Security status checklist
The checklist marks protections that are not configured and sessions that remain open. It cannot tell whether someone else knows your password or has access to your email.
Authentication and recovery methods
If someone learns your password, two-factor authentication still blocks sign-in without a second code. Store recovery codes separately from the phone that holds the authenticator app.
Active sessions
Existing sessions may remain open after a password change. Remove unrecognized devices separately, and change an exposed password anywhere else it was reused.