Short answer
Use a unique password, turn on two-factor authentication with an authenticator app, security key or passkey, enable password reset protection, review connected apps and sessions, and never share login codes.
Key takeaways
- Two-factor login stops most account takeovers; an authenticator app or security key is stronger than text-message codes.
- Review Apps and sessions every few months and remove what you don't recognize.
- X support never asks for your password or codes in a message.
Most hacked X accounts fall to the same few tricks: a reused password, a phishing link, or a fake "copyright" or "verification" message. Ten settings and habits close nearly all of those doors.
What should I turn on today?
A unique password and two-factor authentication with an app, key or passkey.
- Unique password. Use a password manager and a long random password you don't use anywhere else.
- Two-factor authentication. Settings and privacy > Security and account access > Security > Two-factor authentication. Choose Authentication app or Security key. X restricted text-message codes to paying subscribers in 2023, and they're the weakest option anyway.
- Save the backup code. X shows it when you set up two-factor. Store it in your password manager.
- Passkey. If X offers passkey login on your device, add one. It's phishing-resistant and replaces typing the password.
- Password reset protection. In Security settings, require your email or phone to be confirmed before a reset.
What should I review regularly?
Connected apps, active sessions and the email and phone on the account.
- Apps and sessions: Settings > Security and account access > Apps and sessions. Revoke apps you no longer use; log out of sessions you don't recognize.
- Account information: make sure the email and phone are yours and current, so resets reach you.
- Delegation: if you gave someone access to your account through X's delegate feature, check who still has it.
What habits keep me safe?
Never log in from a link in a message, and never share codes.
- Go to x.com directly when an email or DM claims there's a problem with your account. Phishing messages about copyright strikes, suspensions, "verification" and "badge renewal" are common.
- Don't share codes with anyone, including "X support". X doesn't ask for them.
What are the most common scams?
Fake support, fake verification offers, crypto giveaways and impersonated friends asking for money.
| Scam | Tell |
|---|---|
| "Your account violated copyright; appeal here" | Link to a non-x.com login page |
| "Get verified for free" | Asks for your password or a code |
| Crypto "double your money" giveaway | Uses a famous name or a fake gold check |
| Friend's account asking for money | Unusual tone, urgency, payment by gift card or crypto |
X bans these under its financial scam policy. Report them, and never act on them. If it already happened, follow how to recover a hacked account.
Questions people ask
What's the safest two-factor method on X?
A hardware security key or passkey, then an authenticator app. Both resist phishing far better than codes by text message.
Why did X turn off my text-message two-factor?
In March 2023 X limited two-factor by text message to paying subscribers and asked others to switch. If your text-message option disappeared or isn't offered, set up an authenticator app or security key instead.
How do I know if someone else logged into my account?
Check Settings > Security and account access > Apps and sessions > Sessions. Log out anything unfamiliar, then change your password.