Secure Your X Account: Stop Phishing & Unauthorized Posts

Phishing attacks and unauthorized posts on X (formerly Twitter) can compromise your account, spread spam, or damage your reputation. This guide walks you through the essential security settings and habits to protect your account from being hijacked or misused.

What You’ll Need

Access to the email address or phone number linked to your X account
A password manager (recommended, but not required)
An authenticator app (like Google Authenticator or Authy) for two-factor authentication

Step-by-Step

Enable Two-Factor Authentication (2FA). Go to Settings and privacy > Security and account access > Security > Two-factor authentication. Choose an authentication app (preferred) or a security key. Avoid SMS if possible, as SIM-swapping can bypass it. Follow the on-screen prompts to link your authenticator app.
Use a Strong, Unique Password. In Security and account access > Password, create a password that is at least 12 characters long, mixing uppercase, lowercase, numbers, and symbols. Do not reuse passwords from other sites. A password manager can generate and store this for you.
Review Connected Apps and Sessions. Go to Security and account access > Apps and sessions. Revoke any app you don’t recognize or no longer use. Under Sessions, log out of any devices that aren’t yours.
Check Your Account Recovery Methods. Ensure your email and phone number are current and secure. Go to Security and account access > Account > Account information > Email and Phone. Update them if needed.
Be Wary of Phishing Links. Always check the URL before entering your credentials. X only asks you to log in at x.com or twitter.com. Hover over links in DMs and posts to see the actual destination. If a message urges you to “verify” or “secure” your account via a link, do not click it—go directly to X’s settings instead.
Enable Login Alerts (if available). In Security and account access > Security, you may see an option for login alerts. If present, turn them on to receive notifications for new logins.
Set Up Password Reset Protection. In Security and account access > Security, you can require personal information (like your email or phone) to reset your password. This adds a layer of protection against account takeover.
Regularly Audit Your Followers and Mentions. If you notice unusual posts from your account that you didn’t make, immediately change your password and revoke all sessions. Also check if your account is posting spam or following unknown accounts—these are signs of compromise.

Common Mistakes

Using SMS for 2FA: SMS is vulnerable to SIM-swapping. Prefer an authenticator app or hardware key.
Clicking Links in DMs: Even from friends, if a link looks odd or asks for login, it’s likely phishing. Verify with the sender through another channel.
Not Logging Out of Public Computers: Always log out and use incognito mode on shared devices.
Ignoring Login Alerts: If you get an alert for a login you don’t recognize, act immediately—don’t dismiss it.
Reusing Passwords: If one site is breached, attackers try the same credentials on X.

Tips

Use a password manager to create and store a unique password for X.
Enable 2FA with an authenticator app and keep backup codes in a safe place.
Periodically check your Apps and sessions to remove anything you don’t use.
Be skeptical of any message that creates urgency (“Your account will be suspended unless you verify now”).
Consider using a security key (like YubiKey) for the highest level of protection.

Troubleshooting

You’re locked out of your account: Use the “Forgot password?” link on the login page. You’ll need access to your recovery email or phone. If you’ve lost those, X’s account recovery process may ask for additional verification.
You suspect your account is already compromised: Immediately change your password and revoke all sessions. If you can’t log in, use the “Account recovery” option at x.com. Then, check for any unauthorized posts and delete them.
2FA code isn’t working: Ensure your device’s time is correct (automatic time zone is best). If you have backup codes, use one. Otherwise, you may need to go through account recovery.
You receive phishing emails: Do not click any links. Report them as phishing to X (if the email looks like it’s from X) and delete them. Forward suspicious emails to the Anti-Phishing Working Group at reportphishing@apwg.org.

Frequently Asked Questions

What is the most effective way to prevent unauthorized posts on X?

Enabling two-factor authentication with an authenticator app is the single most effective step. It prevents attackers from logging in even if they have your password.

Can someone post on my X account without having my password?

Yes, if they have an active session on a device they control (e.g., you logged in on a shared computer and didn’t log out). Also, third-party apps with posting permissions can post on your behalf. Regularly review and revoke unused apps.

What should I do if I clicked a phishing link and entered my password?

Immediately change your password, revoke all sessions, and enable 2FA. If you have 2FA already, the attacker may not have been able to log in, but still change your password to be safe.

Is SMS two-factor authentication better than nothing?

Yes, it’s better than no 2FA, but it’s the least secure method because of SIM-swapping. If you can, use an authenticator app or a hardware security key.

How do I know if my account has been hacked?

Signs include posts you didn’t write, new followers you don’t recognize, changed profile information, or being locked out. You may also receive login alerts for unrecognized devices.

Does X offer a way to see where I’m logged in?

Yes, go to Settings and privacy > Security and account access > Apps and sessions > Sessions. You can see active sessions and log out of any that look unfamiliar.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →