X tool guide: publishing, accounts and private-message limits

X is more a publishing network than a confidential messenger. Protect the account with a unique password and two-factor authentication, keep a contact path outside the network, and take sensitive conversations elsewhere. Even a protected post can be saved by a follower, and deleting later does not recall copies that already left the site.

If you want to leave the network or build a planned archive, see leaving X. Choosing a channel for confidential material is covered in choosing private channels.

A unique password and two-factor authentication

1. From the menu go to Settings and privacy, then Security and account access, then Security.
2. Change the password and choose a unique one that is not the same as the recovery email password.
3. Open Two-factor authentication. Use an authenticator app or a security key, not SMS alone. SMS is tied to a number and may not be available on every account.
4. X usually gives only one backup code. Store it immediately in a password manager or on separate paper; do not assume you can see it again.
5. If a passkey exists under additional password protection, create it only on a device you own. A passkey is not a substitute for two-factor authentication and does not remove the account password.
6. Do not send a login code to anyone who claims to be X support.

Sessions and connected apps

1. Under Security and account access, open Apps and sessions.
2. Read active sessions for approximate location, time and device type and log out of anything unknown.
3. Look at connected apps: a scheduler, a third-party client or Sign in with X on another site. Revoke access you do not recognize.
4. After using a shared computer, sign out and do not tap “remember me”.

Email, phone number and recovery

1. Under Your account, open Account information.
2. Read the email and number and remove anything you no longer control.
3. Leave at least one recovery email that you can open.
4. Do not change the username without a reason; a name history may remain visible, and old links may go to another account or to an empty page.

Protecting posts only shrinks the circle

1. In Privacy and safety, open Audience and tagging and turn on Protect your posts if not everyone should see the material.
2. New followers must be approved. Look at who they are before you approve.
3. Followers can still take a screenshot or move the text elsewhere.
4. Turning protection on does not necessarily remove old public posts from outside archives.
5. Your reply under someone else’s public post may be visible in a different way depending on settings; consider that before you reply.

Who can reply, mention you or send a message

1. For each post, choose who can reply: everyone, people you follow, verified accounts, or only mentioned accounts.
2. In Privacy, see who can mention you.
3. In Direct Messages, choose who can send you a message request.
4. A mention and a reply in a public thread are publishing, even if your account is otherwise cautious.
5. Treat a quote and a repost as publishing too; a repost attaches a new audience to the original material.

Do not treat an X private message as a confidential channel

The older X inbox is readable by the service and is not a place for confidential material. A newer feature called Chat offers end-to-end encryption on some accounts, but only when both people have registered for it and the relationship conditions are met. A message request is usually unencrypted until it is accepted. If you see an unlocked icon next to the send button, the message will go out unencrypted.

1. Before you send sensitive material, look at that icon; if it is not locked, do not write the text here.
2. Metadata such as who you wrote to and when is usually not encrypted.
3. If you add an AI feature or Grok to the conversation, the content is made available to the service so that feature can work.
4. Reporting a message gives X the text for review.
5. Disappearing messages, if they exist, do not stop a screenshot everywhere.
6. Even with Chat, the published design is not necessarily forward secure; take highly sensitive material to a more suitable messenger. Practical steps are in using Signal safely.

A contact path outside the network

An account can be suspended, taken over or limited. If the only way to reach colleagues is this direct message inbox, one lockout leaves you unable to warn them. Agree in advance on an alternative path—ideally an end-to-end messenger or an in-person route—not after the account is locked.

1. Do not write that path in a public post.
2. Exchange a backup number or username only through a channel you already trust.
3. After you set up the alternative, test it once.

Being found by email, number and the address book

1. In Privacy, open discoverability and contacts.
2. Limit being found by email and by phone number if you do not want someone who has those details to reach the account.
3. Turn off address-book sync unless you need it, and review contacts permission in the system settings too.

Location, media and photo tags

1. Do not add a precise location to a post if the place should not be revealed.
2. Before you upload an image, check the background, signs and metadata. Details are in removing identifying metadata.
3. Limit photo tagging so others cannot mark you in an image so easily.
4. Treat live video and audio in a Space as publishing; recording and resharing are possible.

Lists, communities and highlights

1. Other people may add you to a public list; you can sometimes see that from a notification and, if needed, block them or stop following.
2. A post in a Community is visible to members of that group and sometimes more widely.
3. Treat Highlights and a pinned post as the shop window of the profile; do not put temporary material there.

Block, mute and muted words

1. Blocking reduces mutual visibility but does not erase a saved copy.
2. Muting reduces notifications without telling the other person.
3. Use muted words to reduce abuse and to see fewer high-risk threads; that does not replace protecting the account.

Impersonation and the blue check

1. Do not confuse a paid checkmark with independent identity verification. Anyone can set a display name like yours; look at the @ handle.
2. If an account has been created with your name and photo, use the official path to report impersonation and tell people you know through another channel.
3. Review the password and two-factor authentication on the real account the same day.
4. Ignore a message that sells a verification badge or a way to lift a suspension.

Fake sign-in pages and false alerts

1. Start sign-in by opening x.com or the official app yourself, not from a link in mail.
2. Look at the address bar. Close a page that asks for the password and is not the official domain.
3. If a message says the account is at risk, verify that from Security and sessions inside Settings.
4. Enter a confirmation code only on the official page.

Archives and deletion

1. From Your account you can download an archive of your data. That file contains posts, messages and lists and no longer sits behind the account lock.
2. Planning a departure and keeping an archive is covered in leaving X.
3. Deleting a post does not recall saved copies, quotes or outside archives.
4. Before a large deletion, export the archive if you need the history and protect that file.

If you think the account is at risk

1. Change the password, end every other session and revoke unknown connected apps.
2. Check two-factor authentication and the recovery email.
3. Take down a post sent in your name if you still can, and warn people through the alternative path.
4. The rest is in recovering a compromised account.

Common mistakes

• Assuming an X direct message is like an end-to-end messenger.
• Using only SMS for two-factor authentication, or leaving it off.
• Letting this account be the only contact path for a working group.
• Using the same password for X and for the recovery email.
• Relying on a blue check to recognize a person.
• Writing a number or an address in a post or in an unencrypted message.
• Signing in from a fake alert link.
• Turning on post protection and imagining that the past has been removed from the internet.
• Adding an AI feature to a conversation that should stay limited.

A paid subscription, a familiar display name or a large follower count does not create a new security layer. What actually protects your account and the people close to you in daily use is a unique password, a strong second factor, a clean session list and not writing confidential material on this network. Do this work today; do not leave it until after an incident.

Who can write in your name

1. If you have given delegate or team access to the account, open that list in the delegation or team settings.
2. Do not give someone full access only so they can schedule one post.
3. When a collaboration ends, remove access the same day and review sessions.
4. Also revoke an external scheduler in Connected apps, instead of only signing out of that tool.

Likes, bookmarks and searching the past

1. Likes and some other activity may be visible to others. For sensitive material use a more private channel instead of a public reaction.
2. A bookmark is mainly for you, but anyone who has the unlocked account can see it.
3. Search your own handle once to review old public posts, not only the top of the profile.
4. When your job or where you live changes, review that past against the new audience. The broader framework is in reducing social media disclosure.

Artificial intelligence on the network

1. If there is a setting for sharing data with Grok or a similar feature, read it and limit anything you do not want used for training or for answers.
2. Do not write sensitive text in a conversation with that feature.
3. Adding it to an encrypted Chat ends the confidentiality of that thread.

A professional account and ads

1. Switching to a professional or creator account adds insights and sometimes contact details.
2. Treat a contact button or a website link as public.
3. A paid subscription brings appearance or analytics features, not a new encryption layer on ordinary posts or messages.

Notifications and a shared device

1. Turn off lock-screen previews of message and reply text.
2. If a watch shows the same preview, limit that too.
3. Do not sign in on a shared computer, or use a guest window without saving the password and sign out at the end.
4. Keep the phone’s screen lock on.

Official installs and unofficial clients

1. Get the app from the official store or from x.com itself.
2. Do not use an unofficial client that asks for the password instead of official sign-in.
3. After you revoke an app in the connected list, change the password too if it may have leaked.

Deactivation

1. Deactivation hides the account and is usually reversible for a while; after that the handle may be released.
2. Deactivating does not erase copies other people already saved.
3. Download an archive first if you need the history.

What X does not hide

A public post is live for search engines, outside archives and screenshots. Protecting posts shrinks the circle but does not remove followers or the service itself. An ordinary message is readable by the service, and even an encrypted Chat leaves metadata and comes with conditions and limits. If an identity or a text should not sit with this platform, do not write it here. Do not treat writing in a direct message and then deleting it as erasure from the service or from other people’s devices, especially if the message was never encrypted to begin with.

Set replies separately on each post

1. Before you send, open that post’s reply menu and shrink the circle if you do not want a crowded or hostile thread.
2. Limiting replies does not necessarily close quotes. A quote can republish the same text to a new audience.
3. Look at your own replies to others the same way; your text under a high-reach account will be seen.
4. If a conversation should stay private, do not start it in a public thread at all.

Sensitive media and content warnings

1. If an image may harm or identify someone, decide before you publish whether it needs a media warning and whether it should be here at all.
2. Cropping a face or a place in a quick edit is not enough if the original file still has metadata or extra margins.
3. Treat a live Space or a video stream as recordable; do not assume it exists “only in that moment”.

Following, suggestions and similar accounts

1. On a public account the follower and following lists are usually readable and show a network of relationships.
2. Suggestions of accounts like yours can connect you to people you do not want finding you; reduce that with protected posts and tighter discoverability.
3. Following a sensitive account from a work profile creates a public link. For that kind of reading, use a separate identity and device, or do not follow and read the source somewhere else.

Take the backup code seriously

1. Right after you turn on two-factor authentication, store that single code immediately.
2. If you lose the authenticator phone and do not have the backup code, signing in may become hard or depend on support.
3. Do not store the code in a draft post or a direct message.
4. After you use the code, if the app creates a new one, replace the stored copy.

Changing the number and losing the email

1. Before you lose a work number or email, change both in Account information.
2. A recycled number can become a reset path for someone else if it is still on the account.
3. After a change, sign in once with the second method to see that recovery is still in your hands.

Group messages and calls in Chat

1. If Chat has groups or voice and video calls, apply the same encryption and metadata limits to every member.
2. Each new member widens the circle of disclosure.
3. Do not put a call on speaker in a public place.
4. Do not treat these calls as a substitute for a suitable messenger for confidential work.

When the account is suspended or limited

1. Open a suspension warning only from the official app or x.com, not from a threatening email.
2. If you really are limited, use the official appeal path and still review the password so a fake request is not mixed into a real lockout.
3. This is where a contact path outside the network matters: colleagues must be able to reach you without this account.
4. After you get back in, read sessions and connected apps again.

Display name, handle and the bio link

1. Anyone can set a display name like yours; judge identity by the @ handle and the account history.
2. The bio link and the location written on the profile are public.
3. If you use a link-in-bio page, that page may also see click statistics.
4. Look at the profile photo and header like any other image for places and people in the frame.

Scheduling and drafts

1. A draft and a scheduled post stay on that account, and anyone with access to the account or the scheduling tool can see them.
2. Do not leave sensitive material sitting in a draft that is about to go public.
3. If you schedule through an external tool, limit its access in Connected apps to what it actually needs.

Country, language and ad data

1. The registered country and language may affect recovery or how content is shown; keep them accurate but do not put extra information on the profile.
2. Review ad preferences if you want less data used for personalization. That does not replace a password and two-factor authentication.

Several accounts in one app

Switching between several accounts in one app is convenient, but the same device holds both. Sending from the wrong account is common. For sensitive work, check which handle is active before you post and before you message. Real identity separation needs a separate device and process, not just several handles on one phone. Deleting a mistaken work post that went out from the personal account, or the reverse, does not undo it; the audience and the ranking system already saw it.

Open a sign-in alert from Settings itself

1. If a message reports a new sign-in, open Security and sessions yourself in the app or on x.com.
2. Do not trust a link inside the message for a “security review”.
3. If a session was unfamiliar, end them all, change the password and review connected apps.
4. After you change the password, sign in again on your own devices and check that the backup code is still where you can reach it.

Media other people take from your post

1. Expect a public image or video to be downloaded or saved, even if you have limited the share button.
2. A watermark or cropping a corner does not stop a determined reshare.
3. If an image should not spread, do not upload it here at all.

When you are only reading and not writing

Even without a new post, following, old likes, lists and leftover messages still give off information. If the risk is high, reduce activity, take identifying posts off the profile or hide them, and move sensitive contact to another channel. Turning notifications off is not the same as deleting history.

Short links and preview cards

1. A link you put in a post usually builds a preview card, and those clicks are logged by the service.
2. For a sensitive link, do not use a random shortener passed around in messages; it may change the destination.
3. Before you publish, look at the preview yourself so the card title and image do not reveal too much.
4. Treat a link in an unencrypted direct message as savable, like a public post.

What to do today

1. Set a unique password, finish two-factor authentication with an authenticator or a security key, and store that single backup code outside the app immediately.
2. Clean up sessions and connected apps, and sign out on a shared device.
3. Limit being found by email and number, and turn off address-book sync if you do not need it.
4. Protect your posts if you need to, and review unknown follow requests.
5. Set who can reply, mention you and send a message.
6. Agree with sensitive colleagues on a contact path outside X and test it once.
7. Move confidential material out of direct messages, and look at the lock icon before every new message.
8. Remove old recovery emails and numbers.
9. Limit notification previews on the lock screen.
10. If you need an archive, download it from the official path and keep it separately.
11. Scroll the profile once as an outsider or in the protected view and see whether it shows only what you intend.
12. Revoke finished team access or a leftover scheduling tool, and look again at one old identifying post for location, image and replies.