How to secure and recover an Instagram account
Most lost Instagram accounts are not "hacked" by genius attackers. They fall to reused passwords, phishing DMs and SMS-only security. This guide covers how to secure an Instagram account step by step, the privacy settings worth changing, and how to recover an account if you've already lost access.
How to secure an Instagram account: 8 steps
- Use a strong, unique password. Accounts Center > Password and security > Change password. A password manager makes this painless.
- Turn on two-factor authentication with an authenticator app. Password and security > Two-factor authentication. Save the backup codes offline.
- Confirm your email and phone. Accounts Center > Personal details > Contact info. Remove anything that isn't yours. (See our Instagram phone verification guide.)
- Check where you're logged in. Password and security > Where you're logged in. Log out unknown sessions.
- Turn on login alerts. Password and security > Login alerts.
- Review connected apps and websites. Settings > Website permissions > Apps and websites. Remove anything you don't use.
- Learn to spot phishing. Instagram never asks for your password in a DM. Real Instagram emails appear in Password and security > Recent emails.
- Do a security checkup. Password and security > Security Checkup walks you through the basics.
Instagram account privacy settings worth changing
- Private account if it's personal: Settings > Account privacy.
- Messages and story replies: limit who can message you.
- Hidden words: filter offensive comments and DM requests.
- Limits: temporarily restrict comments and messages from new followers during a pile-on.
- Activity status: hide when you were last active.
- Tags and mentions: approve tags manually.
Instagram account protection for businesses
- Give team members access through Meta Business Suite or Accounts Center instead of sharing the password.
- Keep two admins with 2FA so one lost phone doesn't lock the business out.
- Use a business email you control for the account, not a staff member's personal address.
- If you manage multiple Instagram accounts, keep each one in its own browser profile and record the recovery details safely.
How to recover an Instagram account
You forgot the password
- On the login screen tap Forgot password?
- Enter your username, email or phone and choose how to get the reset link or code.
- Set a new password and then turn on 2FA if it wasn't on.
Someone changed your email or password
- Check your inbox for an email from security@mail.instagram.com about the change. It often has a "revert this change" or "secure your account" link. Use it.
- If not, go to instagram.com/hacked and choose what happened (hacked, forgot password, lost 2FA, and so on).
- Follow the steps. Instagram may send a code to the original email or ask for a video selfie to confirm it's you (for accounts with photos of you).
- Once back in: change the password, remove unknown contacts and sessions, turn on 2FA, and review recent posts and DMs sent in your name.
You lost access to two-factor authentication
Use a saved backup code. If you have none, choose "Try another way" on the 2FA screen; Instagram can confirm your identity with the email or phone on file, or by a recognised device you're still logged in on.
The account is disabled or suspended
You'll usually see an option to appeal ("Disagree with decision"). Follow it once and answer accurately. Common causes are spam-like activity, impersonation and logins that look like a takeover.
Instagram account recovery guide: prevention beats cure
Recovery is slow and not guaranteed. The 15 minutes you spend on 2FA, contact details and backup codes now is worth far more than the hours a recovery appeal can take.
Bought an Instagram account? Secure it on day one
If you buy an aged or PVA Instagram account, treat the first login as a handover:
- Log in from one device on a stable connection.
- Change the password.
- Replace email and phone with your own.
- Turn on 2FA with an authenticator app.
- Log out any other sessions and warm up gradually.
Browse Instagram accounts, including aged Instagram accounts (2–3 years) and Instagram PVA accounts. For the full login routine see how to log in to bought accounts safely.
Frequently asked questions
What is the best way to secure an Instagram account?
A unique password plus two-factor authentication with an authenticator app, confirmed contact details and regular checks of where you are logged in.
How do I recover a hacked Instagram account?
Use the "revert this change" link in Instagram's security email, or go to instagram.com/hacked and follow the steps, which may include a video selfie.
What if I lost my 2FA device?
Use a saved backup code, or choose "Try another way" to confirm by email, phone or a recognised device.