Enable 2FA separately on each social account, secure the email address that controls password resets and keep platform-specific backup codes outside the phone.
Prioritise accounts
Start with accounts linked to business pages, advertising, large audiences, direct messages or identity verification. Also protect the email account used to recover them.
Set up safely
- Open the social platform’s own security settings.
- Choose two-factor authentication.
- Prefer an authenticator, passkey or security key where supported.
- Save the service’s recovery codes.
- Review active sessions and connected applications.
- Test a new sign-in while the current session remains open.
Beware fake verification
Do not scan a QR code or share a code sent by someone claiming they need to verify your page, copyright complaint or advertising account. Social platforms do not need your one-time code through a chat message.
Keep ownership clear
For shared business accounts, use official role or team-access features rather than sharing one password and one person’s phone.
Secure the email account before the social account
A social-media recovery process often depends on email or a mobile number. Protect those first, then add the strongest method the platform supports.
- Prefer an authenticator, passkey or security key over SMS where available.
- Save recovery codes and confirm the recovery email belongs to you.
- Review logged-in devices and revoke unknown sessions.
- Remove obsolete phone numbers and third-party app access.
Be cautious with direct messages claiming copyright, verification or account suspension. Open the platform independently instead of signing in through the message link.
Official sources
Facts checked: 26 July 2026. Device behaviour, account features and menu paths can change. Recheck the current instructions for your exact device, software version and service before acting.
