An X account holds years of posts, private messages and often the public face of a business. Losing it to someone else is hard to undo. The steps that prevent most takeovers are built into the app and take less than fifteen minutes.
Short answer: use a password you use nowhere else, turn on two-factor authentication with an app or security key, and remove third-party apps you no longer need.
Key takeaways
- X offers three two-factor methods: text message, authentication app and security key.
- Reused passwords are the easiest way in for an attacker.
- Old connected apps keep their access until you revoke it.
What is two-factor authentication?
Two-factor authentication is a second login step that asks for a code or a security key in addition to your password.
With it turned on, a stolen password alone is not enough to get into the account.
Where do you start?
With the password and the email address behind the account.
Make the X password long and unique, and store it in a password manager. Then check the email account linked to X. Whoever controls that inbox can reset the X password, so it needs the same care.
How do you turn on two-factor authentication?
Go to Settings and privacy, then Security and account access, Security, and Two-factor authentication.
The X Help Center lists three methods to choose from there. After you enroll, logging in asks for your password plus the second step.
| Method | How it works | Notes |
|---|---|---|
| Text message | A code arrives by SMS | Depends on your phone number staying under your control |
| Authentication app | An app on your phone generates a code | Works without mobile signal |
| Security key | A physical key you plug in or tap | Strong protection against fake login pages |
When you finish setup, X shows a backup code. Save it somewhere safe and offline. It gets you back in if you lose your phone.
What else should you check?
Connected apps, active sessions and the messages you click.
- Review the apps connected to your account and remove any you do not recognize or use.
- Look at the list of devices and sessions, and log out the ones that are not yours.
- Treat messages that ask you to log in with suspicion, including ones that appear to come from X. Open the app directly to check.
- Give team members access through X’s own tools where possible, so the password is not passed around.
What if you think the account is compromised?
Change the password at once, then check the email address and two-factor settings.
If you can still log in, a new password logs out other sessions in most cases. Confirm the email on the account is yours, revoke unknown apps and delete posts you did not write. If you are locked out, use the account access forms in the X Help Center. For a broader view of staying safe as a marketer, our older article on security for Twitter marketers is still worth a look.
How do you spot a phishing message?
Check where the link really goes and be wary of anything that creates urgency.
- The message says your account will be suspended within hours unless you act.
- The link leads to a domain that only resembles x.com.
- It asks for your password or a two-factor code in a reply or a form.
- It promises verification, followers or payment in exchange for logging in.
When in doubt, close the message and open X from your own bookmark or the app. Real account notices also appear inside your settings.
FAQ
Which two-factor method is best?
An authentication app or a security key. Both avoid relying on text messages, which can be intercepted if someone takes over your phone number.
Can I use more than one method?
Yes. X lets you enable several and choose a different one when you log in.
Do I need two-factor on a small account?
Yes. Small accounts are taken over too, often to send spam to their followers.