X Account Security Check and Link Explainer

X account security check

Pick the answer that is true today, not the one you plan to make true. You can open X in another tab and look while you go. Your answers stay in this tab and are gone when you close it.

01 How is your X password set?

Reused passwords are the first thing attackers try, using lists leaked from other sites.

Unique to X and stored in a password manager Unique, but I remember it or wrote it down I use it (or something close) on other sites

02 What protects your login beyond the password?

Settings and privacy > Security and account access > Security. Two-factor authentication and Passkey both live there.

A security key, or a passkey with two-factor also turned on Authenticator app (codes that change every 30 seconds) Text message (SMS) codes None, or I'm not sure

03 Do you have your X backup code saved somewhere safe?

The backup code gets you in if you lose the phone or key that holds your second factor.

Yes, stored offline or in my password manager No, or I can't find it

04 Is the email address on your X account locked down too?

Whoever controls that inbox can reset your X password.

Yes: unique password and 2FA on the email account It has a strong password but no 2FA No, or it's an old address I rarely check

05 When did you last review your connected apps?

Security and account access > Apps and sessions > Connected apps.

In the last three months, and I removed what I don't use Sometime in the past year Never, or I don't know what that is

06 Have you checked which devices are logged in to your account?

Security and account access > Apps and sessions > Sessions.

Yes, recently, and every session is mine No

07 Is password reset protection turned on?

With it on, anyone requesting a reset must confirm your email or phone number first.

Yes No, or I didn't know it existed

08 Can people find your account by your email address or phone number?

Settings and privacy > Privacy and safety > Discoverability and contacts.

No, both options are off Yes, or I'm not sure

09 Is your phone number protected against SIM swaps?

Most carriers offer a port-out PIN or a number lock in the account settings.

Yes, I set a carrier PIN or number lock There's no phone number on my X account and 2FA doesn't use SMS No, or I don't know

10 Someone DMs you a link about a copyright strike or your verification. What do you do?

These messages are the most common way X accounts get phished.

Ignore the link and check notices in the X app or at x.com myself Open it to look, but I wouldn't log in Follow it and do what it asks

11 How about the computers and browsers you use X on?

Session-stealing malware usually arrives as a cracked app, a fake game or a sketchy browser extension.

Updated, with only a few browser extensions I trust Not sure, or I install a lot of free tools and extensions

Guides, one attack at a time

01The most common attacks on X accounts, and how to block each oneSix attacks account for most X takeovers we hear about. Each one has a tell you can learn to spot and a setting that blunts it. 02How to set up two-factor authentication and passkeys on XX offers an authenticator app, security keys, passkeys and, for Premium subscribers only, text-message codes. Here is which to pick and how to turn each on. 03What to do in the first hour after your X account is hackedSpeed matters more than anything else. Work through these steps in order, starting with the email inbox, because that is how you get the account back. 04How to spot impersonation and fake X support accountsImpersonators copy a name and photo in seconds. The handle, the badge type, the account history and what they ask you to do are much harder to fake. 05Securing a brand or business X account shared by a teamMost brand account takeovers start with a shared password that too many people know. X Delegate lets your team post without ever holding the login. 06How to check and revoke connected apps and sessions on XYour password isn't the only way into your account. Connected apps and logged-in sessions keep access until you remove them, and both lists take two minutes to review. 07Protecting high-profile X accounts from doxxingDoxxing is rarely one brilliant discovery. It is usually small public details stitched together. Removing those details before you need to is the most effective defense.

Questions

Does the security check send my answers anywhere?

No. The checklist and the link explainer run as plain JavaScript inside this page. Your answers and any link you paste never leave your browser, and nothing is saved after you close the tab.

Which two-factor method should I use on X?

A passkey or a hardware security key is the strongest choice, followed by an authenticator app. X has offered text-message codes only to X Premium subscribers since March 2023, and SMS is the weakest option anyway because a SIM swap can redirect your codes.

Will X ever DM me about a copyright strike or my verification?

Treat any DM or email that threatens suspension and asks you to log in through a link as phishing. Check notices inside the X app or at x.com itself, never through a link someone sent you.

Is TweetAttacks part of X?

No. TweetAttacks is an independent site and is not affiliated with X Corp. We will never ask for your password, codes or backup codes.

How hard is your X account to take over?