In an era of sophisticated phishing attacks, SIM swapping, and data breaches, standard two-factor authentication (2FA) via SMS is no longer sufficient for high-risk individuals. If your Google account holds sensitive financial data, business secrets, or confidential communications, you need a stronger defence mechanism.
The Google Advanced Protection Program (APP) is the company’s strongest level of account security. It replaces standard authentication methods with strict hardware-based requirements, making it virtually impossible for remote attackers to hijack your account, even if they have your password.
What is the Google Advanced Protection Program?
The Advanced Protection Program is a free opt-in security upgrade designed specifically to safeguard users at high risk of targeted online attacks. This includes journalists, activists, business executives, and politicians, though any user can enrol to benefit from its features.
Once activated, the program enforces three strict security policies:
- Hardware Keys Required: You can no longer log in using a code texted to your phone or an authenticator app. You must physically insert or tap a registered hardware security key (like a YubiKey or Google Titan Key).
- Strict App Restrictions: To prevent malicious software from accessing your data, Google will block most third-party applications from requesting access to your Gmail and Google Drive.
- Enhanced Account Recovery: If you lose your hardware keys, the account recovery process is deliberately slow and requires extensive verification, preventing hackers from using automated recovery tools to steal your account.
What You Need Before Enrolling
Before you begin the setup process, you must purchase two FIDO-compliant security keys. Why two? One acts as your primary daily key (often kept on your keyring), and the other serves as a backup to be stored safely in a drawer or safe. If you lose your only key while enrolled in the program, you could be permanently locked out of your account.
We recommend buying one key that supports USB-C (for modern laptops and Android phones) and another that supports NFC (for iPhones and older devices).
How to Set Up the Google Advanced Protection Program
Once your two security keys have arrived in the mail, enrolling takes only a few minutes.
- Open a web browser on your computer and navigate to the Google Advanced Protection website (landing page).
- Click on the Get Started button.
- Sign in to the Google account you wish to protect.
- You will be prompted to register your security keys. Click Register security key.
- Insert your first key into your computer’s USB port (or tap it if using an NFC reader) and touch the gold contact pad when prompted. Give the key a memorable name, such as “Primary USB-C Key”.
- Repeat the exact same process for your second backup key.
- Review the final warning screen detailing the strict app restrictions and recovery limitations.
- Click Turn On.
You will immediately be signed out of your Google account on all your other devices. You must now log back in using your password and your newly registered physical security key.
What to Expect After Enrolling
Enrolling in the Advanced Protection Program introduces a trade-off between absolute security and minor convenience.
You will no longer be able to use Apple’s native Mail app on iOS or macOS to read your Gmail, as it does not meet Google’s strict third-party data requirements. Instead, you must use the official Gmail app. Similarly, if you frequently grant random productivity tools access to your Google Calendar, those connections will be blocked.
However, this minor friction is a small price to pay. By physically separating your authentication token from your digital devices, you ensure that no remote attacker on the other side of the world can ever compromise your digital life.
