks for a password, MFA code, backup code or approval that they should never need.
- An MFA prompt appears when you are not trying to sign in. Repeated prompts can indicate that someone already has your password.
A safer sign-in routine
- Do not use the link or phone number in an unexpected message.
- Open a saved bookmark you created earlier, type the known service address, or use the official app.
- Check the browser’s address and the provider’s sign-in context before entering credentials.
- Contact the sender through a separate, trusted channel if the request might be legitimate.
- Report the message through your organization’s or provider’s available reporting mechanism, then delete or quarantine it.
Handle MFA prompts carefully
Never approve a sign-in you did not initiate. If prompts continue, deny them, change the account password from a trusted device, review sessions and connected apps, and contact the provider or workplace administrator. Number matching can reduce accidental approvals, but it does not make an unexpected request safe.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
What to do if you clicked a phishing link
If you only opened the page
Close it without entering credentials or downloading files. Update the browser and operating system, run the security checks provided by your device, and watch the account for unusual sign-ins or changes. Treat the event as more serious if a file opened, a download ran or you approved an MFA request.
If you entered a password
- From a known-clean device, change the password immediately on the affected account.
- Change the same password anywhere else it was reused, beginning with email and accounts that control recovery.
- Revoke unfamiliar sessions and connected applications.
- Check forwarding rules, delegates, recovery details and cloud-sharing permissions.
- Ensure MFA is enabled and replace a weak method with FIDO/WebAuthn or a security key if available.
- Tell your organization’s security team or the provider using its official support channel.
If you shared a code or approved a prompt
Assume the attacker may have completed a sign-in. Follow the password-change and session-revocation steps immediately, then inspect mailbox rules, sent mail, cloud files and account changes. Warn contacts if messages may have been sent from your account.
Workplace and administrator controls
Personal caution cannot compensate for excessive privileges or weak organizational defaults. Administrators should apply controls consistently to email, cloud file storage, identity providers and applications that can reset or impersonate users.
Protect privileged accounts first
- Require phishing-resistant MFA for administrators, help-desk staff, finance users and other accounts that can change identity or security settings.
- Use separate administrative accounts rather than performing routine email and web browsing with an account that has elevated privileges.
- Enroll backup authenticators under controlled procedures and document emergency recovery without creating a bypass that anyone can request by email.
Use identity and access management to limit damage
- Grant only the permissions required for a person’s role and review them when roles change.
- Use groups, conditional access and device requirements where the identity platform supports them.
- Remove dormant users, stale guest accounts and unused application tokens.
- Restrict external sharing and review public links to cloud files.
- Log sign-ins, MFA changes, recovery changes, forwarding rules and privilege changes; alert on unusual locations, impossible travel or repeated denied prompts where those signals are available.
Make reporting and recovery routine
- Provide one obvious way for staff to report suspicious messages and unexpected MFA prompts.
- Teach staff never to disclose passwords, codes or approve unsolicited prompts, including to someone claiming to be support.
- Test account-recovery procedures and maintain an out-of-band administrator contact method.
- When an account is compromised, preserve logs, disable active sessions, reset credentials, revoke tokens and investigate mailbox and file-sharing changes.
Common mistakes and how to correct them
| Mistake | Why it fails | Correction |
|---|---|---|
| Using SMS as the only MFA method forever | SMS and email codes are weaker and depend on the security of the phone number or mailbox | Enroll FIDO/WebAuthn, a security key or an authenticator-app method when supported; retain a controlled backup |
| Using one password for email and cloud storage | A single phished or breached password can unlock both accounts | Generate a unique password for each account with a password manager |
| Keeping only one security key | Loss or damage can cause lockout | Enroll a backup key or provider-approved recovery method before the first key is needed |
| Trusting a familiar logo or display name | Those details are easy to copy in a message or fake page | Inspect the sender and destination, then navigate independently |
| Ignoring unexpected MFA prompts | Someone may already possess the password and be attempting a sign-in | Deny the prompt, change the password, revoke sessions and notify the administrator or provider |
| Securing login but not recovery and sharing | Recovery addresses, forwarding rules, tokens or public links can preserve attacker access | Review recovery settings, connected apps, mailbox rules and cloud permissions regularly |
A maintenance schedule that keeps protection effective
- Whenever you add an account: set a unique password, enable the strongest MFA, enroll a backup and record recovery details securely.
- After a device is lost or replaced: remove it from registered devices, revoke its sessions and confirm that passkeys or authenticator registrations are still under your control.
- After a suspicious message or prompt: report it, inspect sign-ins and account changes, and reset credentials if you interacted with it.
- When your job or responsibilities change: ask an administrator to remove permissions and application access you no longer need.
- Periodically: review recovery methods, connected applications, forwarding rules, shared files, public links and registered authenticators.
How do I protect my email from phishing?
Enable phishing-resistant MFA on the email account, use a unique password stored in a password manager, and open the mailbox through a known address or app instead of unexpected links. Review forwarding rules, delegates, recovery methods and active sessions. Treat requests for passwords, MFA codes or urgent sign-ins as suspicious and report them through the provider or your organization.
How do I secure my cloud account?
Apply the same controls to every cloud-storage identity: unique password, strongest supported MFA, backup recovery method, current devices and limited sharing. Inspect shared folders, public links, third-party apps and guest access. For work accounts, ask the administrator to enforce phishing-resistant MFA and least-privilege access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
