Social Media · 3 min read
How to Lock Down Your X Account: A Security Checklist
Short answer
To lock down an X account, use a unique password in a password manager, turn on two-factor authentication with an authenticator app or security key, remove connected apps you don't use, keep your recovery email current and review who else has access.
Key takeaways
- Two-factor authentication is the most important single step. Prefer an authenticator app or a security key.
- Connected apps with write access are a common route for unwanted posts. Remove the ones you don't use.
- A recovery email you can't open turns a small problem into a lost account.
- Most account takeovers start with a convincing fake login page or message.
An X account is easy to take for granted until someone else is posting from it. For a person that's embarrassing; for a brand it can be expensive. This checklist takes about fifteen minutes and closes the most common gaps.
Why does account security matter for curators?
Because a curated account has followers who trust its links, which makes it a valuable target for spam and scams.
An account that regularly shares useful links is exactly what scammers want: an audience that clicks. A takeover can mean spam posts, phishing links sent to followers, or the account being renamed and resold.
What should you do first?
Turn on two-factor authentication with an authenticator app or a security key.
X offers three methods: text message, authentication app and security key. App-based codes and hardware keys are generally harder to steal than SMS codes, which can be intercepted or redirected through SIM swapping. Since 2023, X has limited text-message 2FA to paid subscribers, so many accounts will need an app or a key anyway.
Find it in Settings and privacy > Security and account access > Security > Two-factor authentication. Save the backup code X gives you somewhere safe, offline or in your password manager.
What's the rest of the checklist?
Password, apps, email, sessions and people, in that order.
| Step | Where | Why |
|---|---|---|
| Unique password from a password manager | Settings and privacy > Your account > Change your password | Reused passwords leak from other sites |
| Remove unused connected apps | Security and account access > Apps and sessions | Old apps with write access can post for you |
| Log out of old sessions | Apps and sessions > Sessions | Closes access on lost or shared devices |
| Check the account email and phone | Your account > Account information | Recovery depends on them |
| Review delegated access | Settings for shared or team access | Former staff and agencies should be removed |
| Password reset protection | Security | Makes resets require more than a username |
How do takeovers usually start?
With a convincing message: a fake copyright notice, a fake verification offer, or a login page that looks like X.
Common patterns:
- A message or email saying your account will be suspended unless you "verify" through a link.
- An offer of a badge or partnership that asks you to log in on another site.
- A direct message from a friend's account (already compromised) with a link.
The rule is simple: if a message asks you to log in, don't use its link. Go to x.com yourself. X won't ask for your password in a direct message.
What should you do if it happens?
Act quickly: reset the password, revoke apps and sessions, and follow X's compromised-account steps.
If you can still log in, change your password, remove unknown apps, log out other sessions, check that your email and phone haven't changed, and delete posts you didn't make. If you're locked out, use X's help page for compromised accounts. Tell your followers once you're back, so they ignore anything sent in your name.
How often should you check?
Every three months, as part of a wider account review.
The security section of the 60-Minute X Audit covers these items with hints for where to look. It takes ten minutes, and it's the part of the audit most people skip.
Questions
Which two-factor method should I use on X?
X offers text message, authentication app and security key methods. Authentication apps and security keys are generally stronger than SMS, which can be intercepted or moved to another SIM. X limited text-message two-factor authentication to paid subscribers in 2023.
Where are X's security settings?
In Settings and privacy, then Security and account access, then Security. Connected apps are under Security and account access, Apps and sessions.
What should I do if my account is compromised?
Try to reset your password straight away, revoke connected apps and sessions, and follow X's help page for hacked accounts. If you can't get in, use X's account recovery form.
Should a brand account be shared by one password?
Ideally not. Use a password manager with shared vaults, keep a list of who has access, and change the password and 2FA when someone leaves.