Least disruptive security changes first
The safest way to make an account more secure is to fix the easiest-to-reverse things first, then work toward the changes that can lock you out. Before you change a password, turn on MFA, or remove a trusted device, confirm your recovery email, recovery phone number, backup codes, and at least one other way back in. If you follow that order, you can tighten the account without turning a routine security cleanup into a recovery problem.
Start with the settings that are easiest to undo
Prerequisites
- Access to the account’s security or sign-in settings
- Your current recovery email address and phone number
- Any backup or recovery codes you already have
- At least one trusted device, security key, or other current sign-in method
- A password manager, if you use one
Steps
- Rank each change by how easy it is to reverse.
Use this rule: changes you can roll back without losing access go first, and changes that could block sign-in go last.
A practical order looks like this:
- Low risk: turning on alerts, updating contact details, installing an app, saving recovery codes.
- Medium risk: adding a new sign-in method while the old one still works.
- Higher risk: removing old methods, changing your primary password, revoking trusted devices, or tightening session rules.
- Keep one working exit route open while you make changes.
If a setting can be undone in a few clicks, it is a good early change. If it could replace your only recovery method, leave it until the new setup has been tested.
- Stop before each harder change and confirm your fallback still works.
If anything feels uncertain, do not move on yet. Verify the recovery path first, then continue.
Completion
You have the order right when the easiest changes are done first and you still have a working way back in before you touch the more disruptive settings.
Check what you can still use if something goes wrong
Before you change anything, list every recovery path the account still accepts. You want to know exactly what could get you back in if a password reset fails or your phone disappears.
Check for these items:
- Recovery email address
- Recovery phone number
- Backup or recovery codes
- Trusted or remembered devices
- Security keys
- Account recovery contacts, if the service uses them
- Administrator recovery options, for work accounts
Treat this as a safety-net check, not a formality. If the recovery phone number is an old number you no longer use, that is a problem to fix now. If the account says a device is trusted but you no longer have it, do not count it as part of your plan.
Update your contact info before you tighten login security
Confirm your current email address, phone number, and device access first, because those are often the easiest ways back into an account. If your recovery email still works but your recovery phone points to an old number, you may think you have two fallback options when you really have one.
Start by signing in and checking the account profile or security page for contact details. Make sure you can receive messages on the email and phone you see there. If a device is supposed to receive prompts or codes, confirm that you still have access to it and that it is signed in.
Only after that should you change passwords or authentication methods. Otherwise, you can end up with a brand-new password and a dead recovery path, which is exactly the kind of mismatch that causes lockouts.
Turn on alerts and sign-in notifications first
Alerts are one of the safest early changes because they improve visibility without taking away access. Turn on sign-in alerts, new-device notifications, and security emails before you make anything harder to reverse.
This gives you a heads-up if someone else tries to sign in, and it also helps you confirm that your own changes are being applied correctly. For example, if you add a new phone number or sign in from a new browser, a notification should help you see that the account is recognizing the change.
If the service lets you choose how alerts are delivered, pick at least one channel you check often. The point is not to create extra noise. The point is to know quickly when the account changes, and to catch a bad change before it becomes a recovery problem.
Use a password manager before you change passwords
A password manager gives you a safe place to store the current password, the new password, and any notes about recovery details. Without that, people often change a password and then forget the exact replacement they used, or they overwrite the old password before the new one has been confirmed everywhere.
If you already use a password manager, check that it is unlocked on the devices you plan to use. If you do not use one yet, set it up before you start changing account passwords. Add the current password first, then update it after the change is complete.
Keep the old password record until the new one has been accepted and saved correctly. That way, if the new password does not work on one device, you still have a clear record of the previous state while you sort it out.
Create and store backup codes before enabling stronger MFA
Before you turn on stronger multi-factor authentication, generate backup or recovery codes if the service offers them. These codes are your exit route if you lose the phone, delete the authenticator app, or reset the device that holds your second factor.
Store them somewhere you can reach even if your main device is unavailable. The exact place depends on the account and your setup, but the basic rule is to keep them separate from the device that could fail. If the only copy lives on the same phone as your authenticator app, that is not much of a backup.
Make sure you can actually find the codes again. A backup you cannot locate is the same as no backup at all. Once the codes are saved and you know where they are, you can add stronger MFA with much less risk.
Add a second factor before you remove the old one
The safe MFA sequence is to enroll the new method, test it, and only then retire the older one. For example, if you are moving from SMS codes to an authenticator app or a security key, add the new method first while the old one still works. Sign in with the new method once or twice so you know it is accepted.
Do not remove your old factor before you have tested the new one and confirmed you can still recover the account.
After that, you can decide whether to keep both methods or retire the weaker one. If the older method is still your only practical fallback, leave it in place until you have backup codes and another recovery path ready. The sequence matters more than the specific method. New path first, test it, then remove the old one.
Keep one trusted device or fallback method in place
Do not wipe out every familiar sign-in route at once. A previously signed-in device, a security key, or an alternate method can save you if the new setup fails in a way you did not expect.
This matters most during the transition. A phone can be lost, a browser can clear its saved session, and an authenticator app can be reset. If you remove the old device from the account before the new factor has been proven, you may strand yourself with no practical recovery path.
Leave one trusted route untouched until the new method has survived a real sign-out and sign-in. After that, you can decide whether the old route still needs to stay active. In many accounts, it is better to keep a second recovery option than to make the setup perfectly tidy.
Test the new setup with a real sign-out and sign-in
Do not stop after the settings are saved. Sign out completely, then sign back in using the new setup so you know the account really accepts it.
- Sign out of the account on the device you just changed.
- Sign back in with the new password and the new second factor.
- Confirm you can reach the recovery options page again.
- Try the recovery path once, if the service allows a safe test without locking the account.
- Verify that alerts, backup codes, and trusted devices still show the state you expect.
The expected result is simple: you should be able to get back in without relying on the old method you plan to retire. If something feels off, stop there and fix it before making any more changes. A successful test is the difference between a safer account and a locked one.
What to do if you almost locked yourself out
If you are already close to being locked out, slow down and use the safest recovery path you still have. First, check whether your backup codes were saved somewhere reachable. If they were, use one to regain access and then update the missing recovery details.
If you lost the authenticator app, look for a backup copy on another device or a synced account, if that was part of your setup. If you changed the wrong phone number, sign in through another trusted method and correct it before the account starts depending on the bad number.
If none of the recovery paths work, stop making more changes. Repeating failed sign-in attempts can make the situation messier, especially on work accounts with stricter controls. The priority is to recover one working path first, then clean up the others after you are back in.
The last changes to make when everything else is working
Only after you have tested the new setup should you make the tighter, harder-to-undo changes. That usually means removing old devices, retiring weaker login methods, shortening session timeouts, or requiring stronger MFA everywhere.
These are the changes that improve security the most, but they also reduce your margin for error. If you make them too early, they can remove the very fallback you need. If you make them last, they close off the remaining weak spots after you have already proven the account can survive a sign-out, a sign-in, and a recovery test.
At this stage, clean up anything temporary you used during the transition, like an extra verification method you no longer need. Keep the backup codes and recovery contact details current, though. Those are not temporary convenience items; they are part of the account’s safety net.
When it makes sense to stop halfway
Sometimes a partial upgrade is the right answer. If the account is shared with family members, used only occasionally, or tied to a device you cannot easily replace, a halfway setup may be safer than an aggressive one. The goal is not to squeeze every last hardening option into the account immediately. The goal is to improve protection without making recovery unrealistic.
Stopping halfway can make sense when you already have a current password, a verified recovery email or phone, alerts turned on, backup codes saved, and one strong second factor in place. If those pieces are working, you may not need to remove every older login method right away.
What matters is that you can still explain, in plain terms, how you would regain access if the main device disappears tomorrow. If that answer is clear, you have probably gone far enough for now.
Conclusion
Once the account can survive a sign-out, a sign-in, and a recovery test, you can finish the cleanup without much risk. Keep the backup codes where you can actually reach them, leave alerts on, and revisit the weaker login methods only after the stronger ones have proved themselves. If you are unsure about the next change, pause there. A safer account is not the one with the most switches flipped; it is the one you can still recover.
Frequently Asked Questions
Should I change my password or set up MFA first?
In most cases, set up your recovery options and backup codes first, then add MFA, then change the password. That order gives you a fallback before you touch the login itself.
Can I remove SMS authentication right away?
Not until you have another verified second factor, backup codes, and a tested recovery path. If SMS is your only backup, keep it until something stronger is in place.
What is the safest thing to do first on an account I barely use?
Start by confirming the recovery email and phone number, then turn on alerts. Those changes are low risk and help you avoid surprises later.
How do I know if I went far enough?
You have probably gone far enough when you can sign out, sign back in with the new setup, and still recover the account without depending on the old method you removed.