How to Secure Your X (Twitter) Account

The best way to secure your X account is to turn on two-factor authentication with a passkey, a security key, or an authentication app, then lock down the email address your account uses. Those two steps stop most account takeovers.

After that, use a password you don't use anywhere else, keep your backup codes somewhere safe, and stop clicking links in DMs that warn your account is in trouble. Below is how I set all of this up and why each piece matters.

Pick a strong second factor

Two-factor authentication (2FA) means a password alone isn't enough to log in. You also need something only you have. X offers a few kinds, and they aren't equally strong.

A passkey lets you log in with your phone's fingerprint, face unlock, or screen lock instead of typing a password. X supports passkeys in its apps on iOS and Android. A security key is a small physical device you plug in over USB or tap over NFC or Bluetooth. An authentication app generates a six-digit code that changes every 30 seconds.

Passkeys and security keys have one big advantage. They're tied to the real X website, so they won't work on a fake login page even if you're fooled into visiting one. An authentication app is still solid, but you can be tricked into typing its code into a phishing site, so it protects you less against a well-made fake.

You'll find all of these in the Security section of X's settings, under two-factor authentication. Menu names shift from time to time, so if you don't see it right away, search your settings for "two-factor."

Whichever method you pick, keep a backup code. If you lose your phone or your security key, that code is how you get back in. X shows you one when you set up two-factor authentication, and the easiest time to store it is right then.

Write it down or print it, and keep it with other important papers. If you'd rather store it digitally, put it in a password manager, not in a screenshot sitting in your camera roll. Without a backup code, losing your only second factor can leave you locked out of your own account for a long time.

Why text message codes are the weakest option

Codes sent by SMS are better than nothing, but they have a known weakness called SIM swapping. An attacker calls your mobile carrier, pretends to be you, and talks the carrier into moving your number to a SIM card they control. From then on, your login codes go to their phone.

This has happened to plenty of people, including Twitter's own co-founder, whose account was hijacked through his phone number in 2019.

Since 2023, X has limited text message 2FA to paid subscribers, so many people won't have that option anyway. If you do use it, consider switching to one of the stronger methods, and ask your carrier about adding a PIN or port-out protection to your phone line.

Use a unique password and a password manager

Most hacked accounts don't involve clever tricks. Someone's password leaked from another site, and the attacker tried the same email and password on X. This is called credential stuffing, and it works because people reuse passwords.

Give X a long password that you use nowhere else. The easiest way to do that is a password manager, which creates and remembers random passwords for every site. It also helps with phishing, because it won't fill in your password on a lookalike domain it doesn't recognize. If it refuses to autofill, stop and check the address bar.

Your email account is the real master key

Anyone who controls the email address behind your X account can reset your password and, in many cases, get around everything else. So the email deserves the same protection as X itself, maybe more.

• Turn on strong two-factor authentication for your email, ideally a passkey or security key.
• Give it its own unique password.
• Check its recovery phone number and backup email, and remove any you no longer use.
• Look at the forwarding rules and filters. Attackers sometimes add a rule that silently forwards or deletes security alerts.

While you're there, confirm that the email and phone number listed on your X account are still yours and still active.

Review connected apps and active sessions

Over the years, many of us have clicked "authorize" on quizzes, schedulers, analytics tools, and follower trackers. Each one may still have access to your account. If one of those services gets breached or turns shady, your account can post things you never wrote.

In X's settings, find the section called Apps and sessions. Revoke access for any app you don't recognize or no longer use. In the same area you can see every device and browser currently logged in to your account. If something looks unfamiliar, log it out, or use the option to log out of all other sessions.

I do this every few months. It takes two minutes.

Phishing DMs and fake login pages

The messages change, but the shape stays the same. Something urgent is wrong with your account, and you need to click a link to fix it. Common versions include:

• A copyright complaint saying your account will be suspended within 24 hours unless you file an appeal.
• An offer of a verification badge or a "verification review" form.
• A warning that your account broke the rules and will be deleted.
• A brand collaboration or giveaway that requires you to log in to claim it.

The link leads to a page that looks like X and asks for your username, password, and 2FA code. Once you enter them, the attacker logs in right away, changes your email and password, and shuts you out.

My rule is simple. I never log in through a link someone sends me. If a message claims there's a problem, I open X myself and check. Real account notices show up inside the app and in the email tied to your account, not only in a DM from an account with a support-sounding name.

Remember: If a message rushes you to log in, it's almost certainly a trap. Close it and open X on your own.

What the 2020 hack teaches

In July 2020, attackers took over the accounts of Barack Obama, Joe Biden, Elon Musk, Apple and others to post a "double your bitcoin" scam. The address they used is the one in this site's domain name. You can read the full story of the 2020 Twitter hack.

The account owners did nothing wrong. According to the New York State investigation that followed, the attackers phoned Twitter employees while posing as the company's IT help desk, claimed there was a VPN problem, and sent them to a fake VPN login page. With the stolen credentials, they reached internal tools that could take over almost any account.

Two lessons stand out to me. First, the same phone and fake-page tricks are used on ordinary people every day. Second, even a well-protected account can be hit from the platform's side, so pay attention to official notices from X about security incidents and act on them, such as changing your password when asked through the app itself.

If your account gets hacked

Move quickly, but don't panic.

1. Try logging in and changing your password right away. If that works, update your email password too.
2. If you can't log in, use X's account recovery process from the login screen or the help pages. It's free, and it's the only route that works.
3. Once you're back in, log out all other sessions, revoke apps you don't recognize, and set up a passkey, security key, or authentication app.
4. Check your email and phone number on the account, recent posts, DMs, and anything sent in your name.
5. Tell your followers what happened, especially if the attacker posted links or crypto offers. Some of them may have been targeted.

Ignore anyone who offers to recover your account for a fee. People pitching that service in replies and DMs are scammers waiting for exactly this moment. Hacked accounts are often used to push crypto scams, so if you hold bitcoin, read how to keep your bitcoin safe as well.

Questions