Google is urging Gmail users to spend two minutes auditing who and what can reach their inbox, pointing people to its Security Checkup tool as a quick way to catch forgotten devices, stale app permissions and outdated recovery details.
The company laid out the pitch in a blog post published October 30, framing the exercise as a routine but often neglected piece of account hygiene.
What the checkup covers
Google asked when’s the last time users checked who or what has access to their Gmail inbox, and recommended running a quick Security Checkup to protect email with three quick and easy steps.
Those steps are reviewing signed-in devices, removing old third-party app access, and confirming recovery information.
The tool itself is not new. Google has offered some version of Security Checkup for years, but the company is renewing attention on it as phishing and account takeover attempts remain common.
According to Google’s account help pages, users can run the checkup to get personalized security recommendations, including updating account recovery options and checking Gmail settings for unfamiliar activity.
Third-party access is the key category
Third-party app permissions are an area that can contain forgotten risks. Security Checkup lists apps and services that can access a user’s Google account data.
That may include calendar tools, email clients, file managers or productivity apps connected years earlier. Old integrations can remain active even after a person stops using them.
Google has made this same case before. In an earlier post explaining the feature, the company noted that the Security Checkup shows all non-Google apps that have access to a user’s data and flags potentially risky apps.
That lets people revoke permissions they are no longer comfortable with. The same controls are also available at myaccount.google.com under “Apps with account access.”
Separately, Gmail’s lesser known delegation feature has drawn fresh scrutiny because it works differently from standard app permissions. Reporting on the distinction found that third-party apps that connect through Google usually get narrow permissions, maybe access to sync contacts or read calendar events.
Gmail’s delegation feature is separate from all of these. It gives another person direct access to a user’s inbox, not a narrow slice of data. That kind of access also does not expire simply because a password changes; access ties to identity rather than a password, so when a password is changed or two-factor authentication is enabled, it does not affect a delegate’s access, which is one reason Google continues to recommend a manual review rather than relying on password resets alone.
Why Google is pushing this now
The renewed messaging arrives as account security remains a persistent target for attackers across major platforms. It follows a string of incidents this year involving automated and large-scale credential attacks.
That includes a recent password spray in which a China state-aligned actor Microsoft tracks as Storm-0940 used an AI agent framework to attempt sign-ins to more than 2,250 Microsoft 365 tenants at 2,900 attempts per minute.
Google’s guidance does not claim any specific new vulnerability prompted the post. Instead, the company is treating the checkup as preventive maintenance, similar to the periodic prompts it has issued since the tool’s original rollout years ago, when it first responded to concerns over third-party developers scanning Gmail inboxes for services like price comparison and travel planning.
How to run it
Gmail users can reach the tool directly through myaccount.google.com or by searching “Security Checkup” while signed into a Google account.
The process surfaces signed-in devices, recent security events, sign-in and recovery methods, and a full list of connected third-party apps in one screen.
Users can revoke access to anything they no longer recognize or use.
Google’s recommendation remains the same it has offered for years: run the checkup periodically rather than only after noticing something suspicious. Much of the exposure it catches, like a forgotten app connection or an outdated recovery phone number, tends to build up quietly over time.
That incremental mindset mirrors broader shifts in consumer tech, where devices such as the recently expanded screenless Fitbit Air increasingly tie personal data to a single Google account, raising the stakes for keeping that account’s access list current.
