Facebook tool guide: accounts, audiences and relationships

Protect a Facebook account with a unique password, two-factor authentication and a review of devices and connected apps. Limit the audience of each post and of tags, and keep a work Page separate from a personal profile. Choosing an audience does not turn a post into a private message; anyone who is allowed to see it can save or reshare it.

The broader framework for choosing an audience and for what should not be written at all is in reducing social media disclosure. If you think the account is no longer yours, close other sessions and then follow recovering a compromised account.

Accounts Center and a unique password

Many sign-in settings for Facebook, Instagram and some other Meta services now live in Accounts Center. Official help says you may instead see Meta Account settings; the Password and security section does the same job. Do not reuse this password as the password of the recovery email.

1. Tap your profile picture at the top, then Settings & privacy and Settings.
2. Open Accounts Center and go to Password and security.
3. Change the password and choose a unique one that you keep only in a password manager or on separate paper.
4. If several Facebook or Instagram accounts are attached to the same center, review each password separately; being connected does not mean the passwords should be the same, and they should not be.
5. Do not write the password in a chat, an email draft or a public sync folder.

Make two-factor authentication strong

1. In the same Password and security section, open Two-factor authentication and select the Facebook account.
2. Add a method. A hardware security key or an authenticator app is safer than SMS, because SMS is tied to a number and can be taken over if the SIM is swapped.
3. If you keep SMS only as a backup, use a number you control, not a work number that may close tomorrow.
4. Create recovery codes there and store them outside Facebook. Without them, signing in again is hard if you lose the authenticator phone.
5. Do not send a login code to anyone who claims in a message to be Facebook support. Official support will not ask for a code inside a private message.

Login alerts and where you are logged in

1. In Password and security, turn on Login alerts so a sign-in from an unrecognized device is reported to you.
2. Open Where you're logged in and select the account.
3. Read each session for time, device type and, if shown, location.
4. Log out of a session you do not recognize. If the doubt is serious, select several sessions or all of them and confirm Log out.
5. After a mass logout, sign in again on your own device and change the password if it may have leaked.
6. Do not leave a saved login on a shared computer or a public-cafe browser.

Walk through Security Checkup once

Meta offers Security Checkup, which walks through the password, two-factor authentication, login alerts and devices in order. The shortcut does not replace your decisions, but it helps you avoid skipping a step.

1. From Settings & privacy go to Settings and open Security Checkup, or follow the same path from Password and security.
2. Finish each step instead of only flipping through the screens.
3. Repeat the checkup after travel, after using someone else’s computer, or after the people who manage your Page change.

Clean up recovery emails and numbers

1. In Accounts Center open Personal details.
2. Read every email address and phone number attached to the account.
3. Remove an old work address, a number you no longer have or an inbox you can no longer open; those become a recovery path for someone else.
4. Leave at least one recovery email that you control so you still have an official way back in if you are locked out.
5. If Trusted contacts is available, add only people you would actually trust in a recovery. Those people become part of the path that can reopen the account.

Apps, Facebook Login and business integrations

1. In Settings, open Apps and websites.
2. Look at each item: what access it has and when it was last used.
3. Remove an app you no longer need or do not recognize, and confirm.
4. If you used Facebook Login for a news site or a work tool, removing the connection may also cut off that site’s sign-in; set another sign-in method for that service first.
5. Open Business integrations separately and cut access for an advertising or Page-management tool that should no longer be there.

Activity off Meta and the address book

1. In Accounts Center go to Your information and permissions.
2. Open your activity off Meta technologies (Off-Facebook activity), review the history and disconnect or clear it if you do not want that link to remain. Disconnecting does not mean Meta never keeps any data; it only weakens the link to your account.
3. Review contact uploading. If the address book was synced, limit or stop that sync there and also review the app’s contacts permission in the system settings.
4. Clear search history if you do not want it visible on that device; this does not change what other people can find on the internet.

How people find you

1. In Settings, open Audience and visibility and then How people find and contact you.
2. Choose who can send you friend requests.
3. Limit the friends list to friends or only you if your network of relationships should not be readable from outside.
4. Limit being found by email and by phone number so someone who already has those details from elsewhere cannot reach the profile so easily.
5. If you do not want search engines outside Facebook to link to your profile, turn that option off. Turning it off does not immediately erase older copies already stored on the internet.

Audience for new posts and for old posts

1. Before every post, look at the audience selector next to the share button: Public, Friends, Friends except, Specific friends or Only me.
2. In the Posts settings, set the default audience for future posts to what you usually want, so habit does not make them public.
3. To limit the past in one step, run Limit Past Posts. That changes posts that were more public than Friends back to Friends, and it cannot be fully undone with one click.
4. A post that had a custom audience may not behave like a public post; after the bulk limit, open a few important posts and check those audiences separately.
5. You can also change one post’s audience from the post itself: open the selector next to the date and choose a new audience.
6. If your version has Profile locking, know that past public posts change to Friends and that profile review and tag review turn on. The feature is not available everywhere.

Privacy Checkup

1. Tap your profile picture, then Settings & privacy and Privacy Checkup.
2. Finish the steps about who sees what, how people find you and data settings without rushing.
3. Set periodic reminders there if you want them, but do not rely on reminders alone; come back yourself after a job change or a change in your circle of friends.

The About section and what is always on the profile

1. Open the profile and look at About: work, education, city, hometown, family relationships, phone and email.
2. Set the audience of each field separately. Keep a phone number or email on the profile to Only me in most cases.
3. The profile photo and cover may still be more visible than your posts. Do not use an image that shows a location, an ID card or people who would be put at risk.
4. Do not confuse the name you are known by with the name on an identity document; changing the name follows Facebook’s own rules, and a name history may remain visible.

Tags and writing on the profile

A tag creates a link to a profile and often expands who can see the post to include friends of the tagged person. Even if you publish carefully, someone else’s tag can attach you to a post whose audience you did not choose.

1. In Settings, open Profile and tagging.
2. Turn on review of posts you are tagged in before they appear on your profile.
3. Turn on review of tags on your own posts as well if that option is there.
4. Choose who can write on your profile and who can see those posts.
5. Choose who can see posts you are tagged in on your profile.
6. From Activity log, in timeline and tag review, you can Add to profile or Hide pending items.
7. Remove a tag you do not want; removing the tag does not necessarily take the image itself off the internet.

Stories, Reels, followers and groups

1. Check the audience of Stories and Reels separately from ordinary posts; their default may be more public.
2. If the profile has public followers, a public post is visible to strangers even when the friends list is locked.
3. Treat membership in a public group, an event RSVP and a reaction on a public post as publishing too.
4. In group settings, see whether other people can see which groups you belong to.
5. Do not write private coordination in a public group.

Keep a work Page separate from the personal profile

A Page is an organizational publishing tool, not a safer version of a profile. A Page admin can see drafts, Page messages, the role list and sometimes ads. Do not mix work and personal life on one profile, and do not use a personal profile in place of a Page for sensitive work.

1. Switch into the Page and open Page access.
2. Distinguish Facebook access with full control, partial control and Task access. Full control can change other people’s roles and in some cases delete the Page.
3. Do not give someone full control only so they can publish a post; task or partial access is usually enough.
4. Ask people who have Facebook access to use two-factor authentication and to close their own sessions.
5. Before you publish, check whether you are writing as the Page or as yourself; a mistaken personal post on a work Page, or the reverse, cannot be fully taken back.
6. Do not link an Instagram account or an outside tool to the Page unless you need to; that link creates another path to content and roles.
7. When a collaboration ends, remove access the same day, not the following week.

Do not treat Facebook Messenger as a confidential chat

Meta is making personal messages and calls on Messenger end-to-end encrypted, but official help still says this is happening gradually. Chats with businesses, Marketplace threads and some group or business-tool conversations are not end-to-end. If the material must stay between two people, first look in that chat’s settings for the words End-to-end encrypted.

1. Open the chat and read the conversation settings. If end-to-end encryption is not stated, do not use that chat for sensitive material.
2. Treat anything you share with Meta AI or a similar feature as outside end-to-end protection.
3. Turn on disappearing messages if they exist for temporary material; that does not stop a screenshot.
4. Turn on Secure storage on purpose if you want end-to-end history to come back on a new device, and keep that path’s password or key outside the app. Leaving it off can mean those chats will not return if you lose the phone.
5. In Messenger settings, see who can message you and limit message requests.
6. Turn on Messenger’s app lock with a fingerprint or a separate code if it is available.
7. Take confidential work to a more suitable channel; choosing a channel is covered in choosing private channels.

Location, photos and metadata

1. Review the app’s location permission in the system settings and turn it off if you do not need live maps.
2. Do not leave a check-in at home, at a sensitive workplace or at a gathering that should stay limited.
3. Before you upload a photo, look at the background, signs, ID images and metadata. Details are in removing identifying metadata.
4. Look once at old albums with the same eye, not only at this week’s post.

Activity log and data export

1. From Settings & privacy, open Activity log.
2. Review searches, reactions, comments and pending tags.
3. If you need a local archive, use Download your information under Your information and permissions only for the sections you actually need.
4. Keep the export file like any other sensitive document; it no longer sits behind Facebook’s lock.
5. Do not leave the export on a shared computer or in a public sync folder, and delete the temporary copy after you move it.

Notifications, shared devices and saved login

1. Limit notification text previews on the lock screen.
2. Keep the phone and computer screen locks on.
3. On a shared device do not tap “remember me”, and sign out when you finish.
4. If a watch also shows Facebook or Messenger notifications, remove text from those too.

If you think the account is at risk

1. Sign in from a device that is still yours, change the password and end every other session.
2. Check two-factor authentication and the recovery email; take a newly added email address seriously.
3. Review apps and business integrations and remove anything unknown.
4. Take down a post or a message sent in your name if you still can, and tell the people who need to know.
5. The rest of account recovery, mail and signs of an unwanted sign-in are in recovering a compromised account.

Common mistakes

• Using the same password for Facebook and for the recovery email.
• Using only SMS two-factor authentication on a number you do not fully control.
• Assuming that limiting future posts also closes old public posts.
• Ignoring other people’s tags.
• Giving someone full control of a Page only so they can publish one post.
• Writing sensitive material in a Marketplace thread or a business chat.
• Leaving a session open on a shared computer.
• Connecting, without review, an app that asks to “Continue with Facebook”.

The Restricted list and blocking

1. If you need to stay visible as a friend but not show someone your friends-only posts, add them to the Restricted list so they mainly see what is public.
2. Blocking cuts mutual profile and message visibility, but it does not erase a copy they already saved.
3. In blocking settings you can separately limit a person, Page messages or event invites.
4. Do not accept a friend request from someone whose name looks like a current friend’s without checking through another channel.

Comments, mentions and message requests

1. In the followers and public content settings, see who can comment on a public post and who can mention you.
2. A mention in someone else’s post can also attach you to a public conversation; limit that if you need to.
3. Your own comment on a public post is readable to others even if your profile is otherwise cautious.
4. Limit message requests from strangers so unwanted chats arrive less often.

Fake sign-in pages and false alerts

1. If an email or a message says your account is at risk and offers a link to “sign in and verify”, do not open that link.
2. Open facebook.com or the official app directly and go to Password and security from there.
3. Ignore a sign-in page whose address bar is not the official domain.
4. Do not enter a confirmation code or password in a suspicious form. If you already did, change the password immediately, end sessions and follow the compromised-account recovery path.

Marketplace and other location features

1. A Marketplace chat is for buying and selling, not for confidential coordination; those conversations are usually not end-to-end encrypted.
2. Read the approximate listing location and the name shown there before you post an ad.
3. Meet in a public place and do not send extra identity documents in that same chat.
4. If you do not need Marketplace, reduce its notifications and visibility so fewer unwanted requests arrive.

Face tag suggestions if they are still there

1. In Profile and tagging, see whether there is still an option for tag suggestions when a photo looks like you.
2. If it exists and you do not want others to tag you so easily, limit or turn it off.
3. That setting does not replace reviewing tags by hand.

A fake account in your name

1. If a profile has been created with your name and photo, use the official path to report an impersonating account and tell people who might be fooled through another channel.
2. Ask others to report the account instead of arguing under the fake post.
3. Review the password and two-factor authentication on the real account the same day, in case the aim was to take over the account itself.

Deactivation, deletion and a legacy contact

1. In Personal details, open account ownership and control so you can see the difference between deactivation and deletion. Deactivation hides the account and is often reversible; deletion is timed and usually cannot be undone after the waiting period ends.
2. Deleting the account does not erase copies other people already saved or reshared.
3. If you add a legacy contact, choose someone who should manage the profile after you, not someone who should not have that access.

Professional mode on a profile

Some profiles have professional tools or public followers. That mode changes analytics access and sometimes the default audience, and it makes the profile behave more like a Page. If work and personal identities should stay separate, do not turn professional tools on for a sensitive personal profile; create a separate Page and manage roles there. Treat visitor insights and the list of people who see the Page as sensitive access too, and do not share them widely through a personal account. An insights-only role, if your version has one, is usually not enough for publishing content and should not be confused with full control.

What to do today

1. Set a unique password and finish two-factor authentication with an authenticator or a security key.
2. Read where you are logged in and end unknown sessions.
3. Clean up connected apps and websites.
4. Limit being found by number and email, and limit who can see the friends list.
5. Fix the default audience for future posts and run Limit Past Posts if you have a public history.
6. Turn on review of posts and tags before they appear on the profile.
7. Review work Page roles and remove access that should have ended.
8. In one important Messenger chat, check whether it is end-to-end encrypted.
9. Remove old recovery emails and numbers.
10. Review the About section and notification previews once, and limit any phone or email fields on the profile if they are public.