Google Advanced Protection: How Does It Protect Your Gmail and Google Account?

Many people use their Google account to read email, store files, keep contacts and photographs, or sign in to other online services. A Gmail address may also be where password reset messages for important accounts arrive. This makes Google account security relevant even to people who do not consider themselves likely targets of a sophisticated attack.

Google’s Advanced Protection Programme adds stricter sign-in requirements and extra safeguards around downloads, connected applications and account recovery. It can help reduce several common routes to account takeover, but it does not make a device, an account or the information inside it immune to attack.

This guide explains how the programme works, why Evening Computing recommends considering it, what may change when you enrol and what other security measures remain necessary.

Use the links below to jump to the sections most relevant to your question.

• What is Google Advanced Protection?
• Why the security of a Gmail or Google account matters
• How Advanced Protection changes the sign-in process
• What is the difference between a passkey and a physical security key?
• Which additional protections does Advanced Protection provide?
• What Advanced Protection does not protect against
• What restrictions and compatibility changes should you expect?
• Does it work with personal Gmail and Google Workspace accounts?
• Why we recommend considering Advanced Protection
• How to prepare and enrol safely
• Frequently asked questions
• What should you review after enrolment?
• Supporting references
• Related guides
• Further Guidance and Support

 Google Advanced Protection is an optional programme that strengthens the security of a Google Account. It is intended particularly for people at higher risk of targeted online attacks, but it can also be useful when an account holds valuable personal or business information.

It combines phishing-resistant authentication with additional controls on access by third-party applications, checks for potentially harmful downloads, and stricter procedures for account recovery. It is not a separate email service and does not replace Gmail, Drive or other Google products.

Enrolment is available without a Google subscription charge. If you choose physical security keys, you may need to purchase them separately. The stronger controls also bring restrictions, which are important to understand before enrolling.

A Gmail account often serves as a recovery address for shopping sites, social platforms, financial services and other accounts. A Google Account may also be used to store documents, contacts and photographs or to sign in to third-party services.

For example, if someone takes control of the Gmail address used for password resets, they may be able to request recovery messages for other services. Access to one email account can therefore create risks elsewhere, even when the attacker has never used those other services before.

For a small business owner or trustee, the same account may also be connected to customers, shared documents or administration tasks. The value of stronger authentication depends on what the account can access, not only on whether its owner considers themselves a likely target.

A conventional account may ask for a password followed by a one-time verification code. Although that is safer than using a password alone, a fraudulent website can sometimes persuade the user to enter both and relay them to a genuine service.

Advanced Protection requires a passkey or compatible security key when a new sign-in needs authentication. These methods use cryptographic checks associated with the genuine website, making them much harder to use on an imitation sign-in page.

You open the Google sign-in page → Google requests your passkey or security key → Your device or key verifies the genuine service → Google checks the authentication and allows or refuses the sign-in.

The check is especially important the first time you sign in on a new computer, browser or device. If you stay signed in, Google may not request the key every time. This is why stronger authentication does not mean that every active session is continuously re-authenticated.

A passkey is a sign-in credential built around a public and private cryptographic key pair. It can be held on a compatible phone, computer or hardware authenticator. To use it, you normally unlock the device or authenticator with a PIN, fingerprint, facial recognition or another supported method.

A physical security key is a separate device, often using USB or NFC. Some keys can hold passkeys, while others can provide other FIDO authentication functions. The passkey is the credential; the security key is a physical authenticator that may hold or use that credential.

Google allows enrolment using supported passkeys or FIDO-compliant security keys. Google recommends a primary security key and at least one backup if you choose the physical-key method. A suitable phone passkey may be more convenient for everyday users, while a dedicated hardware key may suit accounts needing an independent authenticator.

A passkey on its own does not mean an account is enrolled in Advanced Protection. Enrolment activates the programme’s additional account restrictions and recovery checks. Likewise, a secure passkey cannot compensate for an infected device or permissions that have been granted unnecessarily.

For a detailed explanation see our guide Are passkeys and security keys the same thing?

The programme brings together several controls designed to make account takeover and some forms of data access harder. These controls address different risks and should be understood separately.

Stronger resistance to credential phishing

An attacker who obtains an account password still faces the requirement to use the enrolled passkey or security key for a new sign-in. This reduces the usefulness of passwords collected through lookalike Google sign-in pages.

Restrictions on third-party application access

Some applications ask for permission to read Gmail, open Drive files, access contacts or use other Google data. Advanced Protection restricts access to Google apps and verified third-party apps, and permissions still have to be granted. A verified app is not automatically necessary or suitable: users should still review the access they authorise.

More stringent checks for potentially harmful downloads

Advanced Protection adds stricter download checks in supported Google experiences, including Chrome. A suspicious download may be warned about, scanned or blocked. The result depends on the file and available security checks, so the absence of a warning is not proof that a file is harmless.

Additional safeguards on Android devices

When an enrolled account is used on Android, Google applies additional Play Protect scanning and restricts many installations outside approved stores. Google documents exceptions, including Android Debug Bridge and preinstalled application stores. Applications already installed from other sources are not automatically removed.

Google also has a separate Android operating-system feature called Advanced Protection. Its device-level controls should not be confused with the Google Account Advanced Protection Programme described in this guide.

Stricter account recovery

If someone claims to have lost access to an enrolled account, Google applies extra identity checks during recovery. This helps reduce fraudulent recovery attempts but can delay legitimate recovery if the account owner loses all suitable authentication methods.

Advanced Protection strengthens important parts of account security, but it does not make the whole digital environment secure. Its boundaries matter because attacks can target devices, existing sessions, people and information-sharing choices.

Malware and already authorised sessions

The programme does not disinfect a computer or phone. Malware with sufficient access may still interfere with applications or information visible in a signed-in session. Strong sign-in requirements also do not automatically eliminate risks involving stolen session information or a device that is already under an attacker’s control.

Fraudulent messages and social engineering

Gmail’s filtering and Google’s safety checks can help with unwanted or harmful messages, but Advanced Protection cannot prevent every scam, telephone call or convincing request. A user could still be persuaded to disclose information, make a payment or approve an inappropriate action.

Incorrect sharing permissions

If a person shares a Drive folder publicly or sends confidential information to the wrong recipient, Advanced Protection does not automatically undo the sharing. Account authentication and control over who receives a document are different security questions.

Data loss and the need for backups

Advanced Protection is not a separate backup product and does not guarantee restoration of deleted or corrupted Gmail or Drive content. Data retention, independent backups where appropriate, and tested recovery arrangements remain necessary.

Organisation-wide device and access management

An enrolled Google account does not automatically make a personal computer an approved managed device. Google Workspace administrators still need to review device controls, application access, sharing, account ownership and related organisational policies.

Advanced Protection deliberately restricts some ways of accessing account data. Before enrolment, consider which applications and devices you depend on, especially where they are part of a business process.

• • Some older email applications, devices or integrations may fail if they depend on app passwords or less secure access methods.
  • Google says app passwords are not available for accounts enrolled in Advanced Protection; existing workflows using them need an alternative supported method.
  • Some third-party services and Apps Script projects may be blocked when they request sensitive data such as mail, documents or photographs.
  • New sign-ins require the chosen passkey or security key, and losing all usable authentication methods may result in a slower recovery process.
  • On enrolled Android devices, certain application installation methods may be unavailable or subject to additional checks.

These effects are not necessarily faults. They are consequences of reducing reliance on weaker authentication and broad application access. However, they should be checked before changing a business-critical account or one used by scanners, mail clients or automated integrations.

A personal Gmail account is a Google Account and can be enrolled if it meets Google’s requirements. You can also have a Google Account using a non-Gmail email address; the protection applies to that Google Account rather than only to Gmail.

Google Workspace accounts can use Advanced Protection when the organisation’s administrator has enabled it. Users should check with their administrator first, because the organisation may rely on centrally approved applications or security policies that affect enrolment and compatibility.

This difference is important for smaller organisations and charities. Enrolling a user in Advanced Protection does not, by itself, prevent that user from accessing files through an unapproved browser or computer. Separate device and data-access controls are still required if organisational policy demands them.

We recommend considering Advanced Protection for people whose Google accounts have significant personal, financial, administrative or business value. This includes people using Gmail as the recovery address for many other services, business owners, trustees, administrators and anyone responsible for confidential information.

The principal reason is that phishing-resistant authentication makes a common form of account takeover harder, while additional controls reduce certain routes for third-party applications to access sensitive information. Those are practical benefits even when the account owner is not a public figure.

The recommendation is not an instruction for every user to enable every control immediately. An account with legacy integrations, shared operational responsibilities or poor recovery arrangements should be reviewed first. The right objective is stronger security without unexpectedly losing access to essential work.

A little preparation makes it easier to adopt stronger authentication without introducing avoidable access problems. Google’s screens and terminology can change, so use its official instructions rather than relying on a permanent sequence of screenshots.

1. 1. Check the recovery email address and phone number for the Google Account, and make sure both remain accessible.
   2. Review existing passkeys, security keys and devices. Decide whether to use a compatible passkey, one or more physical keys, or a combination.
   3. Prepare a backup method and keep a physical backup key somewhere safe if that is the option you choose.
   4. Recovery contact information helps Google verify your identity if you lose access, but it should not be treated as a substitute for a working backup passkey or security key.
   5. Check which email applications, connected services, printers, scripts and automated processes use the account.
   6. Update and protect the devices used for authentication. Use a screen lock and keep the operating system and browser supported.
   7. For a Google Workspace account, check with the administrator before enrolling.
   8. Open Google’s official Advanced Protection Programme page, follow the enrolment instructions and verify that enrolment completed.
   9. After enrolment, test important sign-ins and integrations and confirm recovery methods remain available.

Google Advanced Protection Programme – official enrolment page: https://landing.google.com/intl/en_uk/advancedprotection/

If an essential application stops working, do not automatically weaken the account. Identify how the application authenticates and whether the supplier offers a supported alternative.

Is the programme free?

Yes. Google does not charge to enrol. Physical security keys may need to be purchased if you choose to use them.

Do I have to buy a physical security key?

No. Google supports enrolment with eligible passkeys. Physical FIDO-compliant security keys are another option.

Does a passkey give me all the programme’s protections automatically?

No. Using a passkey strengthens authentication, while enrolment adds the other programme controls, including restrictions on sensitive data access and stricter account recovery.

Can I still use Gmail, Drive and other Google applications?

Yes, ordinary Google products remain available. Particular third-party applications or integrations may need to be checked for compatibility.

Can I use the programme on an iPhone, Windows PC or Mac?

Yes, supported devices and compatible authenticators can be used. The exact passkey or security-key experience depends on the device, browser and operating system.

What happens if I lose my phone or security key?

Use another authentication method you prepared in advance if available. If you lose access to all suitable methods, you may need Google’s recovery process, which can take several days.

Can I turn it off?

Google allows unenrolment through the Google Account security settings after the required identity checks. Doing so removes the programme’s additional protection.

Is Advanced Protection a replacement for two-step verification?

It builds on stronger authentication and adds account restrictions. It is not a replacement for device protection, careful sharing, backups or the wider security measures used by an organisation.

Account security is not a permanent checklist. Devices, applications, threats and Google’s programme controls change, so the effectiveness of an account’s protection needs periodic attention.

Review your registered authentication and recovery methods, connected applications, important account activity and the devices used to access sensitive information. In organisations, review approved applications, user permissions and account recovery responsibilities as part of a wider security process.

Advanced Protection should be one part of layered security, alongside prevention, detection, containment, recovery and ongoing improvement. No single programme should be expected to cover every risk.

Google Advanced Protection Programme

Google Account Help: Get Google’s strongest account security with Advanced Protection

Google Account Help: Common questions about Advanced Protection

Google Account Help: Sign in with a passkey

Google Account Help: Use Advanced Protection with Android devices

Gmail Help: Sign in with app passwords

Android Help: Device-level Advanced Protection

Are passkeys and security keys the same thing?

What is layered security and why does it matter

This guide forms part of a broader layered security approach. For structured guidance on security and resilience planning, see our Security and Resilience page.

For information about practical implementation and ongoing support, you can review our IT services and local IT support coverage across London, Hertfordshire, and Essex.

Return to all guides