Instagram Account Security Checklist

Securing your Instagram account takes about 15 minutes and mostly comes down to five things: a unique password, two-factor authentication, an up-to-date email and phone number, a check of where you’re logged in, and removing apps you no longer trust. Work through the checklist below once, then come back to it every few months.

Instagram moves its settings around from time to time, so the menu paths here are a guide. If something isn’t where we describe it, look in Accounts Center, which is where most security options now live.

1. Use a strong, unique password

Your Instagram password should not be used anywhere else. If another site you use gets breached, attackers try the same email and password on Instagram.

• Make it long. A short phrase of several random words is easier to remember and harder to guess than a short jumble.
• Use a password manager so you don’t have to remember it at all.
• Change it now if you’ve ever reused it or shared it with anyone.

In Settings, look for Accounts Center, then Password and security, then Change password.

2. Turn on two-factor authentication

Two-factor authentication (2FA) means a password alone isn’t enough to log in. You also need a code from your phone. It’s the single most effective step on this list.

• Prefer an authentication app over text messages. Text codes can be intercepted if someone takes over your phone number.
• Save your backup codes somewhere safe and offline, like a password manager or a printed sheet. They’re how you get back in if you lose your phone.

You’ll find it under Password and security, then Two-factor authentication.

3. Check your email and phone number

If you lose access, Instagram sends recovery links to the email and phone number on your account. Make sure both are current and that you still control them.

• Secure that email account too, with its own strong password and 2FA. Whoever controls your email can often reset your Instagram password.
• Remove old numbers you no longer use.

4. Review where you’re logged in

Instagram shows a list of devices and locations where your account is active. Look for anything you don’t recognise, like a phone you’ve never owned or a city you’ve never been to.

• Log out of unknown sessions straight away.
• Change your password afterwards, so the session can’t simply log back in.
• Log out of shared or old devices, such as a work computer or a phone you sold.

Look for Where you’re logged in under Password and security.

5. Remove apps and websites you don’t use

Over the years you may have connected games, quiz apps, scheduling tools or “follower checkers” to your account. Each one is a door.

• Review connected apps and websites in your settings and remove anything you don’t actively use.
• Be very wary of any service that asked for your Instagram password. If you ever typed your password into a third-party app, change it now. Our article on why you should never give your Instagram password to an app explains why this matters so much.

If you use a browser extension like Unfollower Tracker, check how it works. It runs inside your own logged-in session on instagram.com, never asks for your password and keeps follower data in your browser. You can read more in are Instagram unfollower apps safe.

6. Learn to spot phishing

Most stolen accounts aren’t hacked through clever tricks. Their owners are tricked into handing over a login code or password.

• Instagram won’t DM you about copyright strikes, verification badges or account deletion threats. Messages like these are almost always scams.
• Check official emails in the app. In Settings, look for a section showing recent emails from Instagram. If a message isn’t listed there, it didn’t come from Instagram.
• Never share a login or 2FA code, even with a friend who says they “sent it by mistake”. Their account may already be compromised.
• Don’t log in through links in messages. Open the app or type the address yourself.

The short version

Use a unique password, turn on 2FA with an authenticator app, keep your email and phone current, log out of sessions you don’t recognise, remove old connected apps, and never give your password or login codes to anyone. Repeat the check every few months.

If you notice posts you didn’t make, a changed email, or you’re suddenly logged out, act quickly. Use the “Need more help?” or “Forgot password?” options on the login screen, and check for an email from Instagram that lets you undo a recent email change. If your account was disabled rather than hacked, see what to do when your Instagram account is suspended or disabled.