How to Secure Facebook Account: 10-Step 2026 Checklist

Every Facebook account is worth something to somebody. Yours holds a decade of photos, your private messages, your friend list, the Pages you run, and — for a huge number of people in Bangladesh — the shop that pays the bills. That is why account takeover has become one of the most reported cybercrimes in the country: in a single six-month window, the CID Cyber Police Centre logged 282 Facebook account hacking complaints and 165 SIM cloning cases among 3,766 total victims who reached out.

Here is the frustrating part. Facebook's own security advice is genuinely good, but it is scattered across seven different Help Centre pages, none of which tells you what order to do things in, how long each step takes, or which settings actually stop an attacker versus which ones just feel safer. This guide fixes that. If you have been searching for how to secure your Facebook account without reading seven separate help pages, this is the whole answer in one place: a single, ordered 10-step checklist with the exact menu paths for the 2026 Accounts Centre layout, an honest breakdown of which two-factor method is worth using, and a five-minute test at the end so you can prove your account is actually locked down instead of hoping it is.

Total time: about 25 minutes. You will not need to do it again for three months.

How Facebook accounts actually get hacked

Before you start flipping switches, it helps to know what you are defending against. Almost every real-world Facebook takeover falls into one of five patterns — and each checklist step below maps to at least one of them.

Before you start: which settings screen are you on?

This trips up almost everyone. Meta has been migrating accounts to Meta Accounts, which means security settings moved out of Facebook's own settings page and into a shared hub called Accounts Centre. Depending on your account, you may see either layout — and older tutorials (including some still ranking on Google) point at menus that no longer exist.

Here is how to tell in five seconds:

• You see "Accounts Centre" near the top of Settings → you are on the current layout. Everything security-related lives under Accounts Centre → Password and security. This guide's paths will match exactly.
• You see "Security and login" in the left column instead → you are on the legacy layout. The same options exist, just one level shallower. Skip the "Accounts Centre" step in each path below.

One more thing worth knowing: Accounts Centre can control several profiles at once — your Facebook profile, an Instagram account, a second Facebook profile. When you open a security setting, Facebook will ask which account you want to change. Read that screen carefully. Turning on two-factor authentication for Instagram does nothing for your Facebook login.

How to secure your Facebook account: the 10-step checklist

Work through these in order. The sequence is deliberate — steps 1 and 2 assume the worst (that someone may already have access) and shut that down before you start changing credentials.

Step 1 — Run Security Checkup (2 minutes)

Why first: Security Checkup is Facebook's own triage tool. It scans your account and surfaces anything obviously wrong — an old password, 2FA switched off, unrecognised devices — in one screen. Doing it first tells you how much work you actually have ahead.

Work through every item it flags. Do not dismiss warnings you plan to "handle later" — the checkup will not remind you again. Note that this tool is only available when you are logged in on a computer or on a recent version of the Facebook mobile app; the mobile browser version often hides it.

Step 2 — Log out every session you do not recognise (3 minutes)

Why this comes before the password change: if an attacker is already logged in on their own phone, changing your password alone may not evict them from that active session. Kill the sessions first, then rotate the password so they cannot get back in.

You will see a list of devices, browsers, and rough locations. Go through it honestly:

• Keep only devices you are holding right now or use every week.
• Log out of anything unfamiliar — old phones you sold or gave away, a browser at a cyber café or your office, a friend's laptop you borrowed once.
• Log out of everything if you see a location or device you genuinely cannot explain, then immediately continue to step 3.

Step 3 — Set a unique, strong password (4 minutes)

The single most common cause of a hacked Facebook account is not a clever hacker — it is a password you also used on a shopping site that got breached three years ago. If your Facebook password appears anywhere else, treat it as already compromised.

What a good Facebook password looks like in 2026:

• Long beats complicated. A four-word passphrase like correct-mango-rickshaw-42 is stronger and easier to remember than P@ssw0rd!
• Nothing guessable from your profile. No name, birth year, phone number, spouse's name, or your Page name.
• Used nowhere else. Not on your email, not on bKash, not on your hosting panel — nowhere.

Remembering a dozen unique passwords is unrealistic, which is exactly what a password manager solves. If you would rather not use one, at minimum give your email and Facebook two completely different passwords you have never typed anywhere else. Our guide to creating strong passwords you can actually remember covers the passphrase method in detail, and you can check whether your current password has already leaked in a known breach.

Step 4 — Turn on two-factor authentication — with the right method (5 minutes)

This is the highest-value step on the list. Two-factor authentication means that even if someone has your correct password, they still cannot log in without a second code from a device you control. It stops credential stuffing and most phishing outright.

Facebook offers three methods, and this is where nearly every other guide stops being useful. They are not equivalent:

Setting up an authenticator app takes about two minutes: install Google Authenticator, Authy, or Microsoft Authenticator from your app store. In Facebook's 2FA screen, choose Authentication app, scan the QR code with the app, then type the six-digit code back into Facebook to confirm. Done.

Step 5 — Save your recovery codes offline (2 minutes)

This is the step almost everyone skips, and it is the reason people permanently lose accounts they had "secured." When you turn on 2FA, Facebook generates a set of one-time recovery codes you can use instead of an authenticator code — if you lose your phone, break it, or get your SIM swapped.

Facebook typically issues ten codes, each usable once. Store them somewhere that survives losing your phone:

• Best: a secure note in your password manager, plus a printed copy in a drawer at home.
• Acceptable: written on paper and kept with your important documents.
• Do not: screenshot them to your phone gallery, save them in Messenger "Note to self," or email them to yourself. All three defeat the purpose — if your phone or email is compromised, so are your recovery codes.

Step 6 — Add a passkey (3 minutes)

Passkeys are the newer, better replacement for passwords. Instead of typing a secret that can be phished, you unlock your account with your phone's fingerprint, face, or screen lock. Because a passkey is cryptographically tied to the real facebook.com, a fake login page cannot capture or reuse it — which makes it the only method on this list that is genuinely phishing-proof without buying hardware.

Adding a passkey does not remove your password or your 2FA — it just gives you a faster and safer way to log in on your own device. On a mid-range Android phone or any recent iPhone, setup takes under a minute. If you do not see the option yet, it has not reached your account; check again in a few weeks.

Step 7 — Turn on login alerts (1 minute)

Login alerts notify you by email and notification whenever someone signs in from a device or browser Facebook does not recognise. They do not prevent a breach — they shorten it. Catching an unauthorised login within minutes instead of days is often the difference between changing a password and losing an account permanently.

Switch on both channels. If an attacker gets in and immediately disables notifications, the email still lands in your inbox.

Step 8 — Audit connected apps and websites (3 minutes)

Every time you tapped "Continue with Facebook" on a game, a quiz, a photo editor, or a "check who viewed your profile" tool, you handed that service standing access to part of your account. Most people have accumulated dozens. Many of those services no longer exist, have been sold, or were malicious from the start.

Be aggressive here. Remove anything you do not actively use this month. Removing an app you still need costs you thirty seconds to reconnect; leaving a forgotten one connected can cost you the account. Pay special attention to anything promising free followers, likes, auto-posting, or profile analytics — that category is where most malicious integrations hide.

While you are in a cleanup mindset, it is worth running the same exercise on your phone. Our guide to auditing app permissions covers what your installed apps can quietly read.

Step 9 — Secure the recovery email and phone number (3 minutes)

This is the gap that undoes everything above. Your Facebook account can be reset through your email address. If your Gmail password is weak, reused, or has no 2FA of its own, an attacker does not need to break into Facebook at all — they break into your inbox and let Facebook's own password reset flow hand them the account.

Three things to do:

• Check which email and phone are actually on file. Go to Accounts Centre → Personal details → Contact info. Remove any old email address you no longer control — a work address from a previous job or a defunct provider is an open door.
• Turn on 2FA for that email account. An authenticator app, same as step 4. This is non-negotiable if you use one Gmail for everything.
• Add a second recovery email that is not your primary one, so a single inbox compromise does not cost you both.

If your recovery email is Gmail, work through the Google account security checkup next — it takes another ten minutes and closes the same category of hole.

Step 10 — Lock your profile and tighten who can find you (3 minutes)

The first nine steps stop people from getting into your account. This one reduces what an attacker can learn about you from the outside — which is the raw material for impersonation, cloned profiles, and social engineering aimed at your friends and family.

Lock Profile bundles about seven privacy settings into a single tap. Once locked, only friends can see your posts, photos, stories, and full-size profile picture; past public posts switch to friends-only; and profile and tag review turn on automatically.

If the button is missing, you can achieve most of the same result manually: set Posts, Stories, and Profile and tagging to Friends under Settings → Audience and visibility, and turn on both profile review and tag review. Also turn on Profile picture guard, which blocks downloading and sharing of your profile photo — the single most common ingredient in cloned-account scams.

Finally, under Audience and visibility → How people find and contact you, restrict who can look you up using your phone number and email address, and switch Who can send you friend requests to Friends of friends.

Extra steps if you run a Page or online shop

For F-commerce sellers, freelancers, and anyone managing a business presence, the stakes change completely. Your Page is not a separate fortress — it is attached to your personal profile. Nearly every Page hijacking starts with the admin's personal account being compromised, which is why steps 1 through 10 are the real business security plan.

On top of those, do three more things:

• Review who has admin access. Old freelancers, a cousin who "helped set it up," and former employees frequently still hold full control. Remove anyone who does not need access today, and understand what each role can actually do before you assign it.
• Keep at least two admins. If you are the sole admin and you lose your account, the Page can become unrecoverable. A second trusted admin is your insurance policy.
• Require 2FA for everyone in your business portfolio. Your security is capped by the least careful person with access.

We cover asset-level protection in depth in how to secure your Facebook Page from hackers.

Verify it worked: the 5-minute test

Turning settings on is not the same as knowing they work. Almost no security guide includes this part, and it is where people discover their 2FA was never actually confirmed or their profile is still public. Run these four checks now.

If the first test lets you straight in without a code, your 2FA setup was never completed — go back to step 4 and finish the confirmation screen.

Four things that do not secure your account

Plenty of widely shared advice does nothing at all. Skip these:

• Copy-pasting a "privacy declaration" status. Posting a legal-sounding paragraph about not consenting to Meta using your data has zero effect on anything. It is a chain letter, not a setting.
• Third-party "account protection" or "verification" services. Anyone offering to secure, verify, or recover your Facebook account for a fee — especially via Messenger or a Page inbox — is running a scam. Meta never charges for account recovery, and handing over your credentials is the actual attack.
• Deleting the Facebook app to "log out." Uninstalling an app does not end the session. Log out explicitly, or clear it from "Where you're logged in."
• Relying on SMS 2FA alone and calling it done. It is a real improvement over no 2FA, but as step 4 explains, it is the one method with a well-documented bypass. Treat it as a backup, not your primary.

Learning to recognise the bait itself is the other half of the job — our guides on spotting phishing emails and fake links and why you should never share an OTP cover the tactics that get past technically secure accounts.

What to do if you are already hacked

If you are reading this because something has already gone wrong — you cannot log in, your password stopped working, or friends are receiving strange messages from you — stop working through the checklist and act in this order instead:

• Go to facebook.com/hacked and follow Meta's guided recovery flow. Do this from a device you trust.
• Check your email inbox and spam folder for messages from Meta about changed contact details. These often contain a "secure my account" reverse link that works even after the attacker changed your email.
• Warn your contacts through another channel so nobody sends money to a scammer using your name.
• Report it officially if money, blackmail, or impersonation is involved. In Bangladesh this goes to the CID Cyber Police Centre or through the national cybercrime reporting channels.

Our step-by-step Facebook account recovery guide for Bangladesh walks through the full process including identity verification, and how to report cybercrime in Bangladesh covers the official complaint route.

Your quarterly maintenance schedule

Security is not a one-time project. Put a recurring reminder in your phone and spend ten minutes on this every three months.

Frequently asked questions

How do I secure my Facebook account in the fastest way possible?

Turn on two-factor authentication with an authenticator app, then log out of every session you do not recognise. Those two actions take about eight minutes and block the majority of real-world account takeovers. Everything else on this checklist is worth doing, but start there.

Is SMS two-factor authentication safe enough?

It is much better than no two-factor authentication at all, but it is the weakest of the three methods Facebook offers. SMS codes can be intercepted through SIM swap or cloning, which is a documented and common attack in Bangladesh. Use an authenticator app as your primary method and keep SMS only as a fallback.

What happens if I lose the phone with my authenticator app?

You use one of your saved recovery codes to log in, then set up the authenticator app again on your new phone. This is precisely why step 5 exists. If you lose both the phone and the codes, recovery becomes a slow identity-verification process with no guaranteed outcome.

Can I lock my Facebook profile in Bangladesh?

Yes. Bangladesh is one of the countries where Meta enabled the one-tap Lock Profile feature. Open your profile, tap the three-dot menu beside Edit profile, and select Lock Profile. If the option is missing, make sure Professional Mode is turned off and your app is up to date.

Does changing my password log everyone else out?

Not reliably, and not instantly. That is why this guide puts session logout before the password change. Do it in that order, then verify in "Where you're logged in" that only your own devices remain.

How can I tell if someone else is using my Facebook account?

The clearest signals are unfamiliar entries in "Where you're logged in," login alert emails you did not trigger, messages or posts you did not create, friend requests sent from your account, and changes to your name or contact details. Any one of these means you should run steps 1 through 3 immediately.

Are passkeys a replacement for two-factor authentication?

Not exactly. A passkey replaces the act of typing a password and is resistant to phishing, but you should keep two-factor authentication enabled as well. Together they cover different failure modes: the passkey protects your day-to-day logins, while 2FA protects the fallback paths.

Why does Facebook keep asking me for a code even on my own computer?

Facebook needs to store browser and device information to recognise you next time. If you use private browsing, clear cookies on exit, or run privacy extensions that block this, you will be treated as a new device every session. That is a settings side effect, not a security problem.

Should I pay someone to recover or protect my account?

No. Meta does not charge for account recovery, and every paid "Facebook recovery expert" advertising in comments or Messenger is a scam. At best they take your money; at worst they take the credentials you hand them.

The bottom line

Learning how to secure your Facebook account is not complicated — the process is just poorly organised by the platform itself. The platform gives you every tool you need, then scatters the instructions across a dozen help pages and never tells you which switch matters most. Now you know: sessions first, then a unique password, then app-based two-factor authentication with recovery codes stored somewhere your phone cannot lose them.

Give it twenty-five minutes today and ten minutes each quarter after that. Compared with the alternative — losing a decade of photos, your customer conversations, or a shop you spent years building — it is the cheapest insurance you will ever buy.