Reach collapsed after a hack: cleaning up what the hacker did and restoring recommendations

If your reach collapsed after you got a hacked Instagram account back, the hack itself is not the cause; what the hacker did with the account is. Instagram’s Recommendations Guidelines say it tries not to recommend accounts that recently broke the Community Guidelines, put non-recommendable content in their name, bio or profile photo, used misleading practices to build a following, or were banned from running ads. A single takeover can trigger every one of those, so clean up in the right order, read Account Status, and request a review only where Instagram got it wrong.

This guide covers only the post-hack case. If you are not sure a recommendation limit is the problem at all, start with our general guide to checking and fixing an Instagram shadowban.

The short answer

• Why it happens: the attacker’s posts, profile changes, follower purchases and ads are recorded against your account, and the recommendation rules apply to the account.
• Where to look: Account Status. Professional accounts can see there whether their content is eligible to be recommended, and what is blocking it.
• Order: lock the attacker out, record what Account Status shows, restore the profile, remove the attacker’s content and connections, then request reviews.
• Followers still see you. A recommendation limit affects people who do not follow you; Instagram says your content can still reach followers.
• Time matters. Several of the conditions are about recent behavior, and Instagram publishes no fixed recovery period.

What the hacker did, and which rule it touches

Instagram’s page on recommendations on Instagram lists the accounts it tries not to recommend. Set it next to what attackers often do with a hijacked account, in the cases we see:

What the attacker did	Instagram tries not to recommend accounts that…
Posted crypto or “investment” scams that were then removed	recently violated the Community Guidelines
Changed the name, bio, photo or link to promote the scam	repeatedly or recently put non-recommendable content in the name, username, profile photo, bio or profile
Bought followers or likes, or connected a growth app	repeatedly used misleading practices to build a following, such as buying likes
Ran ads with a stolen card and got the account banned from advertising	have been banned from running ads on Meta’s platforms

None of these lines has an exception for content posted by someone else. Instagram’s systems see an account that did these things.

Step 1: lock the attacker out first

Do not start cleaning while the attacker can still get in. Change the password from inside the app (Instagram says this logs out every other device), check Where you’re logged in, confirm the email and phone are yours, turn on two-factor authentication, and revoke third-party apps you do not recognize. Instagram’s page on a profile posting unauthorized content gives the same list, and warns specifically against apps that offer likes and followers in exchange for your login details. If the account is still posting scams and you are not fully back in, our guide to a hacked account posting crypto scams covers containment and recovery in order.

Step 2: read Account Status before you delete anything

Open your profile menu and find Account Status under More info and support (on some versions it sits inside Help). Instagram’s page on recommendation eligibility says professional accounts can see there:

• whether their content may be eligible to be recommended to people who do not follow them;
• whether something in the profile, such as the photo or bio, goes against the Recommendations Guidelines;
• a sample of content that cannot be recommended right now, and which guideline applies;
• any content removed for going against the Community Standards.

Screenshot every screen. You need a record of what was flagged, and the dates help show that the content appeared during the takeover. If your account is personal rather than professional, Account Status still shows removed content and features you cannot use, but Instagram describes the recommendation eligibility view for professional accounts.

One line on the same page explains why reach can fall to almost nothing: if the account is not eligible to be recommended, none of its content will be recommended, including posts that follow every rule.

Step 3: restore the profile

Change the name, username, profile photo, bio and links back to yours. The profile is assessed at account level, so a scam link left in the bio can keep the whole account out of recommendations. Check every field, including the category, contact buttons and any link-in-bio page the attacker may have swapped.

Step 4: remove what the attacker posted and connected

• Posts, reels, stories, highlights and comments the attacker made, including anything they archived. Delete them once they are screenshotted.
• Third-party apps and websites with access to the account. Revoke anything you did not authorize yourself.
• Follower services. If the attacker bought followers or likes, cut off whatever delivered them: revoke its access and do not pay for or reconnect anything. The guideline is about the practice, so the priority is making sure it has stopped. Instagram does not say whether removing the purchased followers themselves changes eligibility.
• Ads. If the attacker ran ads, check whether your ad account or your ability to advertise was restricted. That restriction has its own appeal in Meta’s ad tools, and while it stands it can keep the account out of recommendations. Our guide to ad accounts disabled for unusual activity covers that appeal.

Step 5: request reviews, once each

For content removed during the takeover, Instagram’s page on requesting a review explains the route: in Account Status, open Removed content, tap the item and choose Request a review. For recommendation flags, the eligibility page says you may be able to request a review when your content goes against the Recommendations Guidelines. Instagram also says a review can take up to 90 days, and that a request may be closed before it is reviewed.

Be realistic about what a review does. It asks Instagram whether its decision was correct. If the attacker really did post a scam, the removal was correct, and a review will not reverse it. The Instagram help pages we checked do not describe a separate process for clearing violations caused by an attacker. What clears those is time: the guidelines refer to accounts that recently violated the rules. Use reviews for decisions that are actually wrong, such as one of your own older posts flagged by mistake, and let the rest age out while the account behaves normally.

Step 6: post normally and give it time

Post original content at your usual rhythm. Do not buy engagement to “restart” the account, and do not fill the gap with reposted viral reels: unoriginal content with only minor edits is on Instagram’s list of content it avoids recommending. Instagram publishes no timeline for eligibility to return, and it notes that being eligible does not guarantee your content will be recommended. In the cases we see, reach comes back gradually once Account Status is clear, not overnight.

What does not help

• Paid “shadowban removal”. Nobody outside Instagram can change recommendation eligibility, and services that ask for your login repeat the takeover.
• Deleting the whole feed. It removes the evidence of what happened and does nothing about account-level flags.
• Starting over on a new account. It throws away the audience you just fought to recover and leaves the cause unfixed.

When to get help

If Account Status is clear and your reach is slowly returning, you need nothing more. Help is worth it when Account Status shows restrictions you cannot explain, when the account was disabled or banned from advertising during the takeover, or when the recovery itself is not finished. Our hacked account recovery service covers the whole sequence through Instagram’s official channels: recovery, security, the cleanup record and the reviews. It starts with a free case review. We do not promise that reach returns by a date, and if a violation on the account was real, we will tell you so.