Facebook has had multiple major data breaches over the years, but most account compromises happen not through hacking but through weak passwords, phishing, and overly permissive app access. Here’s a practical guide to locking down your account in 2026.
Short Answer: The three most impactful steps: enable two-factor authentication (2FA) immediately, review and remove third-party apps that have access to your account, and switch your profile to ‘Friends only’ visibility. These three changes block the most common attack vectors.
Step 1: Enable Two-Factor Authentication
This is the single most effective security step. With 2FA, even if someone has your password, they can’t get in without your phone.
- Go to Settings & privacy → Settings → Security and Login
- Tap Use two-factor authentication
- Choose Authentication App (most secure) or SMS (acceptable)
- Use Google Authenticator, Authy, or Microsoft Authenticator for the app option
📸 SCREENSHOT NEEDED: Facebook Security and Login settings page with Two-Factor Authentication section highlighted
Step 2: Review Active Sessions
Check every device and location currently logged into your Facebook account:
- Settings → Security and Login → Where You’re Logged In
- Review every session — location, device type, last active time
- Tap the three dots next to any unfamiliar session → Log Out
- Tap “Log Out of All Sessions” if you see anything suspicious
📸 SCREENSHOT NEEDED: Facebook ‘Where You’re Logged In’ screen showing list of active sessions with device names and locations
Step 3: Audit Third-Party App Access
Every app you’ve ever used “Login with Facebook” for has access to your data. Many of these are old and unnecessary:
- Settings → Security and Login → Apps and Websites
- Review all apps with Active access
- Remove any you don’t recognize or no longer use
- Click an app → Remove → check “Also delete posts…” before confirming
Warning: Some apps you last used years ago may still have Active status and ongoing access to your profile, friends list, email, and more. This is one of the most overlooked security risks on Facebook.
Step 4: Tighten Privacy Settings
- Settings → Privacy → Your Activity
- Set “Who can see your future posts” to Friends
- Set “Who can see your friends list” to Only Me
- Set “Who can look you up using email/phone” to Friends
- Turn off “Allow search engines to link to your profile”
Step 5: Use a Strong, Unique Password
If you’re reusing your Facebook password anywhere else, change it now. Use a password manager (Bitwarden is free and excellent) to generate and store a strong unique password.
Quick checklist:
- ✅ Enable two-factor authentication using an authenticator app
- ✅ Log out all unfamiliar active sessions immediately
- ✅ Remove old third-party apps under Apps and Websites
- ✅ Set future posts to ‘Friends only’
- ✅ Turn off search engine linking to your profile
- ✅ Use a unique password stored in a password manager
FAQ
How do I know if my Facebook account has been hacked?
Signs include: login notifications from unknown locations, posts or messages you didn’t send, friends receiving strange messages from you, or being logged out unexpectedly. Check Settings → Security and Login → Recent Emails from Facebook to see official communications.
What should I do if my Facebook account is hacked?
Go to facebook.com/hacked immediately. Facebook has a dedicated recovery flow. Change your password from a different device, enable 2FA, and log out all other sessions.
Is it safe to use “Login with Facebook” for other apps?
It’s convenient but increases your attack surface — if your Facebook is compromised, so are all connected apps. Use it only for low-stakes services. Never use it for banking, email, or anything sensitive.
Facebook Privacy Settings Guide ↗Best Password Managers
Spending 10 minutes on these five steps dramatically reduces your risk. Two-factor authentication alone stops the vast majority of account takeover attempts — enable it today if you haven’t already.