On this page
Your best defenses against an Instagram or Facebook takeover are a unique password, two-factor authentication, and a recovery email you still control. You can set up most of that in one sitting without making your profile public or buying security software.
Start with the email account connected to your profiles, then work through Meta's security settings. A locked-down social account is much easier to recover when its backup contact details and login records are already in good shape.
Secure the email behind your accounts
Your email inbox is often the reset button for your social accounts. If someone controls it, they may intercept password resets, remove security notices, or use old messages to learn about you.
- Open your email provider's security settings directly, rather than through a message link.
- Set a password that you do not use anywhere else.
- Turn on two-factor authentication and review your recovery phone number and email address.
- Check signed-in devices, forwarding rules, and connected apps for anything unfamiliar.
Use a password manager to create and store distinct passwords for Facebook, Instagram, and email. If you need help generating a random option, the Password & Hash Generator can help; use password generation rather than treating a hash as extra login protection. Never enter an existing password into a tool just to evaluate it.
If you suspect your inbox is already compromised, follow What to Do If Your Email Account Is Hacked before relying on it for recovery.
Strengthen sign-in through Accounts Center
Meta groups many login controls in Accounts Center. Labels can vary by app version, region, and account type, so use the settings search if a path looks different.
- Open your profile and tap the menu button.
- Find Accounts Center, sometimes under Settings and activity.
- Choose Password and security, then Change password.
- Select the correct Instagram account and save a unique password.
- Open Menu > Settings & privacy > Settings.
- Open Accounts Center > Password and security.
- Choose Change password and select your Facebook account.
- Save the change in your password manager.
Check which profiles appear in Accounts Center. Linked accounts can offer convenient login features, but convenience should be deliberate. Review options for logging in across accounts and disable connections you do not need. Securing one profile does not automatically prove every connected profile is protected.
Turn on two-factor authentication
Two-factor authentication asks for another proof when someone signs in. An authenticator app is a practical choice because its codes do not depend on receiving a text message. A supported security key is another strong option.
- Open Accounts Center > Password and security > Two-factor authentication.
- Select an account and choose an available method.
- Complete setup and enter a code when asked to confirm it works.
- Save recovery codes somewhere secure, separate from the phone you normally use.
- Repeat for each Facebook and Instagram account you own.
Text-message verification is generally better than having no second factor. However, phone-number theft and phishing make it less robust than some alternatives. See How to Turn On Two-Factor Authentication Everywhere for help choosing a method.
Never send anyone a login code, approve an unexpected prompt, or share recovery codes. A person claiming to be support, a friend, or a contest organizer does not need them. Enter codes only during a sign-in you started in the real app or website.
Review sessions, recovery details, and app access
In Accounts Center > Password and security, look for Where you're logged in. Review devices and sessions for each account. Location estimates can be imprecise, especially on mobile networks or VPNs, so consider the device, timing, and activity together.
Sign out sessions you cannot explain. If several look wrong, change your password from a trusted device, remove unknown sessions, and confirm that two-factor authentication still belongs to you.
Next, check Accounts Center > Personal details > Contact info. Remove old phone numbers and email addresses only after confirming you have a working replacement. An abandoned work inbox or recycled phone number can make future recovery difficult.
Review Apps and websites in each service's settings as well. Remove old quiz apps, follower tools, and services you no longer use. Be especially skeptical of tools promising to reveal profile visitors or guarantee followers. Giving an app access creates another relationship you need to trust, even if your password stays private.
Reduce what strangers can use against you
Privacy controls cannot prevent every takeover, but they can make impersonation and targeted scams harder. Avoid publishing your phone number, full birth date, school schedule, or answers you use for security questions.
On Instagram, look for Account privacy to consider a private account if it suits how you use the service. Review Messages and story replies, tagging, and mention controls. A private account still needs strong sign-in protection, and approved followers can copy what you share.
On Facebook, use Settings > Privacy Checkup to review who can see posts and personal details. Check the audience for older posts and whether strangers can view your friends list. Review tagging settings so another person's post does not unexpectedly appear on your profile.
Be cautious with urgent direct messages, even from familiar accounts. A friend asking you to receive a code or vote through an unfamiliar login page may have been hacked. Contact them through a different channel before doing anything.
Troubleshooting a suspicious login or takeover
If you can still sign in, act immediately from a trusted device: update your password, secure your email, remove unfamiliar sessions, and review recovery details. Check recent posts, messages, and advertising activity if you use business features.
If you are locked out, type instagram.com/hacked or facebook.com/hacked yourself. Follow the official recovery flow. Options vary, and identity verification may be required. Do not pay a stranger who claims to have a private recovery contact.
Warn friends through another channel if your account has sent scams. Save relevant emails and screenshots, but do not repost active scam links. If payment information was misused, contact the card issuer promptly.
Keep a small security routine
Revisit these settings after replacing a phone, changing your number, or receiving an unexpected login alert. Keep recovery codes accessible to you but private from everyone else. A few deliberate checks now are much easier than rebuilding a trusted account after someone else takes control.
Reach designers & developers at work
Put your product next to the tools people use every day. One sponsor per placement, no tracking pixels.
Become a sponsor