Account Security

Losing a social account can mean losing customer trust, ad spend, and years of proof content. Security is boring until it is an emergency.

Non-negotiables

Unique password per platform (password manager)
Two-factor authentication (2FA) — app-based preferred over SMS
Recovery email you still control
Recovery phone updated
Business accounts: legal owner is a person, not only a shared inbox

Team access

Role	Access level
Owner	Full; 2FA required
Content poster	Post only; no billing
Analyst	Read analytics
Agency	Time-limited; review quarterly

Remove departed employees day one.

Third-party apps

Audit connected apps when you:

Install a scheduler
Run a giveaway app
Connect cross-posting tools

Revoke anything unused.

Phishing patterns

"Verify your account" DMs with random links
Fake copyright strikes
"Brand collaboration" asking for login

Rule: never enter credentials from a link in DM or email. Go to the app directly.

Backup plan

Export content periodically where platforms allow
Document handle, associated email, 2FA device location
Store recovery codes offline (password manager secure note)

Incident response

Change password immediately
Revoke sessions / log out all devices
Check email rules for forwarding hacks
Contact platform support with business verification docs
Post on other channels if account is compromised

Security checklist (printable)

2FA on all active platforms
Password manager in use
Shared logins eliminated
App permissions reviewed this quarter
Backup admin assigned for business pages

See Privacy and Visibility next.