Platform security
Protect Your X (Twitter) Account: The Security Settings Checklist
X hides its riskiest access outside your password: connected third-party apps, developer API tokens, and delegate members who can post as you. Walk through your own X settings and close every quiet door.
Start the X hardening checklist
An error occurred. Please try again.
Official tools only
Every step uses X's own Security and account access settings.
No password, ever
We never ask for your X password or login codes.
Owner-only
Guidance is for your own account or a consenting family member's.
We cannot guarantee recovery or identify an attacker - we help you close the doors you control.
Who can still control your X account after a password change
| Provider | Shown in X settings | You revoke it yourself | Password reset removes it | Takes effect immediately |
|---|---|---|---|---|
| Connected third-party apps (OAuth) | YesSettings and privacy - Security and account access - Apps and sessions | YesOpen the app, then choose Revoke app permissions | NoOAuth tokens survive a new password - you must remove the app by hand | YesAccess ends the moment you revoke it |
| Delegate and X Pro team access | YesMembers appear under your Delegate settings | YesThe account owner removes each member | NoDelegation stays until you remove the person | YesRemoved members lose posting rights at once |
| Developer and API app tokens | If eligibleOAuth apps show here; raw API keys live in the developer portal | YesRevoke the app or regenerate keys you own | NoAPI keys keep working until you rotate them | YesRevoked keys stop authenticating right away |
| Logged-in sessions and devices | YesApps and sessions lists every active login | YesLog out of any device you do not recognize | If eligibleX offers to log out other sessions when you reset your password | YesThe device is signed out on the spot |
Your X keep-it-safe checklist
Phishing-resistant 2FA
Add a security key or authenticator app, not text codes.
Connected apps
Revoke third-party apps that can still post as you.
Delegate & X Pro teams
Drop team members who no longer need your account.
API & app tokens
Rotate developer keys you forgot you ever created.
Every step lives in your own X settings - no passwords or codes are ever shared with anyone, including us.
Account left on defaults
- SMS-only 2FA that a SIM swap can defeat
- A pile of old connected apps you never audit
- Ex-collaborators still on your X Pro team
- Unknown sessions you have never reviewed
Account hardened by you
- A security key or authenticator app guards login
- Only apps you actually trust keep any access
- Your delegate list matches who you truly work with
- One active session per device you own
Done entirely in your own X settings - no tool stops every attack, but this closes the doors you control.
Dead ends and the way forward
X / Twitter - owner actions only
✗ Trying to 'find' or reset someone else's X passwordAccessing an account you do not own is illegal and against X's rules.
→ Secure the account you do own; if it belongs to a family member, sit with them while they run X's own recovery.
✗ Paying a service to 'hack' or unlock an X accountThese are scams that take your money and often your login too - no one can bypass X's 2FA for you.
→ Use X's official login help and 2FA settings; if you are locked out, start X's account-recovery form.
✗ Assuming a new password kicks out a connected appOAuth tokens, API keys, and delegate access survive a password change, so control can quietly continue.
→ Open Apps and sessions in X settings and revoke each app, token, and delegate one by one.
✗ Handing your login code to anyone who asks to 'verify' youA genuine recovery never needs your code passed to a third party - that request is the attack itself.
→ Type codes only into X's own screens, and treat any code request in chat or email as phishing.
FAQ
Where are the security settings on X (Twitter)?
On X, open Settings and privacy, then Security and account access, where you will find Security for 2FA, Apps and sessions for connected apps and logins, and Delegate for team access - the three areas that control who can reach your account.
Which two-factor method should I use on X?
A security key or an authenticator app is far safer than text-message codes, and because X limits SMS-based 2FA to paid Premium accounts, most people should set up an authenticator app or a hardware key instead.
Why do connected apps and API tokens matter more than my password?
A third-party app or developer token you once approved keeps its access even after you change your password, so reviewing and revoking them in Apps and sessions is the only reliable way to cut that access off.
I think someone might still be in my account - what should I do first?
Change your password, turn on strong 2FA, then revoke every unfamiliar app, token, delegate, and session, and if you are already locked out use X's official recovery process rather than any third-party service.
Can HackSN get into an X account for me?
No - we never access anyone's account or handle passwords or codes, and we only show you how to secure or recover an account you own using X's own official tools.