Instagram security checklist for creators: 21 checks that close the usual ways in

The settings that protect a creator account are few, free and mostly in one menu: two-factor authentication with an authentication app, a unique password, a secured email account, a clean list of logged-in devices and connected apps, and the habit of checking any “Instagram” message inside the app before acting on it. Instagram calls two-factor authentication the single most effective step to protect an account from hackers, and says it is on by default for creator accounts, so the first check is that nobody turned it off.

This checklist is written to be copied, printed or shared with your team. Each item says what to check and why, with Meta’s own guidance linked. A one-page version is at the end.

The short answer

• Two-factor on, with an authentication app, and backup codes stored offline.
• A unique password, and an email account that is just as well protected.
• Once a month: where you’re logged in, Accounts Center, connected apps, account history.
• Every “Instagram” email checked in Recent emails; DMs about your account treated as fake.
• A recovery file with the sign-up email, phone and device, kept off your phone.

Part 1: Login (15 minutes, today)

1. Two-factor authentication is on. Accounts Center, then Password and security, then Two-factor authentication. Instagram’s page on securing your account says it turned two-factor on by default for creator accounts, and asks you to check you did not turn it off.

2. The method is an authentication app. Instagram’s two-factor page offers three methods (authentication app, text message and WhatsApp) and recommends the app. The app method can only be turned on from the Instagram app for Android and iPhone.

3. Backup codes are stored offline. If you lose your phone, a backup code is how you get in. Keep them in a password manager or on paper, not in your camera roll.

4. “Trust this device” is used only on your own devices. Instagram says not to tap it on a public or shared device.

5. The password is unique and long. Instagram says it should differ from the passwords for your email or bank, recommends at least eight characters, and suggests a password manager. Its page on accounts at risk names the two usual leaks: a password reused on a site that was breached, and an account synced with an unauthorized third-party app.

6. Advanced Protection, if Instagram asks. Instagram’s page on Advanced Protection says some accounts must enroll, including Meta Verified subscribers, accounts connected to Meta Verified for businesses, people who advertise with Meta, and civic actors such as politicians and journalists. If you do not enroll within the grace period, the account is locked until you do. Never ignore that prompt.

7. Passkey, Security Checkup and login alerts. Meta’s Account Recovery Hub lists all three among its prevention tools; login alerts tell you about new sign-ins from an unrecognized device or browser. Turn on whichever your app offers.

Part 2: Email and phone

8. The email account is as secure as Instagram. Instagram puts it plainly: anyone who can read your email can probably also access your Instagram account. Give the email its own unique password and its own two-factor.

9. The email and phone on the account are yours and current. Remove old numbers and addresses you no longer control; recovery codes go to them.

10. Your personal number is not public. In our experience, a phone number in the bio or on a contact button is how SIM swap targets get picked. Use a business line or email for brand enquiries.

Part 3: Monthly review (5 minutes)

11. Where you’re logged in. Accounts Center, Password and security, Where you’re logged in. Instagram’s login activity page says you can log out any device and tell Instagram a login was not you.

12. Linked accounts in Accounts Center. Remove any account you do not recognize, as Instagram’s hacked-account guidance advises.

13. Third-party apps and websites. Instagram warns that an app holding your login, by access token or password, can gain complete access to your account, and singles out apps that offer likes and followers. Revoke anything you no longer use.

14. Account history. Your activity, then Account history, lists the changes made to the account. A password, email or username change you did not make is an early warning.

Part 4: Messages, deals and links

15. Every “Instagram” email is checked in Recent emails. Accounts Center, Password and security, Recent emails shows official emails from the last 14 days. If it is not there, it did not come from Instagram. Our guide to real and fake Meta emails lists the addresses to trust.

16. DMs about your account are treated as fake. Instagram says it will never send you direct messages about your account in the app. Copyright strikes, verification offers and deletion warnings in DMs are phishing; our breakdown of the copyright phishing message shows how the kit works.

17. Brand deals never need your Instagram login. In our experience, fake collaboration offers are the lure aimed most specifically at creators: a contract or “campaign dashboard” behind an Instagram login page. A real brief does not need your Instagram password to open.

Part 5: Team access

18. Nobody gets your password or login codes. Instagram says never give your password to someone you don’t know and trust, and a code shared once is a login handed over. If a manager or agency needs access, agree how they will work without your password before they start. The fifth pattern in our guide to how takeovers actually happen is the person you gave access to.

19. When someone leaves, the password changes. Instagram says that when you update your password, you are logged out of all other devices, which ends any session a former team member still had.

20. Business notifications are on. If the account is connected to a Business Manager, Instagram’s scam guidance recommends turning on Business notifications so you are alerted to changes there.

Part 6: Your recovery file

21. A recovery file exists, and it is not on your phone. If the worst happens, Instagram’s identity checks ask for details that are easy to record now and hard to find later. Its hacked account page says that for an account without photos of you, a support request asks for the email address or phone number you signed up with and the type of device you used at sign-up; for an account with photos of you, it asks for a video selfie. Write down:

• the email address and phone number you originally signed up with;
• the device you used to create the account (iPhone, Android, iPad or other);
• whether the account shows your face, which decides the selfie route;
• the official starting point if you are locked out: instagram.com/hacked.

The one-page version

Print this, or paste it into your team’s notes.

1. Two-factor on
2. Authentication app as the method
3. Backup codes stored offline
4. Trusted devices: own devices only
5. Unique password, eight characters or more, in a password manager
6. Advanced Protection completed if prompted
7. Passkey, Security Checkup and login alerts where available
8. Email account: unique password and two-factor
9. Account email and phone current and yours
10. Personal number not public
11. Where you’re logged in: reviewed monthly
12. Accounts Center: no unknown linked accounts
13. Third-party apps: reviewed and trimmed
14. Account history: no unexplained changes
15. Emails confirmed in Recent emails before clicking
16. DMs about the account ignored and reported
17. No Instagram login to read a brand brief
18. No shared passwords or codes
19. Password changed when someone leaves
20. Business notifications on
21. Recovery file kept up to date

When to get help

This checklist costs nothing, and most creators can complete it in an afternoon. If something on it already looks wrong (a device you do not know, an email change you did not make, a linked account that is not yours), act on it now: change the password from inside the app first. If you are already locked out, our hacked account recovery service works through Meta’s official recovery channels and starts with a free case review. We do not sell “account protection” or monitoring, and we cannot guarantee a recovery; we can tell you honestly which route fits your case.