How to secure your X account after using a follower site

If you signed in to a free follower site, or approved its app, the fix is mostly a matter of cutting off its access and closing every door it might have opened. It takes about fifteen minutes. Do the steps in this order, because each one assumes the one before it is done.

Menu names below match X's help center at the time of writing. X renames settings now and then, so if a label looks different, the same options are usually still under Settings and privacy.

Step 1: Revoke connected apps

Start here, because an authorized app keeps working no matter what you do with your password.

On the web, go to More, then Settings and privacy, then Security and account access, then Apps and sessions, then Connected apps. The mobile apps use the same path from the Settings and privacy menu. You'll see every app with access to your account. Open each one you don't recognize and choose Revoke access.

When you look at the list, check the permissions line under each app. X's help center describes three main levels:

• Read lets the app see your profile, posts, follows and lists.
• Read and write adds posting, deleting, following, liking and changing your profile.
• Direct Messages lets it read, send and delete your DMs.

Anything with write or DM access that you can't place should go. Old apps you no longer use can go too. If you revoke something you still need, you can reconnect it later.

Step 2: Change your password

If you typed your X password into the follower site, assume it's been saved and shared.

Go to Settings and privacy, then Your account, then Change your password. Pick something long and unique that you don't use anywhere else. A password manager makes this painless. If you reused the old password on other sites, change it there as well, starting with your email.

If the site asked for your email password, deal with the email first. Change that password, turn on two-factor authentication for the email account, and look through its settings for forwarding rules or recovery addresses you didn't add. Someone with access to your inbox can reset almost anything else.

Step 3: Log out of other sessions

Back in Apps and sessions, open Sessions. This lists the devices and browsers signed in to your account. Choose Log out all other sessions, or remove the ones you don't recognize one at a time. X notes that logging out stops further actions from a session but may not delete data, such as DMs, already stored on that device.

Do this after changing your password, so a stolen session can't simply sign back in with the old one.

Step 4: Turn on two-factor authentication

Two-factor authentication (2FA) means a password alone isn't enough to sign in. On X, go to Settings and privacy, then Security and account access, then Security, then Two-factor authentication.

X currently offers three methods: text message, an authentication app, and a security key. An authentication app (any app that generates six-digit time-based codes) or a hardware security key is the better choice. Text message codes can be intercepted through SIM swaps, and X has at times restricted text-message 2FA to certain account types, so an app is the more dependable option anyway.

Save the backup code X gives you somewhere offline. And remember why this step matters for follower sites in particular: some of them ask you to paste in a login code. Nobody legitimate ever needs that code, and from now on it's the only thing standing between a stolen password and your account.

Step 5: Check your email and phone number

Go to Settings and privacy, then Your account, then Account information. Confirm the email address and phone number are yours. If either was changed, fix it right away and look for a notification email from X about the change; it may contain a link to undo it.

While you're there, check that your username hasn't changed and that your country and other details look right.

Step 6: Clean up what the site did in your name

Now look at what your account did while the site had access.

1. Scroll your profile's posts and replies tabs for promos you didn't write, especially anything mentioning followers, giveaways, crypto or links you don't know. Delete them.
2. Check your sent Direct Messages for spam. If something went out to your followers, a short post saying your account was misused and they should ignore those messages is worth the minor embarrassment.
3. Look at your following list. Many pools follow hundreds of accounts on your behalf. Unfollow the ones you don't want. It's tedious; do a batch a day rather than mass-unfollowing in one sitting, which can itself look like automated behavior.
4. Less urgent, but check for lists you didn't create and likes on spam.
5. Make sure the bio, link and name haven't been edited.

Step 7: Watch for a few weeks

For the next month, keep an eye on emails from X about new logins or settings changes. Check Apps and sessions again after a week. If you see posts you didn't make after all of this, repeat steps 1 to 4 and check your computer for malicious browser extensions, which can act inside a logged-in session.

If X has locked or limited your account, follow the prompts on screen. Usually that means passing a challenge or confirming a phone number. If the account is suspended and you believe it was because of a service acting on your behalf, X's help center has an appeal form. Explain briefly and honestly what happened and what you've done to secure the account.

What not to do

Don't pay a "recovery expert" who contacts you after you post about the problem. Those offers are a well-known second scam. Don't sign up for a different follower service to replace the followers you lose. And don't try to undo the follows with another automation tool that wants write access; that just repeats the problem.

If you want a quick list to work through, the checker on our home page builds one: tick what the follower site asked for, tick "I already went ahead", and it lists the steps that apply to you.

Once the account is clean, the 30-day organic growth plan is a good place to start rebuilding.

Sources: X Help Center articles on third-party apps and log-in sessions and two-factor authentication.

Questions