The most effective way to secure an X account is to combine a unique password, an available second-factor method or passkey, a protected email account, and regular reviews of connected apps and active sessions. Never enter your password on a login page reached through an unexpected message; open x.com yourself instead. If unauthorized posts appear, change the password first, then secure the email account, revoke unfamiliar apps, end unknown sessions, delete the posts, and contact X Support if access is still blocked.
Start with this security checklist
Work through these controls in order. They address both common phishing attacks and the ways a connected app or stolen session can publish from your account.
As an Amazon Associate I earn from qualifying purchases.
- Use a password that is unique to X. Do not reuse it on another website or service.
- Turn on an available second factor or passkey. Check the security settings on your account because the choices shown can vary.
- Secure the email account linked to X. Anyone who controls that mailbox may be able to intercept reset messages or account-change notices.
- Check Apps and sessions. Revoke applications you do not recognize or no longer need, and log out sessions you do not recognize.
- Do not trust an unexpected login prompt. Verify the base domain is x.com, or navigate to x.com manually.
- Respond immediately to unexpected activity. Change the password, secure the email account, revoke app access, end unfamiliar sessions, remove unwanted posts, and escalate to X Support if necessary.
These steps complement one another. A new password will not remove every connected app, and ending a session does not undo posts that were already made. Treat each control as a separate part of the account’s recovery path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why a phishing message can lead to unauthorized posts
Phishing is designed to make a fake sign-in page look legitimate. The page may copy X’s colors, logo and wording, then ask for a username, email address or phone number and password. If you enter those details, the attacker can sign in normally and publish, change settings or attempt to lock you out.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
There is another route to the same result: a third-party application that you authorized earlier. Depending on its permissions, an app may be able to publish or delete posts, interact with other posts, change profile information, alter account settings, or follow and block accounts. A permission set that includes Direct Messages can allow an app to send, view, manage or delete messages. Unexpected posts therefore do not always prove that a person guessed your password; a buggy or compromised app can also act through an existing authorization.
The practical implication is that prevention must cover links, credentials, authorizations and sessions rather than focusing on the password alone.
How to tell whether an X login page is fake
Check the base domain, not just the padlock
Before entering an X password, inspect the address bar. X says its domains use x.com as the base domain. A secure padlock only indicates that the connection is encrypted; it does not prove that the site is operated by X. Look at the actual domain before the first single slash in the address. A look-alike domain, an unfamiliar spelling, or a different domain with “x” somewhere in the name is not the same as x.com.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When the address is uncertain, stop. Open a new browser tab, type x.com yourself, and sign in from there. Do not continue through the unexpected page to “verify” the account.
Handle links in Direct Messages carefully
A message can be malicious even when it comes from someone you know. Their account may have been taken over, or an app may be sending messages on their behalf. Shortened links from services such as bit.ly or TinyURL hide the destination, so they deserve extra caution. If a message claims your account has a problem, bypass its link and check the account directly at x.com.
Know what X says it will not request
X states that it will never ask for your password by email, Direct Message or reply. It also says it will not ask you to download something or sign in to a non-X website. Treat any request that conflicts with those rules as a phishing attempt, even if it uses urgent language or threatens suspension.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Be skeptical of liveness-check links
X’s current guidance says liveness checks appear inside the official X app or, for QR checks, in an iOS App Clip. An email, text message or Direct Message that claims to start a liveness check through a link is likely phishing. Open the official app yourself and look for the check there rather than following the supplied URL.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchStrengthen the account’s sign-in protection
Create a password used nowhere else
Choose a long, hard-to-guess password that has never been used on another site. Reuse is dangerous because a breach at a different service can give an attacker a password that also works on X. A password manager can help generate and store a different password for each service, but the important security property is uniqueness.
Do not send the password to another person or paste it into an app that asks for direct credentials. X recommends authorizing third-party access through its OAuth method instead of handing an app the X password. Sharing the password with an app or website can give that party complete control of the account.
Enable a second factor that your account offers
Two-factor authentication adds a second check after the password. X describes a mobile phone or a security key as possible second-factor possession methods. The exact choices can differ by account, country, carrier and current product settings, so open your account’s security controls and use an option you can reliably access.
A FIDO2-compatible hardware security key is an optional physical category for accounts that offer security-key authentication. It is not required for every user, and X does not endorse a particular brand or model in the guidance covered here. If you use one, keep a recovery path for loss or replacement of the key.
Recommended Free Tools
Consider a passkey
X encourages passkeys and describes them as based on WebAuthn public-key cryptography. A passkey is generated for the device: X stores the public key, while the private key remains on the device. Because a fake website cannot use the private key to authenticate to the real service, passkeys are less susceptible to phishing than passwords.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
X says passkeys are available on iOS and Android, but they are encouraged rather than mandatory. Availability and setup screens can change, so confirm the option in your current security settings. Before replacing or wiping a phone, make sure you understand how your passkey is backed up or how you will use another recovery method.
Prepare for a lost phone or changed number
Do not wait until a phone is lost to test recovery. X recommends planning for a phone replacement and says a backup code can be used when the enrolled phone is unavailable. Store backup codes somewhere safe and offline where you can retrieve them during a device loss.
X’s help material states that SMS two-factor support for non-Premium accounts ended on March 20, 2023. SMS availability for Premium accounts may vary by country and carrier. Do not assume SMS is available or sufficient; check the methods shown in your account now and keep a backup code or another factor available.
Protect the email account connected to X
The linked email account is part of your X recovery system. X’s compromised-account instructions tell users to secure that email, and X says it sends a notice to the previously used email address if the X account email is changed. If someone controls the mailbox, they may be able to read reset messages, approve changes or hide warnings.
- Use a unique password for the email account as well.
- Enable the email provider’s strongest available second factor.
- Review forwarding rules, recovery addresses and recent sign-ins for changes you did not make.
- Keep access to the mailbox before changing the X password, especially if you suspect an account takeover.
When an X account shows unexpected activity, check the mailbox for account-change messages and security alerts. A message about a changed X email address is a reason to act immediately, not to click a link in the message without first verifying the destination.
Review connected apps and active sessions
Find the review screen
In X, open Settings and privacy and look for Apps and sessions. X uses this area to list connected applications and active sessions. Menu names and placement can change, so use the account’s current settings search if the label is not in the expected location.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Understand what an app can do
| Permission or connection | Possible capability described by X | What to do |
|---|---|---|
| Read and write | Publish or delete posts, interact with posts, update profile information, manage settings, and follow or block accounts. | Keep only apps you recognize, still use and genuinely need. |
| Direct Messages included | Send, view, manage or delete messages, in addition to other granted actions. | Revoke access unless the messaging capability is essential and trusted. |
| Unknown or obsolete app | Its purpose and current operator are not clear, even if it was authorized in the past. | Revoke it. You can authorize it again later if you verify the need. |
Use X’s OAuth authorization flow when connecting a legitimate service. If you previously typed your X password into an untrusted app or website, revoke its access and change the X password immediately.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →End sessions you do not recognize
Active sessions can show a location and login time. X lets you log out an individual session or all other sessions. End sessions you do not recognize, especially those from a location or time you cannot explain.
Logging out stops further actions from that session, but X cautions that it may not erase data already cached on the device. If the device itself may be compromised, change the password and secure the device as well; do not rely on session termination alone.
What to do when unauthorized posts appear
Move quickly, and follow this order. It limits continued access before you spend time cleaning up the visible posts.
- Change the X password immediately. Use a new password that is strong and not used anywhere else. If you cannot sign in, start X’s password-reset process. Changing the password alone does not automatically log the account out of X mobile apps, so continue through the remaining steps.
- Secure the associated email account. Change its password if necessary, check recent activity and look for unexpected X account-change notices. Confirm that the mailbox and recovery methods remain under your control.
- Revoke unfamiliar third-party apps. In Apps and sessions, remove connections you do not recognize or no longer need. Pay particular attention to read-and-write and Direct Messages permissions.
- End unknown active sessions. Log out individual sessions you cannot explain, or use the option to log out all other sessions if the account’s history is unclear.
- Delete unwanted posts. Remove posts, replies or other activity made during the compromise after you have contained access. If the posts are harmful, keep a record of their times and URLs before deletion when that is safe and useful.
- Scan devices if behavior continues. X advises scanning computers for viruses or malware and installing operating-system and application security patches when unauthorized behavior persists after the password change.
- Contact X Support if you still cannot sign in. If a password reset does not restore access, submit an X Support Request using the email associated with the account. Include the username and the date you last had access.
Unexpected behavior can sometimes come from a third-party application bug rather than a deliberate takeover. That distinction does not change the first response: change the password, revoke connections and review sessions so the app cannot continue acting while you investigate.
Choose the right authentication mix
No single option fits every recovery situation. Compare the methods by how they resist phishing, what device they depend on and how you will regain access after loss.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
| Method | Phishing resistance | Device dependence | Recovery considerations |
|---|---|---|---|
| Unique password alone | Lowest of these options; a convincing fake page can capture it. | Works anywhere you can sign in. | Must rely on password reset and control of the linked email or phone. |
| Two-factor with a mobile phone | Adds a second check beyond the password, but the account still depends on the password and the available phone method. | Requires access to the enrolled phone or the account’s supported recovery method. | Plan for a phone replacement and store a backup code. SMS availability varies; it is not universal. |
| Hardware security key | Provides a physical second factor and is an option X identifies for some accounts. | Requires the enrolled key when signing in. | Keep a backup key or another recovery method if your account permits it; availability is account-specific. |
| Passkey | X describes passkeys as less susceptible to phishing because authentication uses WebAuthn public-key cryptography. | Private key remains on the enrolled device; availability is stated for iOS and Android. | Plan for device loss, replacement or reset before it happens, and retain another recovery path. |
X’s help material does not provide a quantified head-to-head test of these methods. The practical priority is to enable a method your account offers and that you can recover when your primary device is unavailable.
Keep the account secure after the initial setup
Review access after major changes
Recheck Apps and sessions after installing a new social tool, changing phones, using a shared computer or responding to a security incident. Remove connections that are no longer necessary instead of allowing them to accumulate indefinitely.
Use direct navigation for security alerts
An urgent message is not proof that the requested action is real. Treat links in emails, replies and Direct Messages as untrusted entry points. Open x.com or the official app yourself, then look for notices and settings there.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPatch and scan devices when symptoms persist
Repeated unauthorized posts after a password change can indicate malware or a still-authorized application. Install operating-system and application security updates, scan the computers and phones used to access X, and repeat the app and session review.
Maintain a recovery record
Keep your username, the linked email address, backup codes and the date of your last known access somewhere secure. This information is useful if you must submit a support request and reduces the chance of making rushed decisions during an incident.
Common mistakes that leave an account exposed
- Trusting a familiar sender: A friend’s account can be compromised. Verify the destination independently.
- Checking only for HTTPS: Encryption does not establish that the page belongs to X; verify the x.com base domain.
- Changing the password and stopping: Existing apps and mobile sessions may remain active.
- Giving an app the password directly: Use OAuth authorization instead; direct password sharing can grant complete control.
- Deleting posts before containing access: Remove unwanted content only after changing credentials and revoking access, or the attacker may recreate it.
- Assuming SMS recovery will always work: Availability depends on account type, country and carrier, and support for non-Premium accounts ended March 20, 2023.
- Waiting to prepare backup access: A lost phone or reset device can turn a manageable sign-in problem into a lockout.
When to escalate to X Support
Use the recovery sequence first when you still have access. If you remain unable to sign in after using the password-reset process, submit an X Support Request with the email associated with the account, your username and the date you last accessed it. Explain the unauthorized posts or account changes clearly and identify which recovery steps you already completed.
Keep in mind that account settings, authentication methods and support procedures can change. Confirm the current options shown in your X account and the latest X Help Center guidance when you are preparing a recovery plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
