Deepak Gupta

Lock down your Instagram account

9 settings, about 18 minutes. Do them in order: each one closes a door attackers use. Your ticks stay in this browser only.

0 of 9 doneAbout 18 minutes total

Change your password to one you use nowhere else2 minOn the web, click More > Settings > Accounts Center > Password and security > Change password, pick the account, and enter your current and new password. Instagram says to use at least 6 numbers, letters and punctuation marks. Changing it logs out every other device.source
Turn on two-factor authentication with an authentication app4 minClick More > Settings > See more in Accounts Center > Password and security > Two-factor authentication, then pick your account. Choose Authentication app, which Instagram recommends over text message. You can only turn on the app method from the Instagram app for iPhone or Android.source
Save your backup codes somewhere safe2 minIn Password and security > Two-factor authentication, pick your account, then click Additional methods > Backup codes. Save them offline. A backup code gets you in when a login code cannot reach you.source
Log out devices you do not recognize2 minIn Password and security, click Where you're logged in, pick your account, then click Select devices to log out. Select anything you do not recognize and click Log out.source
Check your email and phone number are yours1 minConfirm the email address and phone number in your account settings are correct and that only you can reach them. These are where Instagram sends login links and codes.source
Remove linked accounts you do not recognize1 minOpen Accounts Center and check which Facebook, Instagram and Meta accounts are added. Remove any account you do not recognize.source
Remove third-party apps you do not trust2 minClick More > Settings, then below Your app and media click Website permissions > Apps and Websites > Active. Click Remove next to anything you do not use or trust, especially apps that promised likes or followers.source
Secure the email account tied to Instagram3 minInstagram says anyone who can read your email can probably get into your Instagram too. Give that email account its own strong, unique password and turn on its two-step sign-in.source
Learn where to check real Instagram emails1 minClick More > Settings > Meta Account > Login and security > Recent emails. Security emails from the last 14 days are listed there. If a "security" email is not in the list, it did not come from Instagram.source

Then

Write down where your recovery details live in the recovery kit, so a future lockout takes minutes, not weeks.

Free toolExposure CheckSee what of yours is already public.Free toolPassword Breach CheckCheck if a password shows up in known leaks.ReadHow to set up two-factor on all your accounts ReadPasskeys vs passwords

Comparing password managers or security keys? See the independent tool comparisons.

Sources and last check

Last verified: October 16, 2026. Steps checked against the platform's own help pages listed below. Device testing is ongoing; steps marked unconfirmed are still waiting for it.

Instagram: My Instagram was Hacked (read 2026-10-16)
Instagram Help: Hacked Instagram account (read 2026-10-16)
Instagram Help: If you think your Instagram profile has been hacked (read 2026-10-16)
Instagram Help: Change your Instagram password (read 2026-10-16)
Instagram Help: Two-factor authentication (read 2026-10-16)
Instagram Help: Backup codes (read 2026-10-16)
Instagram Help: View your recent Instagram login activity (read 2026-10-16)
Instagram Help: Accounts Center (read 2026-10-16)
Instagram Help: Remove apps and websites from Instagram (read 2026-10-16)
Instagram Help: Security tips (read 2026-10-16)
Instagram Help: Review recent emails sent from Instagram (read 2026-10-16)
Instagram Help: Avoid getting scammed on Instagram (read 2026-10-16)
Instagram Help Center: Report an Impersonation Account on Instagram or Threads (read 2026-10-16)
Instagram Help: What can I do if my account has been disabled? (read 2026-10-16)
Meta: Account Recovery Hub (read 2026-10-16)

Wrong step or changed screen? Report it. Never include passwords or codes.