Most creators only think about channel security after something's already gone wrong -- a strange livestream, a renamed channel, a locked-out login. This checklist is for the other direction: going through your account before that happens, so there's nothing for an attacker to find.
None of this takes long individually. Set aside 20 minutes, work through it top to bottom, and then put a recurring reminder on your calendar to redo the connected-apps and device-activity sections every month or two -- those two drift the fastest.
1. Confirm whether your channel is on a personal account or a Brand Account
Go to YouTube Studio → Settings → General. If it says your channel is managed by a Brand Account, good -- that's the setup YouTube recommends for anyone running a channel as more than a hobby, because it separates channel ownership from your personal Gmail, Drive, and Photos. A compromise of one doesn't automatically hand over the other.
If your channel is tied directly to your personal Google account, consider migrating it to a Brand Account (Settings → General → "Move channel to a different account" walks you through it). It's a one-time setup cost that pays off the first time anything goes wrong with either side.
If you run the channel with a team, Brand Accounts also let you add collaborators as Managers or Owners on the channel itself (Settings → Permissions) instead of handing out your actual Google login. Review that list now: anyone there who no longer works with you should be removed.
2. Audit every third-party app with access to your Google account
This is the single highest-value check on this list. Go to myaccount.google.com/permissions. This page lists every app and service that's ever been granted access to your account, and exactly what it can do -- some will say "Can manage your YouTube account," "Can view and manage videos," or similar.
Channel takeovers overwhelmingly happen through this page, not through guessed or stolen passwords. The common pattern: a "sponsorship," "collab," or "media kit" email asks you to sign in with Google to an analytics tool or "TubeBuddy Pro"-style app to "verify eligibility." That grants the app standing permission to manage your channel -- no password theft required, and it never shows up as a suspicious login because, technically, it isn't one. This is a well-documented pattern across the creator economy, not a rare edge case.
Go through the list and revoke:
- Anything you don't recognize
- Anything you haven't actively used in the last few months
- Anything with YouTube, Gmail, or Drive access that you're not currently relying on
Revoking an app's access here invalidates the tokens it was issued, in most cases cutting it off immediately -- even if it's sitting on a valid session right now.
3. Turn on 2-Step Verification -- with an authenticator app, not SMS
Go to myaccount.google.com/security and check whether 2-Step Verification is on. If it isn't, turn it on now. If it is, check which method it's using.
SMS-based codes are better than nothing, but they're vulnerable to SIM-swapping -- an attacker convincing or bribing your mobile carrier into porting your number to a new SIM, which then lets them intercept your verification texts. It's a real and rising attack vector for anyone with a public profile, because a public creator is a more identifiable, more motivated target than an average phone user.
Switch to an authenticator app (Google Authenticator, Authy, or similar) under 2-Step Verification → Authenticator app, and generate backup codes while you're there. Save those codes somewhere offline -- not in the same inbox an attacker might also be targeting.
4. Check your recovery email and phone number
Still in myaccount.google.com/security, scroll to "Ways we can verify it's you" (or go directly to myaccount.google.com/recovery). Confirm the recovery email and phone number listed are current and actually belong to you.
This matters more than it sounds like it should: outdated recovery info is one of the leading reasons creators lose a channel permanently after a compromise. If an attacker changes your password and your recovery contact is a phone number you cancelled two years ago, Google has no way to verify you're the real owner, and recovery can fail outright.
5. Review active sessions and signed-in devices
Go to myaccount.google.com/device-activity. This lists every device currently signed into your account. Scan it for anything you don't recognize -- an unfamiliar browser, an unexpected location, a device you've never owned. If you see one, click it and sign it out immediately, then go back through steps 2 and 3, since an active unknown session is often the clearest sign something's already wrong.
6. Scan your own channel and video descriptions for links you didn't put there
Attackers who get into a channel sometimes don't deface it obviously -- they leave a quiet backdoor instead, like a "verify your channel" phishing link slipped into an older video's description, hoping it gets clicked by you or your viewers later. Skim your channel description and your most-viewed videos' descriptions for anything that doesn't belong.
7. If you're monetized, double-check your AdSense link
Go to YouTube Studio → Monetization and confirm the linked AdSense account and payout details are still yours. This is the part of a compromise that costs real money, and it's one attackers specifically look for once they have channel access -- it's worth a direct look rather than assuming it's fine because nothing else looks wrong.
Keep it a habit, not a one-time pass
Everything above is cheap to check and expensive to skip. The connected-apps list and device-activity page are worth rechecking every month or so, since that's where things quietly accumulate between incidents. If you'd rather not click through six different Google settings pages by hand each time, Securoly runs a full audit of your channel's setup and permissions -- free, no paywall on the findings -- and tells you exactly which of these are currently open, but whether you use a tool or just this list, the point is the same: check it on a schedule, not just after something goes wrong.