Short answer
To secure Google Workspace, an admin should enforce 2-Step Verification, push people toward passkeys or security keys, set a password policy, turn on Gmail’s advanced phishing and malware protection, and limit external sharing. Users should use a long unique password, turn on 2SV, and save backup codes. Each step is below, with the exact Admin console path.
What does Google Workspace already protect by default?
More than most people assume. Google says Workspace’s AI defenses in Gmail block more than 99.9% of spam, phishing, and malware, and that it offers login protections, data loss prevention, and client-side encryption for qualifying editions (Google Workspace security, checked 2026).
Google also says many of the settings in its own security checklist are on by default (Google security checklist, 2026). Your data’s physical home is covered in our guide to where Google Workspace stores your data.
How should admins harden Google Workspace security?
Work through these in order. The first three stop most account takeovers. The rest tighten email and sharing. Not every setting is in every edition, so check yours.
Protect the admin accounts first
Give every admin their own named account and never share one, so the audit log shows who did what. Use security keys for super admins and set up admin email alerts for suspicious sign-ins (admin account best practices).
Enforce 2-Step Verification
Go to Security > Authentication > 2-step verification. Allow it, tell people the deadline, then choose “Turn on enforcement from date.” Give new hires an enrollment period of 1 day to 6 months (Deploy 2-Step Verification).
Drop text and phone codes where you can
Under Methods, choose “Any except verification codes via text, phone call.” For high-risk people choose “Only security key,” which now accepts passkeys too. Move users to another method first, or they will be locked out.
Set a password policy
In Security > Authentication > Password management, check Enforce strong password and set a length between 8 and 100 characters. Leave expiration off unless compliance demands it (password requirements).
Turn on Gmail’s advanced safety settings
In Apps > Google Workspace > Gmail > Safety, switch on the attachment, link, and spoofing protections, plus “Apply future recommended settings automatically.” Also enable enhanced pre-delivery message scanning and set up SPF, DKIM, and DMARC.
Limit what leaves the domain
Set Drive’s default access to Restricted, warn users when they share outside the domain, and disable automatic Gmail forwarding. Turn off POP and IMAP for anyone who doesn’t need it (security checklist).
Review third-party apps and Security advisor
Block less secure apps and approve which third-party apps can reach Gmail and Drive. Then open Security > Security advisor and turn on what it recommends (Security advisor).
What can every Google Workspace user do?
Admin settings set the floor. These five habits are what each person controls.
Use a long, unique password
Google’s strength check rewards randomness and rejects common or breached passwords. A strong password doesn’t need a set number of symbols, so a long passphrase works. Never reuse your work password anywhere else.
Keep passwords in a password manager
That is the only realistic way to have a different password everywhere. We compare options in Google vs. business password managers.
Turn on 2-Step Verification
Even if your admin hasn’t enforced it yet. Google prompt on your phone is easier than typing codes, and it’s harder to phish than SMS.
Add a passkey or a security key
A passkey lets you sign in with your fingerprint, face, or screen lock. A physical security key does the same job on a USB or NFC device. Google treats both as phishing-resistant.
Save your backup codes
Print or store the backup codes somewhere safe. They get you in if you lose your phone or key.
Which 2-Step Verification method is most secure?
Passkeys and security keys. Google calls security keys the most secure form of 2SV and says passkeys give the same phishing protection (Google, 2026; Google, 2026).
| Method | How it works | Phishing resistance | Best for |
|---|---|---|---|
| Passkey | Fingerprint, face, or screen lock on your device | High | Most users |
| Security key | Tap a USB or NFC key | High | Admins and high-risk staff |
| Google prompt | Tap Yes on your phone | Medium | A step up from codes |
| Authenticator app | Six-digit code from an app | Medium | No phone signal needed |
| Text or call | Code sent to your phone number | Low | Last resort; admins can block it |
The resistance ratings are our summary of Google’s guidance, not a Google score.
Which Gmail safety settings should admins turn on?
All of them, to start, with the default “show warning” action. Google scans every message for malware either way, but these settings catch mail the defaults miss (Advanced phishing and malware protection).
| Setting group | What it protects against | Where to find it |
|---|---|---|
| Attachments | Encrypted attachments, scripts, and file types uncommon for your domain from untrusted senders | Gmail > Safety > Attachments |
| Links and external images | Harmful links behind short URLs and malicious linked images | Gmail > Safety > Links and external images |
| Spoofing and authentication | Look-alike domains, faked employee names, and unauthenticated mail claiming to be you | Gmail > Safety > Spoofing and authentication |
| Pre-delivery scanning | Phishing that needs extra checks before it lands | Gmail > Spam, Phishing and Malware |
How do you check that your settings are working?
Use the reports Google already gives you. Reporting > User Reports > Security shows who has enrolled in 2SV and how many security keys each person has.
On Enterprise editions, the security center adds a dashboard for external sharing, spam, and email authentication. Its security health page flags settings that differ from Google’s recommendations.
Frequently asked questions
Is Google Workspace secure enough for a small business?
Out of the box it covers a lot. Google says Gmail blocks more than 99.9% of spam, phishing, and malware (Google, checked 2026). The gaps are usually settings an admin never turned on, like enforced 2-Step Verification, Gmail’s advanced safety options, and limits on external Drive sharing.
Does Google Workspace require 2-Step Verification?
Google is enforcing 2-Step Verification for administrator accounts (Google Workspace Admin Help, 2026). For everyone else it is your call. You can allow it, then enforce it from a set date and give new hires an enrollment period of 1 day to 6 months.
Can I block text message codes for 2-Step Verification?
Yes. In the 2-Step Verification settings, pick the method “Any except verification codes via text, phone call,” or go further with “Only security key,” which now accepts passkeys too. Move users to another method first, or they get locked out.
What password length can a Google Workspace admin require?
You set a minimum and maximum between 8 and 100 characters under Security > Authentication > Password management. Google turns password expiration off by default because research showed little security benefit (Google Workspace Admin Help, 2026).
What is Google’s Advanced Protection Program for Workspace?
It is a bundle of strict policies for people likely to be targeted, such as super admins and business leaders. Enrolled users must sign in with a security key or passkey, risky third-party apps are blocked, and Gmail scans their mail more deeply.
Where do I find Google’s own security recommendations?
Security advisor (Menu > Security > Security advisor) lists recommended settings for Business and Enterprise editions. Enterprise editions also get the security center and its security health page, which flags settings that differ from Google’s advice.
Sources: Google Workspace security; Security checklist (100+ users); Admin account best practices; Deploy 2-Step Verification; Password requirements; Advanced phishing and malware protection; Advanced Protection Program; Security advisor; Security center. Checked October 23, 2026.