How to check email forwarding rules and filters for hidden access
2 min read · Updated October 15, 2026
Open your email settings and review forwarding, filters or rules, and connected addresses. Delete any entry you did not create, especially ones that forward mail to unknown addresses or delete security alerts. Then change your password and enable two-factor authentication.
What to look for
- ✓Forwarding to an address you do not recognise.
- ✓Rules that mark messages as read, archive them or delete them automatically.
- ✓Rules triggered by words such as ‘password’, ‘security’, ‘invoice’ or ‘bank’.
- ✓Extra ‘send as’ addresses or delegated access you did not set up.
Where to find these settings
Every provider names things slightly differently, so look in settings for sections labelled Forwarding, Filters, Rules, Blocked addresses, Accounts or Delegation. In most web mail clients you find them under the settings menu, often in a full-settings page.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
After you remove something suspicious
Assume someone had access. Change your password, sign out all sessions, enable two-factor authentication and review your recovery details. Then check what mail may have been copied: recent password reset emails, invoices and financial messages.
Make it a habit
Review forwarding and filters whenever you do a security checkup, and after any breach alert. It takes two minutes and closes one of the most common hidden-access routes.
Frequently asked questions
Can forwarding be set up without my password?+
Not directly, but an attacker who has your password or an active session can add it in moments.
Will the forwarded copies be visible to me?+
Usually not. That is why forwarding rules are so effective for silent monitoring.
What if the rule was created by my employer?+
Business accounts sometimes have legitimate rules. Check with your IT team before deleting anything on a work account.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.