Protecting high-profile X accounts from doxxing

Doxxing means publishing someone's private information, such as a home address, phone number, family members or workplace, to expose or intimidate them. People with large or controversial audiences get targeted most: journalists, researchers, moderators, creators, activists, and anyone who has just gone viral.

This guide is about defense only. It shows you how to find and shrink the trail of details about you, how to set X up so it gives away as little as possible, and what to do if your information gets posted anyway.

How doxxing usually happens

Exposure rarely comes from one big leak. It comes from combining small pieces that are each harmless alone: a photo of the view from your window, an old post about your commute, a username you also used on a forum ten years ago, a relative tagging you, a phone number that X lets people match to your account, and a data broker page that ties it all to an address.

Breaking that chain at several points is what protects you. You don't need to vanish. You need to make the pieces hard to connect.

Lock down what X reveals

Start in Settings and privacy > Privacy and safety:

• Discoverability and contacts. Turn off "Let others find you by your email" and "Let others find you by your phone number." Otherwise anyone holding your number can check whether it belongs to your account. Also consider removing contacts you uploaded.
• Phone number. If you don't need a phone number on your account, remove it under Your account > Account information, and use an authenticator app or security key for two-factor instead of SMS.
• Direct messages. Limit message requests so strangers can't send DMs straight to your inbox. On a high-profile account, a flood of DMs is also a phishing channel.
• Location. Don't add location to posts, and check that the location field on your profile shows only what you want public, such as a country or a city you're comfortable naming.
• Photo tagging. Restrict who can tag you in photos, or turn tagging off.

Then check the email address on your account. If it's an address you've used for years everywhere, it probably appears in old data breaches and people-search sites. A separate email used only for X makes your account harder to connect to the rest of your life, and harder to phish.

Review your own posts and photos

Search your own posts the way a stranger would. X's advanced search lets you filter by your handle and keywords. Look for:

• Street names, neighborhood names, your gym, your kids' school, regular coffee spots.
• Photos taken at or near home, especially ones with house numbers, car plates, distinctive windows or a recognizable view.
• Posts that reveal your schedule ("leaving for the airport", "home alone this week").
• Old replies that mention your employer, hometown or relatives by name.

Delete what you'd rather not have public. Accept that some old posts may already be archived elsewhere, which is why the steps below matter too. Going forward, post photos after you've left a place rather than while you're there.

Shrink your footprint outside X

Most addresses that end up in doxxing posts come from public records and people-search sites, not from X.

• People-search and data broker sites. Search your name with your city. Most of these sites have an opt-out process; some services will file the opt-outs for you for a fee. Repeat every few months, because listings come back.
• Reused usernames. If your X handle matches an old forum, gaming or dating profile, those accounts can lead back to your real name. Rename or delete old accounts you don't use.
• Domain registrations. If you own a personal website, make sure the domain uses registration privacy so your name and address aren't in public lookup records.
• Family accounts. Ask relatives not to tag your location or post pictures of your home, and to check their own discoverability settings.
• Account security everywhere. A hacked email or cloud photo account can leak far more than X. Use a password manager and two-factor on all of them, starting with email.

Harden the account itself

Doxxing and account takeover often come together: an attacker who gets into your account can read your DMs and email address and post whatever they find. High-profile accounts should go beyond the basics:

• A security key or passkey plus two-factor, and password reset protect switched on.
• A monthly review of connected apps and sessions.
• A carrier PIN or number lock on your phone line, to block SIM swaps.
• Skepticism toward unexpected "brand deal" files, interview requests with attachments, and links in DMs. Targeted accounts get targeted phishing.

If your information is posted

1. Don't engage with the poster. Replies spread the post further.
2. Save evidence: screenshots with the URL, handle, date and time. Do this before reporting, since the post may disappear.
3. Report it to X. Use the report option on the post, choose the option for private information, and explain what was shared. X's private information policy covers home addresses, private phone numbers and similar details shared without permission.
4. Report copies. Ask trusted friends to report reposts rather than quote them.
5. Tell the people affected. Household members, and your employer's security or HR team if you have one.
6. Contact the police if there are threats, someone shows up at your home, or you feel unsafe. Many police departments can also put a note on your address.
7. Tighten settings temporarily. Protecting your posts and limiting replies for a few days can slow a pile-on while reports are reviewed.

If the attack includes accounts pretending to be you, our impersonation guide covers how to report them.

Do the work before you need it

The time to remove your address from people-search sites is before a post of yours goes viral, not after. If your audience is growing, block out an afternoon: change the X settings above, search your own history, opt out of the biggest data broker sites, and set a reminder to repeat it. Then run the security check to confirm the account side is covered.

Questions

TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.