Lock down your social accounts

Your social accounts are part of your business, and losing one can mean losing years of followers and reviews overnight. This guide walks you through protecting every business account, giving your team and any agency their own safe access, and writing down exactly what to do if you ever get hacked or locked out. If you’re locked out right now, jump to step 6 first.

Before you start

• About an hour. You can do one account at a time if that’s easier.
• Your phone, plus the logins for each business account: Instagram, Facebook, TikTok, LinkedIn, Google Business Profile, and any others.
• The login for the email address those accounts use. If you’re not sure which one that is, step 1 helps you find out.
• A free authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator. Many password managers include one too.

Want to do it yourself?

Difficulty

6 out of 10

Estimated completion time

1–2 hours for a small set of accounts

Skills you’ll need: Use a password manager, set up an authenticator, save recovery codes, and review team permissions without locking yourself out.

I’ll do it myselfI’d rather get help

How this helps your brand

Protecting business accounts helps preserve the profiles, conversations, and reputation you have built. Named access and recovery details reduce the disruption if a device, employee login, or account is lost.

1. 1

   Step 1: List your accounts and who can get into them

   Start with a short list. For each business account, write down:

   • The platform and the account name.
   • The email address and phone number it’s registered to.
   • Who else can log in or post: staff, a freelancer, or an agency.

   Tip: Watch for accounts registered to a former employee’s email, someone’s personal phone, or an agency you no longer work with. Those are the ones businesses lose. Change them to an email and phone number the business controls.

2. 2

   Step 2: Secure the email address first

   The email address behind your accounts is the master key. Anyone who gets into it can press “forgot password” on every account and take them all. So protect it before anything else.

   Log in to that email account and go to its security settings. Then:

   • Change the password to a long one you don’t use anywhere else.
   • Turn on two-step login (step 4 explains what this is).
   • Check that the recovery phone number and backup email are ones you still use.
   • Look at the list of signed-in devices and sign out any you don’t recognise.
   • Check for forwarding rules you didn’t set up. Hackers sometimes add one to quietly copy your mail.
3. 3

   Step 3: Give every account its own password, kept in a password manager

   If you use the same password in more than one place, one leak from any website can open all of them. Each account needs its own long password.

   You don’t have to remember them. A password manager is an app that creates strong passwords, stores them safely, and fills them in for you. Well-known options include 1Password, Bitwarden, and the password manager built into Apple, Google, or Microsoft devices.

   Save each account’s login in the password manager, then change any password you’ve used anywhere else.

   Tip: Protect the password manager itself with a strong password you can remember and two-step login. It’s the one password worth memorising.

4. 4

   Step 4: Turn on two-step login with an authenticator app

   Two-step login (also called two-factor authentication, or 2FA) means a password alone isn’t enough. After your password, you also enter a short code from your phone. Someone who steals your password still can’t get in.

   An authenticator app is safer than codes sent by text message, because text messages can be redirected to a criminal’s phone. Use text messages only if a platform offers nothing else. Some platforms also offer passkeys, which let you log in with your phone’s fingerprint or face unlock. Those are a good choice too.

   Look in each account’s Settings under Security, Password and security, or Sign-in. Menus change often, so if you can’t find it, search the platform’s official help pages for “two-factor authentication”. Where to start:

   • Instagram and Facebook: Meta’s Accounts Centre, under Password and security.
   • TikTok: Settings and privacy, then Security.
   • LinkedIn: Settings, then Sign in and security.
   • Google Business Profile: it uses your Google account, so turn on 2-Step Verification in your Google account’s security settings.

   Tip: When you switch it on, most platforms give you a set of backup codes. Save them in your password manager or print them and keep them somewhere safe. They get you back in if you lose your phone.

   Illustrated exampleA password is only the first check

   Example sign-in · your business account

   1. 1Your unique password•••• •••• ••••Filled by your password manager
   2. 2Your authenticator app482 913Illustrative code from your phone

   Both checks pass → signed in

   Lost your phone?

   Use a saved backup code.Keep codes in your password manager or a safe printed copy.

5. 5

   Step 5: Give your team and agency their own access

   Never share your own password with staff, freelancers, or agencies. If they have it, you can’t tell who did what, and you can’t remove one person without changing it for everyone.

   Every major platform lets you add people with their own login instead. Look in your business settings for something like Page access, Roles, People, or Managers, and check the platform’s help pages for current steps:

   • Facebook and Instagram: add people through Meta’s business tools, such as Meta Business Suite.
   • TikTok: use TikTok Business Center to add team members.
   • LinkedIn: add admins to your company Page.
   • Google Business Profile: add managers to your profile.

   Tip: Make sure at least two trusted people in your business have full owner or admin access, so losing one login doesn’t lock you out. Give everyone else the lowest level of access that lets them do their job, and remove people the day they stop working with you.

   Illustrated exampleKeep ownership in the business; limit everyone else

   Northline Studio · example access listOne login per person

   2 trusted owners

   • MayaBusiness owner
     Owner / adminFull control
   • DevTrusted co-owner
     Owner / adminFull control
   • JessStaff member
     Publishing accessCreate posts and reply
   • Northline AdsAgency
     Ads accessManage advertising
   • SamFormer freelancer
     RemovedNo access

   Each person signs in with their own account. Remove their access when the work ends.

6. 6

   Step 6: If you’re hacked or locked out

   Act quickly, but don’t panic, and don’t trust anyone who contacts you offering help. Do these things in order:

   • Check your email for a message from the platform saying your email or password was changed. Many include a link to undo the change. Make sure it really came from the platform before you click.
   • Use only the platform’s official recovery pages. Type the platform’s address into your browser yourself, then search its help centre for “hacked account”. Facebook and Instagram also have dedicated pages at facebook.com/hacked and instagram.com/hacked.
   • Ignore anyone offering to recover your account for a fee, in comments, messages, or online ads. These are scams. The platforms don’t charge for recovery.
   • Warn your followers and customers through another channel, such as email, your website, or another social account. Tell them not to click links or send money because of messages from the hacked account.
   • Once you’re back in, change the password, turn on two-step login, and remove any people, devices, or connected apps you don’t recognise.

   Tip: Most hacks start with a fake message, such as a “copyright warning” or “your page will be deleted” notice with a link to log in. Real warnings appear inside the app as well. If in doubt, go to the platform yourself rather than clicking the link.

I run a small business and I’m not technical. I want to lock down our social media accounts.

Our main account is on [platform]. We also use: [other accounts, or none].
The accounts are registered to this kind of email: [for example a Gmail address, a Microsoft 365 work address, or a staff member’s personal email].
These people also need access: [for example one staff member who posts, and an agency that runs ads].

Please:
1. Make me a simple checklist for each account: where to turn on two-step login with an authenticator app, how to add each person with their own access instead of sharing a password, and which recovery details to keep up to date.
2. Write a one-page “if we get hacked” plan I can print, with the steps in order and a short message I can send to customers to warn them.
3. Tell me which of my accounts is most at risk based on what I’ve described, and why.

Menus change often, so for each step tell me what to search for in the platform’s official help centre to confirm the current steps. Don’t invent menu names or web addresses you aren’t sure of.