Security checkup: secure your social media accounts

The settings that matter, and why

• Turn on two-factor authentication. A second check (a code, an app prompt or a key) means a stolen password alone usually isn’t enough to log in.
• Save your backup or recovery codes. They get you in if you lose your phone or authentication app.
• Add a passkey. Log in with your fingerprint, face or screen lock. Meta says passkeys are less vulnerable to phishing; Snapchat and TikTok call them safer than passwords.
• Use a strong password you don’t use anywhere else. Several apps’ password tips say to use a different password for each account. Our tip: a password manager makes that easy.
• Check your email and phone number are yours and up to date. Recovery messages and codes go to them. Snapchat says phone numbers get reassigned, and a number’s new owner may try to log in with it.
• Check where you’re logged in and remove devices you don’t know. Logging out a device you don’t recognize ends that session. Our tip: change your password too if someone may know it.
• Remove connected apps you don’t recognize. Apps you connected can keep access until you remove them. Meta warns that an app you give your login to can get complete access.
• Run the app’s own security checkup. The app reviews your settings and suggests what to fix.
• Follow the app’s own lock-down steps. Each app’s help lists what to check if you think someone got in, or just want to be safe.
• Know what to do about a login alert you didn’t expect. X, Snapchat and LinkedIn say to change your password right away if an alert wasn’t you.
• Optional extra protection. Settings that add checks or limit features. WhatsApp says Strict account settings is for the very few people who may be targeted by sophisticated attacks.
• Scan your device for malware. Discord, Twitch and YouTube advise scanning for malware after a hack; TikTok lists malware as one way passwords leak.

And on every app: never share a login code, not even with “support” or a friend. See why codes are the key.

Security settings by app: 54 steps across 14 apps

Each checkmark links to the step in our guide for that app. A dash means we don’t cover that setting for the app yet, not that the app lacks it. The steps come from 30 of our guides.

Updated automatically when our guides change. You’re welcome to cite this table with a link to this page.

Every app’s checklist

The same steps the checkup gives, so you can browse or print them.

Fb Facebook (9 steps)

1. Turn on two-factor authentication: Turn on two-factor authentication (Meta’s steps) (Two-factor authentication)
2. Save your backup or recovery codes: Get your 10 recovery codes (do this now) (Two-factor authentication)
3. Add a passkey: Create a passkey (Passkeys)
4. Use a strong password you don’t use anywhere else: How to change your Facebook password in the app (when you can log in) (Can’t log in)
5. Check your email and phone number are yours and up to date: Remove the hacker’s email, phone number and two-factor method (Hacked account recovery)
6. Check where you’re logged in and remove devices you don’t know: Once you’re in: secure the account so it doesn’t happen again (Can’t log in)
7. Remove connected apps you don’t recognize: Remove unknown apps, extensions and admins (Hacked account recovery)
8. Run the app’s own security checkup: Already clicked or entered your password? Act now (Phishing)
9. Optional extra protection: Turn on Advanced Protection (Meta’s steps) (Advanced Protection)

Ig Instagram (3 steps)

1. Turn on two-factor authentication: Turn on two-factor authentication (Instagram two-factor authentication)
2. Save your backup or recovery codes: Get or replace your backup codes (Instagram two-factor authentication)
3. Follow the app’s own lock-down steps: Still logged in? Lock the account down now (Instagram hacked account)

Tt TikTok (3 steps)

1. Run the app’s own security checkup: Lock your account down (Hacked or can’t log in)
2. Check your email and phone number are yours and up to date: Change, add or remove your email or phone number (Hacked or can’t log in)
3. Check where you’re logged in and remove devices you don’t know: Still logged in? Change your password and remove unknown devices (Hacked or can’t log in)

Yt YouTube (2 steps)

YouTube uses your Google Account. YouTube says to secure that account first; its two-step verification and Security Checkup cover your channel.

1. Run the app’s own security checkup: Recover and secure your Google Account (Channel hacked)
2. Turn on two-factor authentication: Secure your channel so it doesn’t happen again (Channel hacked)

X X (Twitter) (7 steps)

1. Turn on two-factor authentication: Turn on two-factor authentication (Two-factor authentication)
2. Save your backup or recovery codes: Backup codes: using them and fixing errors (Two-factor authentication)
3. Use a strong password you don’t use anywhere else: Password tips from X (Login alerts and security)
4. Check where you’re logged in and remove devices you don’t know: Log out of other sessions (Connected apps and sessions)
5. Remove connected apps you don’t recognize: Remove a connected app (Connected apps and sessions)
6. Know what to do about a login alert you didn’t expect: You got a login alert you don’t recognize (Login alerts and security)
7. Optional extra protection: Turn on Password reset protection (Login alerts and security)

Wa WhatsApp (3 steps)

WhatsApp signs in with your phone number; two-step verification adds a PIN or password.

1. Turn on two-factor authentication: Once you’re back in (Hacked account)
2. Check where you’re logged in and remove devices you don’t know: Check and remove linked devices (Linked devices)
3. Optional extra protection: Strict account settings (for people at risk of targeted attacks) (Privacy settings)

Ms Messenger (5 steps)

Messenger uses your Facebook login, so Facebook’s two-factor settings protect it too.

1. Run the app’s own security checkup: Safe browsing and Security checkup (Privacy settings)
2. Turn on two-factor authentication: Turn on two-factor authentication (Meta’s steps) (Two-factor authentication)
3. Save your backup or recovery codes: Get your 10 recovery codes (do this now) (Two-factor authentication)
4. Add a passkey: Create a passkey (Passkeys)
5. Check where you’re logged in and remove devices you don’t know: Change your password and log out everywhere else (if you can still log in) (Hacked account recovery)

Sc Snapchat (5 steps)

1. Turn on two-factor authentication: Turn on two-factor authentication (2FA) (Hacked account)
2. Add a passkey: Add a passkey (and fix passkey errors) (Hacked account)
3. Use a strong password you don’t use anywhere else: Secure your account (Hacked account)
4. Check your email and phone number are yours and up to date: Keep your phone number and email up to date (Hacked account)
5. Know what to do about a login alert you didn’t expect: Got a login code or sign-in alert you didn’t ask for? (Hacked account)

Li LinkedIn (2 steps)

1. Follow the app’s own lock-down steps: Still signed in: lock your account down (Hacked account)
2. Know what to do about a login alert you didn’t expect: A security email you didn’t expect (Password & codes)

Dc Discord (4 steps)

1. Turn on two-factor authentication: Change your password and turn on MFA (Hacked account)
2. Save your backup or recovery codes: Set up 2FA again, and don’t get locked out next time (Can’t log in)
3. Remove connected apps you don’t recognize: Remove Authorized Apps you don’t recognize (Hacked account)
4. Scan your device for malware: Scan your computer for malware (Hacked account)

Rd Reddit (3 steps)

1. Follow the app’s own lock-down steps: Lock your account down (Hacked or two-factor problems)
2. Save your backup or recovery codes: Get your backup codes (do this now) (Hacked or two-factor problems)
3. Check your email and phone number are yours and up to date: Add an email (and a password) to your account (Can’t log in)

Tw Twitch (2 steps)

1. Follow the app’s own lock-down steps: Secure your account (Twitch’s checklist) (Hacked account)
2. Turn on two-factor authentication: Setting up 2FA for the first time (Codes not received)

Tg Telegram (3 steps)

1. Turn on two-factor authentication: Turn on two-step verification (Two-step verification)
2. Add a passkey: Add a passkey (Two-step verification)
3. Check where you’re logged in and remove devices you don’t know: If you’re logged in on another device (Hacked account or stolen phone)

Pi Pinterest (3 steps)

1. Turn on two-factor authentication: Turn on two-factor authentication (Hacked account and 2FA)
2. Use a strong password you don’t use anywhere else: Change your password while logged in (Can’t log in)
3. Check your email and phone number are yours and up to date: After “We protected your account”: add extra security (Hacked account and 2FA)

Questions about the security checkup

Does the security checkup look at my accounts?

No. It never connects to any app and never asks for a username, password or code. It only builds a checklist from the apps you tick. Your ticks are saved only in your own browser so you can come back later, and you can clear them at any time. The apps you pick are added to the page address so you can bookmark or share the list; your ticks aren’t.

What’s the single most important step?

Our tip: start with two-factor authentication (sometimes called two-step verification) and save your backup codes right away. Two-factor adds a second check, so a stolen password alone usually isn’t enough, and backup codes get you back in if you lose your phone.

What is a passkey, and should I use one?

A passkey lets you log in with your fingerprint, face or phone screen lock instead of typing a password. Meta says passkeys are less vulnerable to phishing, and Snapchat and TikTok call them safer than passwords. Our tip: add one wherever your checklist has a passkey step.

I think I’m already hacked. Is this the right tool?

Use the Account Recovery Wizard first: it gives the recovery steps in the right order. Come back to the checkup once you’re back in.

Why isn’t every setting listed for every app?

We only list steps our guides explain from each app’s own help pages or screens we checked. If an app offers a setting we haven’t covered yet, it won’t appear here until we’ve checked it.

Maintained by Michael Michael. See our editorial policy for how guides are researched and checked.