How your security score is made up, what each check looks at, and how to use the next actions to raise it.
On this page
The Checkup tab scores your account out of 100 and lists what to do next. It is titled Security checkup and says it shows how well your account is protected and what to do next. The same score appears as a ring on the account overview and as a row on the Security overview.
Unlike the other Security tabs, the checkup does not ask you to confirm with a second factor first. It is open to any signed-in session.
At the top three figures: Your score with out of 100 and a level, Checks that need attention, and Checks that are good. The level is one of Strong, Fair and Needs attention.
Do these in this order lists each check that needs attention, numbered, with what to do, how many points it would earn (for example +40 points) and an Open button that goes to the page where you fix it.
How the score works explains the rules in three short points, described below.
All checks is a table with the check, its status (Good, Needs attention or At risk), its points as earned out of possible (for example 0 / 40) and an Open button when there is something to do.
When everything is good, the list says Nothing to do right now. This page updates as your account changes.
Your score, out of 100, with its level.
The first thing to do, with the points it earns.
Open, which goes to the page where you fix that check.
Security checkup: how strong the account is, and what to do next. Sample data./account/security/checkup
Each check is all or nothing: a good check earns all its points and one that needs attention earns none. That way you can always say exactly why you lost points.
Check
Points
Good when
Passkey
40
You have at least one passkey. Without one the status is Needs attention, or At risk if you also have no password and no authenticator app.
A way back in
20
You have a second passkey, or recovery codes you have not used, so losing one device cannot lock you out.
Password
15
There is no password, or the password has not been found in a known data breach. A password that appeared in a breach is At risk and the page says to change it now. A password that has not been checked against breaches is Needs attention.
Recovery codes
10
You have a few unused recovery codes left. With none issued, or only one or two left, the page tells you to generate a fresh set.
Sessions
10
No signed-in session has gone unused for a month. Otherwise it says how many have, and to sign them out.
Second email
5
You have a second verified email address.
The page also states what the score counts and what it does not: only things you can change on this account, and nothing about what you do in applications.
The page says it plainly: a score of 100 does not mean you cannot be phished. The score counts how many ways in and ways back you have, not how careful you are with them. Keep passkeys on devices you control, keep recovery codes somewhere safe and separate from your password, and be wary of any page that asks you to sign in after a message you did not expect.
The names and explanations of the individual checks are shown in the language of the page. A check explanation the page does not have a translation for is shown in English. The names quoted here are the English ones. See Languages.
The score updates as your account changes, so there is nothing to refresh by hand beyond reloading the page.