How to lock down Instagram and Facebook so you never get hacked again
Most hacks are preventable with ten minutes of setup. Do this for Instagram and Facebook, and for the email behind them.
1. Secure the email first
Unique password + 2-step verification on the email linked to your accounts. Whoever controls the email controls the account.
2. Turn on two-factor with an authenticator app
SMS is better than nothing, but an authenticator app is stronger against SIM-swap attacks. Save your backup codes in two places.
Use an authentication app for two-factor authentication on Instagram Using an app for two-factor authentication on Facebook How you can use a backup code on Instagram
3. Remove devices you don't know
Check "Where you're logged in" and log out of anything unfamiliar.
View your recent Instagram login activity Log out of Facebook on another device
4. Make sure alerts reach you
Check that the email and phone in Accounts Center are yours and current, so login alerts and security notices reach you.
Facebook security notifications (login alerts)
5. Learn the phishing tricks
- "Copyright violation, appeal within 24 hours or your account is deleted."
- "You've been chosen for the verified badge."
- A friend's account asking you to "vote" or send a code.
Real security emails show up in the app's list of recent emails from Meta. Protect yourself from phishing on Instagram Protect yourself from phishing on Facebook
6. Do a monthly check-up
Once a month: devices, email/phone, 2FA still on, backup codes still saved. Our optional Guard plan reminds you every month.
Open the interactive checklist