How to protect your social media accounts: 10 steps against hacking
Ten practical steps that stop most account takeovers: passkeys and authenticator apps, clean recovery details, session and app reviews, phishing patterns and a plan for the day something goes wrong.
Most hacked accounts we recover were not breached by clever technology. They were opened with a reused password, a phishing link or an old recovery email nobody checks any more. These ten steps close the doors attackers use most.
1. Use a unique password for every account
A password manager makes this easy. If one site leaks, the others stay safe.
2. Turn on two-step verification with an app or a passkey
Authenticator apps and passkeys are far harder to intercept than SMS codes. Keep the backup codes offline.
3. Clean up recovery details
Check the email address and phone number on every account. Remove old ones you no longer control. The recovery email deserves the strongest protection of all, because it can reset everything else.
4. Review active sessions
Instagram, Facebook, X, TikTok and Google all show where you are logged in. Log out of anything you do not recognise.
5. Remove third-party apps
Old quiz apps, schedulers and analytics tools keep access long after you stop using them. Remove what you do not need.
6. Learn the phishing patterns
Fake copyright strikes, “your account will be deleted” warnings, verification offers and brand collaboration requests are the classic hooks. Platforms do not ask for your password in direct messages.
7. Separate personal and business access
Use business tools that give each team member their own login and role, not one shared password.
8. Protect the devices
Keep phones and laptops updated, use a screen lock and do not install apps from outside the official stores.
9. Turn on login alerts
Alerts for new logins and changes to email or phone give you minutes instead of days.
10. Have a plan for the bad day
Write down where the official recovery forms are, which email and phone belong to each account, and who to call. When an account is taken, speed matters more than anything.
How we help
Our Social Media Shield service audits and hardens every account that matters for a person or brand, sets up monitoring and stays on call for the day something goes wrong.
Frequently asked questions
Is SMS two-step verification enough?
It is better than nothing, but SIM-swap attacks can intercept SMS codes. An authenticator app or a passkey is much stronger.
How do hackers usually get in?
Most takeovers start with phishing: a fake copyright warning, verification offer or collaboration request that leads to a login page. Reused passwords from old data breaches are the second most common route.
What should a business do differently?
Give each person their own login with the minimum role they need, through Meta Business Suite and similar tools, instead of sharing one password. Remove people as soon as they leave.