iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most effective protection is layered: use a password that is unique to X, enable an available second factor or passkey, secure the email account linked to X, and routinely review connected apps and active sessions. Never enter your password on a page reached through an unexpected message; open x.com yourself instead. If posts appear that you did not write, contain the incident immediately by changing the password, securing the email account, revoking unfamiliar apps, ending unknown sessions, deleting the posts, and contacting X Support if access is not restored.
Start with this five-minute security check
Use the following order if you are signed in and have not seen suspicious activity:
- Change to a unique password. Choose a long password that has never been used on another site. A password manager can generate and store one, but do not give your X password to an app that claims to improve your account.
- Turn on an available second factor. In X, open Settings and privacy, then the security or two-factor authentication area. The choices shown depend on the account and current X availability. A mobile-phone factor or a security key may be offered. Passkeys may also be available on iOS and Android.
- Protect the linked email account. Give that mailbox its own unique password and second factor. Anyone who controls it may be able to receive reset messages or approve account changes.
- Audit apps and sessions. In Settings and privacy, open Apps and sessions. Revoke applications you do not recognize or no longer need, and log out sessions whose device, location, or time does not make sense.
- Save a recovery method. If X offers backup codes for your two-factor setup, generate them and keep them offline. Plan how you will sign in if your phone is replaced or unavailable.
These controls address different failure points. A password protects the account secret; a second factor or passkey helps when that secret is exposed; email security protects recovery; and app and session reviews stop an already-authorized connection from continuing to act.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How to recognize an X phishing attempt
Check the base domain, not just the padlock
A phishing page can copy X’s colors, logo, and sign-in form. Before typing a password, inspect the address and confirm that the base domain is x.com. A secure padlock only indicates an encrypted connection to the site you reached; it does not prove that the site is operated by X. If the address is confusing, contains an unexpected domain, or uses a look-alike spelling, close it and type x.com yourself.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Short links can hide their destination. A link shortened through a service such as bit.ly or TinyURL may eventually lead somewhere that is not X, so do not treat a familiar-looking short URL as proof of safety.
Be skeptical of links in Direct Messages
A message from a real contact can still be dangerous if that person’s account was compromised. Do not enter your password merely because a Direct Message appears to come from someone you know. If a message says you must “verify,” “appeal,” or “unlock” the account, navigate to X directly and look for the issue after signing in rather than following the message’s login prompt.
Know what X says it will never request
X states: “X will never ask you to provide your password via email, Direct Message, or reply.” It also says it will not ask you to download something or sign in to a non-X website. Treat any request that conflicts with those rules as a phishing attempt, even when it uses urgent language or an official-looking signature.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsTreat liveness-check links as a red flag
X’s current liveness-check guidance says those checks appear only inside the official X app or, for QR checks, in an iOS App Clip. An emailed, texted, or messaged link that claims to start a liveness check is therefore likely to be phishing. Open the official app yourself and check there instead of continuing through the external link.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Build stronger sign-in protection
Use a password that exists nowhere else
Password reuse turns a breach on another website into an X account risk. Make the X password long and unique, and do not recycle a slightly modified version of an old password. If you previously typed the password into an untrusted page or app, replace it immediately and use a different password from every earlier one.
X describes password-reset protection as an option that can require the account email address or phone number when someone requests a reset link or code. If that setting is available in your account, enable it after confirming that the email address and phone number are current and controlled by you.
Choose an available second factor
Two-factor authentication adds a check beyond the password. X describes a mobile phone or a security key as possible possession factors. The exact choices and eligibility can differ, so use the options currently displayed in your security settings rather than assuming that every account has the same menu.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Method | How it helps | What to plan for |
|---|---|---|
| Password only | Provides one secret for sign-in. | Most exposed to password theft, reuse, and fake login pages; do not rely on it alone. |
| Two-factor with a phone | Requires a second check in addition to the password. | Phone loss, number changes, carrier access, and country-specific availability can affect recovery. |
| Hardware security key | Uses a separate physical device as a second factor; X lists security keys as a possible option. | Keep a spare or another recovery method. X does not state that every account offers the option, and no particular brand or model is required. |
| Passkey | Uses WebAuthn public-key cryptography. X stores the public key while the private key remains on the device, making the sign-in credential less susceptible to phishing than a password. | Availability is account- and device-dependent. Prepare a second sign-in or recovery route before losing the device that holds the passkey. |
X encourages passkeys but does not make them mandatory. Its guidance describes passkeys as available on iOS and Android and individually generated by the device. That design means a copied password is not enough to reproduce the private key, but you still need a practical recovery plan for device loss.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prepare for a phone replacement
X recommends planning for a phone change. If your account provides backup codes for two-factor recovery, generate them while you are signed in and store them in a secure offline location. A backup code can be used when the enrolled phone is unavailable. Do not store the only copy in the same phone that might be lost or reset.
X states that SMS two-factor support for non-Premium accounts ended effective March 20, 2023. SMS availability for Premium accounts can vary by country and carrier. Because authentication choices change, check the options shown in your current account settings rather than treating SMS as universally available.
Review connected apps before they can post
Understand what permissions mean
Open Settings and privacy and then Apps and sessions to see applications connected to the account. Read the permission description before authorizing anything. X documents that read-and-write access can allow an app to publish or delete posts, interact with other posts, update profile information, change settings, and follow or block accounts. A permission set that includes Direct Messages can allow an app to send, view, manage, or delete messages.
An app with write access can therefore explain unwanted posts even when the password was not stolen. Revoke access for anything unfamiliar, for services you no longer use, and for tools whose requested permissions exceed their purpose.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use OAuth instead of handing over the password
X recommends authorizing third-party access through its OAuth method. A normal OAuth approval screen lets X handle the password while the app receives the permissions you approve. Giving a password directly to an app or website may give that party complete control of the account. If you already entered the password into an untrusted service, revoke that service immediately and change the X password.
Check active sessions and end unknown logins
The sessions view can show a session’s location and login time. Compare those details with your own devices and travel. A location can be approximate, particularly on a mobile network, so investigate a combination of unfamiliar device, time, and activity rather than relying on a map point alone.
- Open Settings and privacy and choose Apps and sessions.
- Inspect the active-session list and identify devices or times you cannot explain.
- Log out an individual session you do not recognize, or choose the option to log out all other sessions if you want a clean restart.
- Change the password if an unknown session appeared, then return to the list and confirm that only your current devices remain.
Ending a session prevents further actions from that session, but X cautions that it may not erase data already cached on the device. If a device was shared, lost, or infected, also secure the device itself and remove any saved credentials.
What to do when unauthorized posts appear
Unexpected posts are a containment problem first. Do not spend time arguing with replies or trying to identify the attacker before stopping access.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Change the X password immediately. Use a strong password that is not used anywhere else. If you cannot sign in, start X’s password-reset process. Changing the password alone does not automatically log the account out of X mobile apps, so continue with the next steps.
- Secure the associated email account. Change its password, enable its available second factor, and inspect recent activity and forwarding rules. Look for unexpected X account-change messages. X says it sends notice to the previously used email address if the X account email is changed.
- Revoke unfamiliar third-party apps. Remove every connection you do not recognize or no longer need, paying particular attention to read-and-write and Direct Message permissions.
- End unknown sessions. Log out individual sessions you cannot explain or all other sessions for a full reset. Keep your current, trusted device signed in only after the password has been changed.
- Delete unwanted posts. Review recent posts, replies, reposts, profile changes, and messages for activity made during the compromise. Remove content you did not authorize and warn contacts through a separate channel if a malicious message was sent from the account.
- Check the devices you use. If suspicious behavior continues after the password and connection changes, scan computers for viruses or malware and install operating-system and application security patches. A device infection can capture a new password or recreate an authorized session.
- Contact X Support if access is still blocked. If a password reset does not let you sign in, submit an X Support Request using the email associated with the account. Include the username and the date you were last able to access it.
Unexpected activity does not always prove a malicious takeover; X notes that a third-party application bug can produce unexpected behavior. The response is the same initially: change the password, revoke connections, and review sessions so the app cannot continue acting while you investigate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep the recovery path usable
Verify the email and phone before an emergency
Sign-in protection is only useful if recovery details belong to you. Check the email address and phone number listed in X, remove obsolete details, and make sure the linked mailbox is accessible without relying on the same device used for your passkey or authenticator. Do not wait until you are locked out to discover that a former address receives reset messages.
Store backup information separately
Keep backup codes and, where appropriate, a spare hardware key in a secure location separate from your everyday phone. Do not post codes in a note, message, or cloud document that is protected only by the X account itself. Replace or regenerate codes if you believe someone else has seen them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Review security after major changes
Repeat the apps-and-sessions review after installing a new social tool, changing phones, or responding to a suspicious login. Remove temporary authorizations instead of leaving them indefinitely. A short monthly check is useful for high-activity accounts, while anyone who manages an organization or public profile should check after every unexpected notification.
Common mistakes that leave accounts exposed
- Trusting a familiar logo. Visual design is easy to copy; the base domain and the navigation path matter more.
- Continuing after a suspicious redirect. Close the tab and open
x.comdirectly. Do not “test” a questionable page with a real password. - Assuming a password change ended every login. X mobile apps and authorized sessions may remain active, so inspect both sessions and apps.
- Ignoring write permissions. An app that can post, delete, change profile data, or manage messages has more control than a read-only analytics tool.
- Keeping only one recovery method. A lost phone, disabled number, or inaccessible mailbox can block a single-factor recovery plan.
- Deleting posts but not the cause. Cleanup does not stop an attacker or app that still has access. Change the password and revoke access first.
- Using SMS as an assumed default. X ended SMS two-factor support for non-Premium accounts on March 20, 2023, and Premium availability varies by country and carrier.
Decide which protections fit your account
There is no single setup that suits every person. Select the strongest combination you can maintain, then make sure recovery is practical.
| Situation | Recommended baseline | Additional consideration |
|---|---|---|
| Personal account with one primary phone | Unique password, an available second factor or passkey, secured email, and saved backup codes. | Prepare a recovery route before replacing or resetting the phone. |
| Public-facing or high-value account | Unique password plus a passkey or hardware security key where offered, secured email with its own second factor, and frequent session reviews. | Keep a spare recovery method and limit third-party apps to those that are essential. |
| Account that uses scheduling or analytics tools | Authorize only through X’s OAuth flow and inspect requested permissions. | Prefer the narrowest permissions available; remove tools that can write posts or manage messages when they are no longer needed. |
| Account currently showing unauthorized activity | Follow the ordered containment procedure: password, email, apps, sessions, posts, device scan, then Support if necessary. | Do not assume the cause is a stolen password; an app bug or infected device can also continue activity. |
X’s materials describe passkeys as less susceptible to phishing than passwords and describe two-factor authentication as an additional check. They do not provide a quantified head-to-head security test, so treat the table as a decision guide rather than a numerical ranking.
Where to verify the current options
Authentication methods, account settings, and recovery procedures can change. Check the current X Help Center guidance for account security, compromised-account response, passkeys, app permissions and sessions, two-factor recovery, and liveness-check safety, then compare it with the options displayed in your own Settings and privacy screens. The controls available to one account, device, country, or subscription level may not appear for another.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
