Securing your social media accounts
How to protect your Facebook, Instagram, LinkedIn, and other social media accounts from hackers and unauthorized access.
Social media accounts are among the most frequently targeted assets for small businesses. A hacked Facebook page or Instagram account can damage your reputation, expose your customers to scams, and be difficult to recover — especially if the attacker changes your recovery information.
A few steps make your accounts significantly more secure.
Quick summary
Enable two-factor authentication on every social media account. Use a strong, unique password for each. Review who has admin access regularly. Never share your password — use admin roles instead. Set up a backup admin account so you're never locked out.
The biggest risks to social media accounts
- Weak or reused passwords — attackers try credentials stolen from other site breaches
- Phishing — fake "your account has been restricted" emails trick you into entering your password on a fake login page
- No 2FA — without it, a stolen password is all it takes
- Too many admins — old employees or contractors still having admin access
- A single admin — if that account is compromised, you lose access entirely
Turn on two-factor authentication
This is the most important step. Do it on every platform:
For your personal Facebook account (which controls your business page):
- Open Facebook and go to Settings & privacy → Settings.
- Click Security and login (or Password and security).
- Find Two-factor authentication and click Edit or Use two-factor authentication.
- Choose Authentication app — this is more secure than SMS.
- Follow the steps to link your authenticator app.
For Meta Business Suite / Meta Business Manager: Meta can require 2FA for everyone who manages your business assets. Go to Business Settings → Security Center to configure this.
On the Instagram app:
- Go to your profile → three-line menu → Settings and privacy.
- Tap Accounts Center → Password and security.
- Tap Two-factor authentication and select your account.
- Choose Authentication app for the best security.
- Scan the QR code with your authenticator app.
Instagram accounts are managed through Accounts Center, which is shared with Facebook if they are linked.
On LinkedIn:
- Click your profile photo → Settings & Privacy.
- Go to Sign in & security → Two-step verification.
- Click Set up and choose your verification method.
- An authenticator app is available and recommended.
On X (formerly Twitter):
- Click More → Settings and Support → Settings and privacy.
- Go to Security and account access → Security.
- Click Two-factor authentication.
- Select Authentication app.
- Note: X restricts SMS 2FA to paid subscribers. Authenticator app is available to all users.
Use unique passwords for each platform
Use a password manager to generate and store a strong, unique password for each social media account. Never use the same password across platforms.
Review who has admin access
People often have lingering admin access that should have been removed months or years ago. Take 10 minutes to review:
Facebook Page: Go to your page → Manage → Page access (in Meta Business Suite, check Business Settings → Users). Remove anyone who no longer works with you.
Instagram: If managed through Meta Business Suite, check business settings. Remove former team members.
LinkedIn Company Page: Go to your page → Admin tools → Manage admins. Review and remove as needed.
Other platforms: Check the equivalent "Team," "Members," or "Users" settings on each platform you use.
See also Security steps when someone leaves.
Set up a backup admin
On Facebook and LinkedIn, you should have at least two people as admins. If the primary admin account is locked out, hacked, or deactivated, the backup admin can maintain access.
The backup admin should be a real person who you trust — ideally your own second account or a business partner.
Never share your password — use roles instead
All major platforms support multiple admin roles. Instead of sharing one login, invite team members with their own accounts and assign them the appropriate role (admin, editor, moderator, etc.).
This means:
- Everyone has their own login with their own 2FA
- You can remove one person's access without changing shared credentials
- You have an audit trail of who did what
Watch for phishing emails from "Meta" or "LinkedIn"
A very common attack: you receive an email claiming your account has been restricted, that you violated community standards, or that urgent action is required. The email links to a convincing fake login page.
Before clicking any such link, check the sender's actual email address and go directly to the platform by typing the URL yourself. See How to recognize phishing attempts.
Common questions
Related guides
- Two-factor authentication, explained
- How to set up two-factor authentication
- Security steps when someone leaves
- How to recognize phishing attempts
- What to do if an account is compromised
Need a hand?
Learn more
Security steps when someone leaves
The security checklist to run every time a team member, contractor, or employee moves on — to protect your business and remove unnecessary access.
Device & Wi-Fi security basics
Simple steps to keep the computers, phones, and networks your team uses every day secure against common threats.