Short answer: Advanced Protection is Google’s strictest security setting. It requires passkeys or security keys, blocks most third-party app access to your Gmail and Drive, disables app passwords, and makes account recovery deliberately harder. It is free and takes ten minutes. It is genuinely worth it if you are a plausible target — a journalist, activist, executive, campaigner, or anyone whose account would be valuable to someone specific. For most people it is more friction than they need.
What it actually changes
Enrolling switches on several things at once, and you cannot pick and choose:
- Passkeys or security keys required. No SMS, no authenticator app codes, no Google prompts as your primary. This is the core of it, and it makes the account phishing-resistant — see phishing-resistant MFA.
- Third-party app access restricted. Only Google apps and a small set of vetted others can read your Gmail and Drive. This breaks a lot of tools, deliberately.
- App passwords disabled. They bypass 2FA by design, so they go.
- Stricter download scanning in Chrome, blocking more risky files.
- Harder account recovery. Additional verification steps and delays, specifically to defeat social engineering of Google support.
That last point deserves emphasis. Recovery is where strong accounts are usually broken, not at the login screen — so making recovery slower is a real security gain rather than a side effect.
Who should enrol
The honest test is not “how important am I?” but “would anyone spend a week trying to get into my account specifically?”
Yes, enrol:
- Journalists, particularly those with sources.
- Activists, campaigners and civil-society workers.
- Political staff and candidates.
- Executives, finance staff and anyone who can authorise payments.
- People with significant crypto holdings — see 2FA for crypto.
- System administrators and anyone holding infrastructure keys.
- People experiencing harassment or stalking, where the attacker is a specific known person.
- Anyone who has already been targeted once.
Probably not: someone whose main concern is automated attacks and password reuse. A passkey plus unique passwords already handles that, without breaking your email client.
What it will break
Be honest with yourself about this before enrolling, because the friction is real:
- Third-party email clients. Older desktop clients that use IMAP with a password will stop working. Apple Mail and a few others are supported; many are not.
- Integrations. CRM tools, email trackers, backup services and automation platforms that read your mailbox will lose access.
- Sign-in on some devices. Older smart TVs, consoles and IoT devices that cannot handle a security key.
- Convenience during recovery. If you lose both keys, expect days rather than minutes.
You can leave the programme at any time, and access is restored. So trying it is low-risk, provided you check your critical integrations first.
How to enrol
- Get two security keys or set up two passkeys. Two is mandatory in spirit even where not required — a single credential on a programme this strict is asking for trouble. See which security key to buy.
- Go to g.co/advancedprotection and start enrolment.
- Register both credentials.
- Google signs you out everywhere; sign back in on your devices.
- Check what broke, and replace the affected tools.
For a Workspace organisation, administrators can enforce Advanced Protection for selected users or groups from the Admin console — see enforcing 2FA in Google Workspace.
The equivalents elsewhere
Google is not alone:
- Apple — Lockdown Mode for extreme cases, plus Advanced Data Protection for end-to-end encrypted iCloud, and security key support for Apple Accounts. See our Apple Account guide.
- Meta — Facebook Protect, applied to accounts judged high-risk, which enforces stronger authentication.
- Cloudflare — Project Galileo and Zero Trust for at-risk organisations, alongside standard account security.
If you qualify for one, you probably qualify for several. Enrol across the ecosystem rather than hardening one account and leaving another open. The same pair of keys can cover the lot — see using one security key for all your accounts.
The realistic alternative for most people
If Advanced Protection sounds like more than you need, you can get most of the benefit without the breakage:
- Add a passkey or security key to your Google account as a normal 2-Step Verification method.
- Remove SMS — the weakest enabled method is your real security level.
- Audit third-party app access yourself under Security → Your connections to third-party apps, removing anything unused.
- Disable app passwords if you do not need them.
- Check for forwarding rules and filters you did not create.
- Save backup codes offline — where to store them.
That is perhaps 80% of the protection with none of the broken integrations.
Frequently asked questions
Does Advanced Protection cost anything?
No, it is free. You may need to buy security keys, though passkeys on devices you already own can satisfy the requirement.
Can I leave the programme?
Yes, at any time, and normal settings resume. It is not a one-way door.
What if I lose both keys?
Recovery is intentionally slow and involves additional verification. This is the trade-off you are accepting — keep two credentials and store one separately.
Does it protect against malware?
Partly — stricter download scanning helps. But a compromised device can still have its session stolen, which no authentication method prevents. See session hijacking.
Will my phone still work normally?
Yes. Signing in on new devices requires your key or passkey; existing sessions continue.
Is it overkill for a small business owner?
Not necessarily. If you can authorise payments or hold customer data, you are a plausible target for business email compromise — which is exactly the scenario this defends against.
The bottom line
Advanced Protection is not a status symbol; it is a specific trade of convenience for resistance to targeted attacks. If someone would plausibly work at getting into your account, take the trade. If your concern is automated attacks and password reuse, a passkey and a tidy app-access list get you most of the way with none of the friction.
Not sure which category you are in? Read what is account takeover — it describes the attacks each level actually stops.