Platform security
Secure Your Instagram: The Full Settings & Privacy Checklist
A step-by-step checklist to lock down 2FA, active sessions, connected apps, and privacy controls, for an account that's fine today and should stay that way.
Start the hardening checklist
An error occurred. Please try again.
Official tools only
Every step uses Instagram's own settings and Meta Accounts Center.
No password, ever
We never ask for or handle your password, codes, or account access.
Your account only
This is owner-only hardening for an Instagram account you control.
Links point to help.instagram.com and accountscenter.meta.com, check the address bar before you type anything.
Where each hardening step actually lives
Every control below sits inside Instagram or Meta Accounts Center, no third-party tool ever touches your account.
| Provider | Turn on 2FA | Review logins & sessions | Manage connected apps | Private account & tagging |
|---|---|---|---|---|
| Instagram app (iOS & Android) | YesSettings > Accounts Center | YesWhere you're logged in | YesApps and websites | YesWho can see your content |
| Instagram on the web (desktop) | YesSame Accounts Center panel | YesFull session list | YesActive apps listed | YesPrivacy toggles present |
| Meta Accounts Center | YesPassword and security | YesWhere you're logged in | If eligibleSome connections only | NoAudience settings stay in Instagram |
| Security Checkup (guided flow) | YesWalks you through setup | YesShows recent logins | If eligibleSurfaces some, not all | NoNot part of the flow |
Two-factor authentication & login alerts
The single biggest lift, a stolen password alone stops being enough to get in.
- Open Meta Accounts Center > Password and security > Two-factor authentication.
- Choose an authentication app over SMS so a SIM swap can't intercept your codes.
- Turn on login alerts so a new sign-in pings you the moment it happens.
Active sessions & known devices
See every phone, browser, and place your account is currently signed in.
- Go to Password and security > Where you're logged in.
- Tap any session you don't recognize and log it out.
- Sign out of old phones, shared computers, and any location that isn't you.
Connected apps & third-party access
Every app you ever 'logged in with Instagram' can still reach your account.
- Open Settings > Apps and websites and read the Active tab.
- Remove schedulers, quiz apps, and tools you no longer use.
- Keep only the handful you genuinely rely on today.
Private account, tags & story controls
Decide who sees your content and who can attach your name to theirs.
- Switch to a private account under Who can see your content.
- Set Tags and Mentions to 'People you follow' or 'No one'.
- Use Close Friends and Hide Story to control who sees each story.
What this checklist quietly shuts down
Password reuse
A leak on another site can't unlock Instagram once 2FA is on.
Ghost sessions
Old phones and borrowed logins get kicked out in one tap.
Forgotten apps
Tools you stopped using lose their standing access to your account.
Oversharing
You choose who sees stories, tags, and mentions instead of the default.
None of these steps asks for your password or a login code, you change them inside Instagram yourself.
How it works
- 1Run Security CheckupOpen Instagram's guided Security Checkup to see 2FA, logins, and phone/email at a glance.
- 2Turn on app-based 2FAAdd an authentication app in Password and security and save your backup codes offline.
- 3Switch on login alertsEnable alerts so every new sign-in triggers a notification and email.
- 4Clear unknown sessionsReview 'Where you're logged in' and log out of anything you don't recognize.
- 5Audit connected appsRemove third-party apps and websites that no longer need Instagram access.
- 6Set your privacy controlsChoose private or public, then tighten tags, mentions, comments, and story audiences.
There's no timer here, do it in one sitting or spread it across the week. Every step you finish is one an attacker can't use against you.
FAQ
Do I have to give HackSN my Instagram password to follow this checklist?
No, you never share your password, login code, or account access with us or anyone else, because every change is one you make yourself inside Instagram's own settings.
Which two-factor method should I turn on for Instagram?
An authentication app is the most resilient choice because it keeps working even if your phone number is hijacked, and you should save your backup codes somewhere safe in case you ever lose the device.
Will switching to a private account lock out my current followers?
No, making your account private keeps all of your existing followers and only requires you to approve new follow requests, so your current audience stays intact.
How is this different from the hacked-Instagram recovery page?
This checklist is for an account that is still working normally and that you want to keep safe, while getting back an account you've already lost access to is covered on our separate guide for recovering a hacked Instagram account.
How often should I redo this security pass?
Reviewing your login activity, connected apps, and privacy settings every few months is enough for most people, and it is worth doing right away any time you receive an unexpected login alert.