Secure an X (Twitter) Account Against Takeover

Updated 15 November 2026 · Standard formula, shown below

This guide walks you through the practical steps to lock down an X (formerly Twitter) account so attackers can’t hijack it. You’ll learn how to strengthen your password, enable two-factor authentication, revoke suspicious sessions, and monitor account activity. All you need is access to the account’s registered email and phone number.

What You’ll Need

Access to the email address linked to the X account
Access to the phone number linked to the account (if any)
A password manager (recommended, but not required)
An authenticator app like Google Authenticator or Authy (recommended)

Step-by-Step

Change your password to something unique and strong. Go to Settings and privacy → Your account → Account information → Password. Use a password that is at least 12 characters long, with a mix of letters, numbers, and symbols. Do not reuse this password anywhere else. If you use a password manager, let it generate a random one.
Enable two-factor authentication (2FA). Go to Settings and privacy → Security and account access → Security → Two-factor authentication. Choose Authentication app (recommended) or Text message. If you pick the app, scan the QR code with your authenticator app and enter the 6-digit code to confirm. Keep backup codes somewhere safe (like a password manager) – you’ll need them if you lose your phone.
Add or update your phone number and email. Under Account information, verify that your email address and phone number are current. A verified phone number is the primary way X confirms your identity when you request a password reset. Remove any old emails or numbers you no longer control.
Review and revoke active sessions. Go to Settings and privacy → Security and account access → Sessions. You’ll see a list of devices where you’re logged in. Click each unfamiliar session and select Log out. If you see a session you don’t recognize at all, log out of all sessions by clicking Log out of all other sessions.
Check connected apps and revoke any you don’t use. Under Security and account access → Connected apps, review the third-party apps that have access to your account. Revoke any that you didn’t install or no longer use. An attacker can use a compromised app to take over your account.
Set up a password reset email that’s hard to guess. If your email account uses a weak password or has no 2FA, an attacker can reset your X password by accessing your email. Secure your email with a strong password and 2FA too. If possible, use a dedicated email address that you don’t use for other services.
Watch for phishing attempts. X will never ask for your password or 2FA code via direct message or email. If you get a message that says “your account will be suspended” or “verify your identity” with a link, don’t click it. Report it as phishing and delete it.
Regularly review your account activity. Go to More → Settings and privacy → Your account → Account information → Account activity. Check for login attempts from unusual locations or devices. If you see something suspicious, change your password immediately and log out of all sessions.

Common Mistakes

Using the same password for X and other sites. If one site gets breached, attackers will try that password on X. Always use a unique password.
Relying only on SMS 2FA. Text messages can be intercepted via SIM swapping. An authenticator app is much safer.
Ignoring the “suspicious login” email. If X sends you an alert about a new login, act on it immediately – even if you think it’s spam.
Keeping old sessions active. A phone you lost or sold can still have an active X session. Always log out of devices you no longer own.
Clicking links in DMs that ask you to “verify” your account. These are phishing attempts designed to steal your credentials.
Not securing the recovery email. If your email is hacked, the attacker can reset your X password and lock you out.

Tips

Use a password manager to generate and store unique passwords for every site.
Enable 2FA on your email account as well – it’s your last line of defense.
If you use an authenticator app, back up the recovery codes in a safe place (like a password manager or a printed sheet in a secure drawer).
Consider using a hardware security key (like a YubiKey) for the highest level of protection. X supports them for 2FA.
Check your account’s “Account activity” every few months to spot any unusual logins early.
Never share your password or 2FA code with anyone – X support will never ask for them.

Troubleshooting

What if I can’t log in because I’ve already been locked out?
Go to the X login page and click “Forgot password?”. Enter your username or email. X will send a reset link to your email or a code to your phone. If you don’t have access to those, use the “Can’t access those?” option to submit a request to X support. Be ready to provide details that prove you own the account (like the original signup email or a previous password).

What if I don’t have my phone number anymore?
You can still use your email to reset your password, but you’ll need to update your phone number before you can use SMS 2FA again. To change your phone number, log in and go to Account information → Phone. If you’re locked out, you may need to verify your identity via email or a support ticket.

What if I lost my authenticator app and don’t have backup codes?
You’ll need to use the “Can’t access your 2FA method?” link on the login screen. X will ask you to verify your email and phone number. If that fails, you’ll have to contact X support and prove ownership. To avoid this in the future, always save backup codes when you enable 2FA.

What if I get a “suspicious login” alert but it was me?
If you logged in from a new device or location, X sends an alert. If you recognize the login, you can ignore it. But if you don’t recognize it, click “Protect my account” and change your password immediately. Also log out of all sessions.

What if my email has been compromised?
First, secure your email: change its password, enable 2FA, and log out of all sessions. Then change your X password and log out of all X sessions. Check your email’s forwarding rules – attackers often set up forwarding to keep receiving your messages.

Frequently Asked Questions

Is SMS 2FA safe enough?
SMS 2FA is better than nothing, but it’s vulnerable to SIM swapping. An authenticator app or hardware key is much more secure. If you must use SMS, keep your phone number tied to a carrier account with a strong PIN.

How often should I change my password?
You don’t need to change it on a schedule. Instead, change it whenever you suspect a breach, or if you used the same password on another site that was compromised. A strong, unique password can stay the same for years.

Can I use the same 2FA app for multiple accounts?
Yes, an authenticator app like Google Authenticator or Authy can store codes for many accounts. Just make sure you back up the seed or recovery codes for each one.

What does “log out of all sessions” do?
It signs you out of every device that has your X account open, including old phones, computers, and web sessions. This is the quickest way to kick out an attacker who may have access.

Will X ever send me an email asking for my password?
No. X will never ask you to reply with your password, 2FA code, or personal details. Any email that asks for that is phishing. You can report it to X by forwarding it to spam@x.com.

What if I think my account has already been taken over?
Act fast: go to the login page and try to reset your password. If the attacker changed it, use the “Forgot password?” flow. If you can’t get back in, contact X support immediately and provide proof of ownership. Also check your email for any password reset requests – if you see one you didn’t initiate, secure your email first.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.