Social Media Account Security: How to Lock Down Facebook, Instagram, X, and More

Social media account takeovers are among the most visible and damaging account compromises consumers face. A hijacked Facebook account can be used to scam your friends and family, post fraudulent content, or access connected apps. A stolen Instagram account — especially one with a large following — can be ransomed back to you for hundreds or thousands of dollars. A compromised X (Twitter) account can be used to spread misinformation or cryptocurrency scams. The 2020 Twitter hack, in which attackers compromised accounts belonging to Barack Obama, Joe Biden, Elon Musk, and Apple to run a Bitcoin scam, demonstrated that even the most high-profile accounts are vulnerable.

Facebook security checklist: enable two-factor authentication (Settings > Security and Login > Two-Factor Authentication) — use an authenticator app, not SMS. Review active sessions (Settings > Security and Login > Where You're Logged In) and log out of any unrecognized devices. Review apps with Facebook access (Settings > Apps and Websites) and remove any you don't recognize or no longer use. Enable login alerts (Settings > Security and Login > Get alerts about unrecognized logins). Use a unique strong password stored in your password manager.

Instagram security checklist: enable two-factor authentication (Settings > Security > Two-Factor Authentication) — use an authenticator app. Review login activity (Settings > Security > Login Activity) and log out of unrecognized sessions. Review third-party apps (Settings > Security > Apps and Websites). Enable login request notifications. Save your backup codes in your password manager. Note: Instagram accounts are frequently targeted for takeover because they can be monetized — large accounts are sold on criminal marketplaces. If you have a significant following, consider adding a hardware security key.

X (Twitter) security checklist: enable two-factor authentication (Settings > Security and account access > Security > Two-factor authentication) — use an authenticator app or security key. Disable SMS 2FA (X has been targeted by SIM swap attacks). Review connected apps (Settings > Security and account access > Apps and sessions > Connected apps) and revoke any you don't recognize. Enable password reset confirmation (Settings > Security > Additional password protection) — this requires you to confirm your email or phone before a password reset can be initiated.

Google and Apple account security deserve special attention because they're the foundation of your digital identity. Your Google account controls Gmail, Google Drive, Google Photos, Android device management, and hundreds of connected apps. Your Apple ID controls iCloud, Find My, App Store purchases, and Apple Pay. Both should have: a unique strong password, authenticator app or hardware key 2FA, recovery codes stored securely, and regular reviews of connected apps and devices. Google's Security Checkup (myaccount.google.com/security-checkup) and Apple's account security page walk you through all settings.

Universal social media security principles: use a unique password for every platform (reuse means one breach compromises all); enable 2FA on every platform that supports it; review connected third-party apps quarterly and remove anything you don't actively use (these apps retain access even after you stop using them); be suspicious of direct messages asking you to click links or verify your account — these are common phishing vectors; and set up login notifications so you're alerted immediately if someone accesses your account from an unrecognized device. If your account is compromised, act immediately: change your password, revoke all active sessions, and report the compromise to the platform.