How to Secure Your Facebook Account: A Checklist

To secure a Facebook account properly, do four things: set a long unique password used nowhere else, turn on two-factor authentication with a hardware key or authenticator app rather than SMS, enable login alerts, and audit your active sessions and connected apps. Those four cover the overwhelming majority of real account takeovers. Everything else is refinement.

The order matters. A strong password with no second factor still falls to a credential leak. A second factor on an account with a stale session from a laptop you sold is a lock on a door that is already propped open. Work through them in sequence.

Step 1: Fix the password first

The single most common way Facebook accounts are lost is not clever hacking. It is credential reuse. A password you used on Facebook and also on some forum that got breached years ago is in a database that attackers test against every major platform automatically. Nothing about Facebook's own security prevents a correct password from working.

So the requirement is unique, before it is complicated. Length does more than symbol-substitution: a passphrase of four or five unrelated words is both harder to crack and easier to type than a short string of punctuation, and swapping letters for lookalike characters in a dictionary word fools almost nothing.

Use a password manager and let it generate the value. The objection that putting everything in one vault is risky is reasonable on its face, but the alternative in practice is reuse, which is worse. Secure the vault itself with a long master passphrase and its own second factor.

If you suspect your current password has been exposed, change it, then use the option to log out of other devices when prompted, since changing a password does not automatically end sessions elsewhere on every surface.

Step 2: Choose the right second factor

Two-factor authentication is the step that converts a stolen password from a disaster into a nuisance. But the available methods are not equivalent, and the gap between the best and worst is wide.

A hardware security key is the strongest option because the private key never leaves the device and the login is cryptographically bound to the real domain. That domain binding is what makes it phishing resistant: a convincing fake login page cannot get a usable response from the key, because the key knows it is not talking to facebook.com. No code exists for you to be tricked into typing. Register two keys and keep one somewhere safe, so losing one is not a lockout.

An authenticator app is the sensible default for most people. It generates codes from a shared secret on your device, works offline, and removes your phone carrier from the equation entirely. Its limitation is that a code can be read aloud, typed into the wrong site, or relayed by an attacker in real time, so it protects against stolen passwords but not against a well-built phishing page.

SMS is the weakest, and it is worth understanding why rather than taking it on faith. Your phone number is not a credential you control; it is an account at your carrier, and it can be moved to a new SIM by someone who persuades, deceives, or bribes a carrier employee. NIST's digital identity guidelines in SP 800-63B classify use of the public telephone network for out-of-band verification as RESTRICTED, and tell verifiers to watch for risk indicators including device swap, SIM change, and number porting. Texts can also be read from a lock screen or forwarded.

None of that means skip SMS if it is all a service offers. Weak second factor beats no second factor by a wide margin. But on Facebook, which supports keys and apps, there is no reason to settle for it. Meta documents the options in its security features and tips help section.

Whichever you pick, download the recovery codes during setup and store them away from the device generating your codes. That step prevents the most frustrating version of a lockout, which we cover in our guide to recovering lost 2FA access. If you want the detail on how TOTP works and where browser-based generators do and do not belong, see what TOTP is and whether online 2FA generators are safe.

Step 3: Turn on login alerts

Login alerts notify you when your account is accessed from an unrecognised device or browser. They are detection rather than prevention, and that is exactly their value: the difference between discovering a compromise in minutes and discovering it when a friend asks why you are messaging them about crypto.

Enable them in your security settings and route them somewhere you actually read, which for most people means email plus the in-app notification. Then make the alert mean something by reacting to it: if one arrives for a login you did not make, change the password immediately and end the unfamiliar session rather than assuming it was your own old tablet.

Step 4: Audit sessions and connected apps

This is the step almost nobody does, and it is where old access quietly persists.

Under the "Where you're logged in" area of your security settings, Facebook lists active sessions with an approximate device, browser, and location. Read it properly. Phones you no longer own, a browser on a work computer you have left, an unfamiliar city: end those sessions. Location estimates derived from IP addresses are imprecise, so a neighbouring city is not automatically alarming, but a different country usually is. If you see anything you cannot account for, log out of all sessions and change the password in that order.

Then review apps and websites connected to your account. Every "Continue with Facebook" login you have ever used sits in that list, often holding permissions granted years ago to services you have forgotten. Remove anything you no longer use, and look closely at anything holding permission to post. Pay particular attention to tools that promised follower analytics, profile viewers, or engagement growth, since those categories are heavily populated by data harvesters, and the ones that automate activity on your behalf breach Meta's terms and can get your account restricted on top of the privacy problem.

While you are there, confirm your recovery email and phone number are current and that you still control both. A stale recovery address is a hole in every path back into the account.

Step 5: Learn to recognise the phishing patterns

Credentials are usually given away rather than cracked, so this is a skill with a real payoff. Facebook phishing clusters into a few recognisable shapes.

• The urgent policy notice. A message claiming your Page violated copyright or community standards and will be deleted within 24 hours unless you "confirm" via a link. Urgency plus a link is the signature.
• The verification badge or monetization offer. Flattering, unsolicited, and pointing at a login page on a domain that is not facebook.com.
• The hijacked friend. A real friend's compromised account sends you a link, a video "is this you?", or a request for a code they say was sent to your phone by mistake. That code request is an account takeover in progress.
• The fake support agent. Replies to your public complaint offering to help, then asking for your password or a verification code. Real Meta support asks for neither.
• The lookalike login page. Visually perfect, wrong domain. Sometimes reached through a search ad rather than a message.

Two habits defeat nearly all of it. Never log in through a link someone sent you; type facebook.com yourself, or use the app, and if the notice was genuine it will be waiting in your notifications. And treat any request for a verification code as hostile, regardless of who appears to be asking, because a legitimate party never needs your code.

Using a hardware key closes the remaining gap, since there is no code to surrender and the key refuses to authenticate to the wrong domain.

A quick reference checklist

1. Unique, long password, generated and stored in a password manager.
2. Two-factor authentication on, using a hardware key or authenticator app, not SMS.
3. Recovery codes downloaded and stored separately.
4. Login alerts enabled and sent somewhere you read.
5. Active sessions reviewed, unknown and obsolete ones ended.
6. Connected apps pruned, especially anything that can post.
7. Recovery email and phone verified as current and under your control.
8. A second administrator on any Page you depend on commercially.
9. Password manager itself protected with its own second factor.

That last-but-one point is underrated. If your personal account hits a verification hold, a Page with only you as admin becomes unreachable too. Our article on what a Facebook checkpoint means and how to clear it explains that scenario.

Frequently asked questions

How often should I change my Facebook password?

Routine scheduled changes are no longer recommended, because they push people toward predictable variations. Change it when there is a reason: a suspected breach, a login alert you cannot explain, a shared or reused password, or any period where someone else had access.

Is an authenticator app really better than SMS?

Yes. An authenticator app generates codes on your device from a stored secret, so it does not involve your phone carrier and cannot be defeated by moving your number to another SIM. NIST treats telephone-network delivery as a restricted method for this class of reason.

Can someone log in with just my UID?

No. A UID is a public numeric identifier, roughly like a username: useful for referring to an account, useless for authenticating as it. Logging in requires your password and second factor. Our explainer on what a Facebook UID is covers what it can and cannot do.

Should I use Facebook Login on other websites?

It is reasonable for reputable services, and it avoids creating another password. The trade-off is concentration of risk and the data you grant. Keep the connected list short, grant the minimum permissions offered, and remove entries you stop using.

What should I do first if I think my account is compromised?

Change the password, then end all other active sessions, then check that the recovery email and phone number are still yours, since attackers change those to lock you out. After that, review connected apps and recent posts, and re-enroll two-factor authentication to rotate the secret.

Do profile viewer or follower analytics tools pose a risk?

Often yes. Facebook does not expose who views your profile, so any tool promising that is misrepresenting what it does, and granting it account access hands over your data. Several such categories also automate activity, which violates Meta's terms and can get your account restricted.

Does two-factor authentication slow down everyday logins?

Barely. You can mark your usual devices as trusted so codes are not requested every time, and a hardware key is a single tap. The cost is a few seconds on new devices, against a large reduction in takeover risk.

If your work involves looking up public profile identifiers, note that our Facebook UID Finder, along with the Instagram and TikTok tools, never ask for your login. Any site that requests your Facebook password to perform a lookup should be closed immediately.