If your Twitter account was hacked, change your password straight away (or use Forgot password if you're locked out), secure the email address on the account, and revoke any third-party apps you don't recognise. If you still can't get in, X says to submit a support request from the email address linked to the account, with your username and the date you last had access.
Those are the first steps on X's own compromised-account page, and the order matters. Below is the full sequence, the warning signs X lists, what happens if the hacker changed your email, and the two settings that make a repeat much harder.
Signs X says your account is compromised
X lists these as the signals to act on:
- Posts you didn't write appearing on your account.
- Direct Messages sent from your account that you didn't send.
- Follows, unfollows or blocks you didn't make.
- A notification from X saying your account may be compromised.
- A notification that your account information changed when you didn't change it.
- Your password suddenly not working, with a prompt to reset it.
One thing worth knowing before you panic: X says unexpected updates don't always mean a hacker. A buggy third-party app can cause odd behaviour too, and changing your password or revoking that app's access stops it either way.
The 5 steps to take, in X's order
- Change your password. Do it from the Password tab in settings. If you're logged out, use Forgot password on the login page. X asks for a strong password you haven't used before.
- Secure the email address on the account. Make sure you're the only person who can get into that inbox, and update it from the app or Account settings on x.com if needed.
- Revoke third-party apps you don't recognise. While logged in, go to Apps in your settings and remove access for anything unfamiliar.
- Update your password in apps you trust. If a trusted external app uses your X password, change it there too, or X may temporarily lock you out for failed logins.
- Contact X Support if you still need help. Submit a support request from the email address linked to the compromised account, and include your username and the date you last had access.
If you can't log in at all
Use the reset flow. On the sign-in page of x.com, mobile.x.com or the app, tap Forgot password? and enter your email, phone number or username. X sends a code that stays valid for 60 minutes, either by email or by text if a phone number is on the account.
| What you still have | What X lets you do |
|---|---|
| Access to the account's email | Reset by emailed code |
| Access to the verified phone number | Reset by text message code |
| Neither | X says recovery options are limited and you may need a new account |
Two traps from X's reset page: if several accounts share your phone number, you can't use the phone number to start the reset, and you'll need to try the username or email route instead. And X points out you might still be logged in somewhere else, such as the app, mobile.x.com or X Pro, which can be a way back in to change your settings.
If the hacker changed your email address
X sends an email to the previous address any time the email on an account changes, so check your old inbox for that notice. If you've lost access to the email itself, X's advice is to contact your email provider first to regain it, then request a new X password.
Be ready for the hard line on this: X says that without access to the account's email or verified phone number, it can't continue troubleshooting, can't deactivate the account for you and can't free up the username. That's why keeping both up to date matters so much.
Clean up after you're back in
- Delete any posts that went out while the account was compromised.
- Scan your computer for viruses and malware, especially if strange posts keep appearing after a password change.
- Install security updates for your operating system and apps.
- Switch on two-factor authentication.
- Never share your login details, especially with services promising followers, payouts or verification.
If the attack started with a weak password, my guide to creating a strong password covers what to change.
The two settings that stop it happening again
Two-factor authentication. X offers three methods: text message, an authentication app or a security key. The catch that's easy to miss: since 20 March 2023, text message 2FA is only supported for X Premium subscribers, and X says even that can vary by country and carrier. On a free account, an authenticator app or a security key is the route. If you're new to it, what two-factor authentication is explains the idea, and keep the backup code X shows you when you set it up.
Password reset protection. In Settings and privacy, then Account, then Security, switch on Password reset protection. X will then ask for your email address or phone number before it sends a reset link, which makes it harder for someone else to trigger one.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
How accounts get hacked in the first place
X names four common causes: giving your username and password to a malicious third-party app or site, a weak password, malware on your computer collecting passwords, or a compromised network. Phishing gets its own section on X's security page. X says it will never ask for your password by email, Direct Message or reply, and real X login pages always sit on x.com. If a login page appears after clicking a link, go straight to x.com instead.
My verdict
Move fast and work in X's order: password, email, apps, then support. The thing that decides whether you get the account back is whether you still control its email or phone number, so if you're reading this before anything has gone wrong, check both today and add an authenticator app. It takes a few minutes and saves you a very bad week.
Text based login codes get their own write up in my guide to X text messages and codes.
Frequently asked questions
What's the first thing to do if my Twitter account is hacked?
Change your password from the Password tab in settings, or use Forgot password if you're logged out. Then secure the email address on the account and revoke third-party apps you don't recognise.
How do I contact X if my account was hacked?
Submit a support request using the email address linked to the compromised account. X asks you to include your username and the date you last had access.
Can I recover a hacked X account without the email or phone number?
X says that without access to the account's email or verified phone number it can't continue troubleshooting, so recovery options are limited and you may need to sign up for a new account.
How long is an X password reset code valid?
X says the reset code it sends by email or text message is valid for 60 minutes.
Can I use text message 2FA on a free X account?
No. X stopped supporting text message two-factor authentication for non-Premium accounts on 20 March 2023. Free accounts can use an authentication app or a security key.
