How to secure your X account: the settings that matter

To secure your X account, lock five things in order: the password, the second sign in step, the password reset form, the apps and sessions already signed in, and your own habits around links and messages. X has a setting for each one. This guide shows where they are and which choice to make. Then go through the apps you have authorised: how to review and remove connected apps.

It is written for people who run an account that matters: a brand, a founder profile or a client account. If other people post for you, the section on Delegate saves you from the most common mistake. Keep a copy of your data too: how to download your X archive.

Where an X account can be attacked

An X account has five doors, and a strong lock on one does not help while another stands open. Lock them in this order.

The order matters. A strong password with no second step still falls to one convincing fake page, and a second step does not help if an old app still has the right to post for you. Locked out by a forgotten password? See how to recover a forgotten X password.

Everything below sits in one place. Open Settings and privacy, then Security and account access. Privacy settings sit next door; see the privacy settings every brand should check.

Menus move. If yours looks different, search your settings for the name in bold below. The names are what matter.

Use a password nobody can guess or reuse

X's advice is plain: a strong password that you do not reuse on other sites. Its security tips spell out what strong means.

• Length and mix. At least 10 characters, mixing upper case, lower case, numbers and symbols.
• One password per site. A different password for every website you visit.
• Nothing personal. No personal information, common dictionary words or runs such as abcd1234 or qwerty.

A password manager is the practical way to do this, because nobody remembers a different long password for every site. That part is our advice, not X's.

Reset codes matter here too. X sends the code to the email address or phone number on the account, and it stays valid for 60 minutes. Whoever controls that inbox can finish a reset.

Which two factor option should you pick on X

Pick an authentication app or a security key. X lists three two factor methods: text message, authentication app and security key. Text message is only for X Premium subscribers: X's help page says it stopped supporting it for everyone else from 20 March 2023.

Why we put keys and passkeys first

CISA's guidance says the only widely available phishing resistant authentication is FIDO/WebAuthn. Security keys and passkeys are both built on FIDO standards. A code from an authentication app is not, because you can type it into a page that looks like X.

CISA also says any MFA is better than no MFA. So an authentication app is a good choice if you have no key. X does not rank its methods. This ranking is our reading of CISA's definition.

Turn on two factor, step by step

1. Open the settings

   Go to Settings and privacy, then Security and account access, then Security.

2. Choose Two-factor authentication

   Pick Authentication app or Security key. Text message appears only if you subscribe to X Premium.

3. Pair your authentication app

   Scan the QR code with any time based one time password app. X names Google Authenticator, Authy, Duo Mobile and 1Password. Enter the code it shows and tap Verify.

4. Save your backup code

   X says to write it down, print it or take a screenshot. Keep a copy somewhere other than the phone that holds your app.

5. Add a passkey (optional)

   In the X app on iOS or Android, go to Security, open Passkey under Additional password protection, enter your password and choose Add a passkey.

Turn on Password reset protect

Password reset protect makes X ask for the email address or phone number on your account before it sends a reset link or code. X's help pages call it password reset protection. In the app the switch reads Password reset protect.

It matters because of how recovery works. Without it, a username alone is enough for someone to request a reset link, and usernames are public.

That is the weak spot attackers used at the start of September 2026. TechCrunch reported on 1 September that attackers were triggering password reset requests in bulk, using public usernames, after X Money launched. X product engineer Mridul Singhai said X was investigating and had found no evidence of breaches.

1. Open the Security page

   Settings and privacy, then Security and account access, then Security.

2. Find Additional password protection

   Switch on Password reset protect.

3. Confirm with your password

   Enter your current account password and choose OK.

How to review connected apps and sessions

Open Apps and sessions and remove anything you do not recognise. Connected apps lists every tool you have approved, with the permissions each one holds. Sessions lists every active login with its location and time.

Depending on what you granted, X says a connected app may read your posts, see who you follow, update your profile, post for you, access your Direct Messages or see your email address. That is a lot of reach to leave with a tool you stopped using.

1. Open Connected apps

   Settings and privacy, then Security and account access, then Apps and sessions, then Connected apps.

2. Revoke what you do not use

   Choose Revoke access next to any app you do not recognise or no longer use.

3. Open Sessions

   Look at each login's location and time. Choose Log out next to one session, or Log out all other sessions at the top of the list.

How a tool asks for access is a test in itself. A trustworthy tool sends you to x.com to approve it and never asks for your password. That is how Kairo Post works: account owners approve it on x.com with OAuth 2.0 and PKCE, and we never see X passwords.

Tools that post for you also fall under X's rules. Our guide to X automation rules explains what they allow.

Share access without sharing your password

Give people a Delegate role, never your password. X Delegate lets you invite someone as an admin or a contributor. It sits under Security and account access.

Know who has access. The account most at risk is rarely the one with the weakest password. It is the one where nobody can say who still has access. A shared password makes that impossible to answer. A role you can see and manage does not.

This is the short version. The full set of roles, approvals and onboarding steps is in our guide to managing X for clients.

How to spot phishing aimed at your X account

The rule is short: X says it never asks for your password by email, Direct Message or reply, and it only sends email from x.com. Anything else is a trap. Open the X app yourself instead of clicking.

Three lures are worth knowing, because they are the ones X and the press describe.

The giveaways: a link, a deadline, and a request to log in. Nothing in it names your account.

1. Early June 2026

   Email gets a sender check

   X says it added a Mark Certificate to emails it sends. Many email apps show a blue checkmark next to the sender.

2. July 2026

   Fake alerts look real

   The Next Web reported phishing emails that copy X's login notifications almost exactly, with correct logo and grammar. Real alerts name your handle.

3. 1 September 2026

   Reset email flood

   Users received reset emails they never requested after the launch of X Money. An X engineer said there was no evidence of breaches.

What to do if someone already has access

If you can still log in, work through these in order. They come from X's page for compromised accounts.

1. Change your password

   Use a new strong password you have not used before. If you are logged out, use Forgot password on the login page.

2. Revoke apps you do not recognise

   Open Apps and sessions, then Connected apps. X lists this as its own step, so do it even after the password change.

3. Log out other sessions

   In Sessions, choose Log out all other sessions.

4. Update trusted apps

   If a trusted app uses your X password, update it there. Otherwise failed login attempts can lock you out.

5. Clean up

   Delete posts you did not write and scan your computer for malware.

6. Ask X if you still cannot get in

   Send a support request from the email address on the account, with your username and the date you last had access.

Which steps matter most for your kind of account

Every account needs the same five locks. What changes is which one is most likely to slip. This is our advice, based on how each kind of account is run.

When a person leaves a team, the check is short: remove their Delegate role, and review Connected apps for anything they set up. If they only ever had a role, nothing else needs to change. That is the payoff of never sharing the password.

A security check you can repeat

You do not need a quarterly project. Run this list when you set up an account, when a person joins or leaves, and whenever a strange email arrives.

If you connect tools to your account, ask how each one asks for access and what it stores. Those questions are fair for every tool you try, ours included.