Secure X Account: Phishing & Takeover Guide

This guide walks you through the practical steps to lock down your X (formerly Twitter) account against phishing attempts and unauthorized takeover. You’ll learn how to strengthen your password, enable two-factor authentication, recognize malicious links, and monitor your account for suspicious activity—everything you need to significantly reduce your risk of being hacked.

What You’ll Need

Access to the email address associated with your X account
Your current X password (or the ability to reset it via email)
A smartphone with an authenticator app (like Google Authenticator, Authy, or Microsoft Authenticator) OR a physical security key (optional but recommended)
A password manager (optional but strongly recommended for generating and storing strong passwords)

Step-by-Step

Log in to your X account on the official website (x.com) or the official mobile app. Make sure you’re on the legitimate site—check the URL bar for “x.com” and a padlock icon.
Change your password to a strong, unique one. Go to More (the three dots in the sidebar) > Settings and privacy > Password. Enter your current password, then create a new one that is at least 12 characters long, mixing uppercase and lowercase letters, numbers, and symbols. Do not reuse this password anywhere else. Use a password manager to generate and store it.
Enable two-factor authentication (2FA). Go to Settings and privacy > Security and account access > Security > Two-factor authentication. Choose the most secure option available. The best is a security key (hardware like YubiKey), followed by an authentication app (which generates time-based codes). SMS (text message) is the least secure because attackers can sometimes intercept it, but it’s better than nothing. Follow the on-screen prompts to set it up. For an authenticator app, you’ll scan a QR code and enter the code it generates to confirm.
Generate backup codes. While in the 2FA settings, click on “Backup codes” and generate a set. Store these codes in a safe place (like your password manager or a printed piece of paper kept offline). These are one-time codes that let you get back into your account if you lose your phone or security key.
Review your connected apps and sessions. Go to Settings and privacy > Security and account access > Connected apps. Revoke access to any app you don’t recognize or no longer use. Then go to Sessions (under the same menu) and log out of any active sessions that aren’t your current device. This prevents a hijacker from staying logged in.
Update your email address and phone number. Go to Settings and privacy > Your account > Account information. Make sure the email address and phone number listed are ones you control. If they’re outdated, update them. Also, ensure the email account itself has a strong, unique password and 2FA enabled—it’s the key to resetting your X password.
Be vigilant against phishing links. Never click on links in direct messages (DMs) that ask you to log in, verify your account, or claim there’s a problem with your account. X will never ask for your password via DM. Check the URL before entering your credentials—phishing sites often use look-alike domains like “x.com.verify-login.xyz” or “twitter-security.com”. If in doubt, go directly to x.com by typing it into your browser.
Turn on login alerts (if available). In Settings and privacy > Security and account access > Security, look for login alerts or notifications. If available, enable them so X emails or notifies you when a new login occurs.
Regularly check your account activity. Periodically review the Sessions list (as in step 5) and your Account information to ensure no unauthorized changes have been made.

Common Mistakes

Using SMS as your only 2FA method. While better than nothing, SMS is vulnerable to SIM-swapping attacks. Use an authenticator app or security key instead.
Reusing passwords. If you use the same password for X as you do for another site that gets breached, attackers will try that password on X immediately.
Entering credentials on a look-alike site. Always verify the URL. Phishing pages can look identical to the real login page.
Ignoring login alerts. If you get an email about a new login you don’t recognize, take it seriously and change your password right away.
Not logging out of public computers. If you log in on a shared device, always log out completely and don’t check “Remember me”.

Tips

Use a password manager to generate and store a unique, complex password for X. This makes it nearly impossible to guess and easy to avoid reuse.
Set up a physical security key (like a YubiKey) for the highest level of protection. It works by requiring the key to be inserted or tapped when you log in.
Keep your phone’s operating system and apps updated to protect against malware that could steal your login credentials.
If you receive a suspicious DM or email claiming to be from X support, do not click any links. Instead, report it to X and contact support through the official Help Center.
Consider using a separate email address for your X account that you don’t use for other services, to limit exposure in case of a breach elsewhere.

Troubleshooting

If you find yourself locked out of your account or suspect it’s been taken over:

You can’t log in because your password is wrong. Use the “Forgot password?” link on the login page. X will send a reset link to your email or phone. If you don’t have access to those, you may need to use the account recovery process at the X Help Center.
You lost your phone or security key. Use one of your backup codes to log in. If you don’t have backup codes, you’ll need to go through X’s identity verification process, which may involve providing additional information to prove you own the account.
Your email or phone number has been changed without your permission. This is a sign of account takeover. Immediately go to the X Help Center and follow the “My account is hacked” recovery steps. You may need to provide your previous email or phone number to prove ownership.
You’re receiving login alerts but can’t identify them. Change your password immediately, log out of all sessions, and enable 2FA if you haven’t already. Review your connected apps and revoke any that look suspicious.

Frequently Asked Questions

Q: Is SMS two-factor authentication better than nothing?
A: Yes, SMS is better than no 2FA, but it’s the least secure method because attackers can intercept text messages. Use an authenticator app or security key if possible.

Q: What should I do if I clicked a phishing link and entered my password?
A: Immediately change your password on the real X site, log out of all sessions, and enable 2FA. If you can’t log in, use the account recovery process. Also, consider running a malware scan on your device.

Q: Can X support help me get my account back if I’m locked out?
A: Yes, X has an account recovery process. Go to the Help Center and follow the steps for “Hacked or compromised accounts”. You’ll need to provide as much information as possible to prove ownership.

Q: How often should I change my password?
A: There’s no set rule, but it’s good practice to change it if you suspect any compromise or if you’ve used it on another site that was breached. Using a unique, strong password and 2FA is more important than frequent changes.

Q: What is a security key and where do I get one?
A: A security key is a small hardware device that plugs into your computer or phone and verifies your identity. They are available from major electronics retailers. You can also use a built-in security key on some phones or laptops (like Apple’s Touch ID or Windows Hello).

Q: Will enabling 2FA slow down my login?
A: It adds a few seconds, but it’s a small price for significantly increased security. You can also check “Trust this device” for 30 days to reduce how often you’re prompted.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →