How to Lock Down Your Business Social Media Accounts

What you will need: About an hour, a list of your business's social media accounts, and your password manager (or a plan to set one up).

It's easy to treat your business's social media pages as casual. But they hold customer messages, your reputation, and often your ad payment details. If the person who set up a page leaves, or someone guesses a password, you can lose control of all of it quickly.

This guide walks through six steps to make those accounts safer and easier to recover. Every platform names its menus a little differently, and the names change often, so we describe what to look for rather than exact paths. If you can't find a setting, search the platform's help center for the name of the step.

Step 1: Tie each account to a business-owned email

Every social account has an email address behind it. That email is the key: whoever controls it can usually reset the password.

If an account is tied to an employee's personal email, you don't fully own it. When that person leaves or loses access to their inbox, you may be locked out.

1. Make a list of every business account (Facebook, Instagram, LinkedIn, X, TikTok, YouTube, Google Business Profile, and so on).
2. For each one, open the account settings and find the email address the account uses.
3. If it's a personal address, change it to one the business owns, such as a mailbox on your company's web address (for example, social@yourbusiness.com).
4. Make sure messages to that mailbox reach at least two people, for example by forwarding to both, so one person's absence doesn't lock you out.

If you don't have business email yet, a dedicated email account that only the owner controls is a reasonable starting point.

Since this email can reset everything else, protect it with two-step sign-in too. If you use Microsoft 365, see How to Turn On Two-Factor Authentication for Microsoft 365.

Step 2: Give at least two people admin access using roles

Sharing one password among several people is risky. You can't tell who did what, and every time someone leaves, you have to change the password and tell everyone again.

Most platforms let you add people to a page or business account with their own logins and a role. A role is a set of permissions, such as "can post" or "can manage everything." The most powerful role is usually called Admin or Owner.

1. In the settings for your page or business account, look for the section that lists the people who have access.
2. Add yourself and one other trusted person (a co-owner, business partner, or senior employee) at the top role. Each person uses their own login, not a shared one. That's the whole point.
3. Give everyone else the lowest role that lets them do their job. Someone who only posts doesn't need admin rights.
4. Ask the second person to open the account and confirm they can manage it.

For Google Business Profile: the roles are Owner and Manager. Go to More, then Business Profile settings, then People and access, and add a second Owner.

Two people at the top role means that if one is unavailable, leaves, or is locked out, the other can still get in and fix things.

Some accounts, especially personal-style profiles, only support a single login. For those, Steps 3 to 5 matter even more.

Step 3: Turn on two-step sign-in

Two-step sign-in (also called two-factor authentication or 2FA) asks for something extra after your password, such as a code. A stolen or guessed password is no longer enough to get in.

1. Sign in to the account and open its security settings.
2. Look for two-step verification or two-factor authentication, and turn it on.
3. Pick a method. If you have a choice, an authenticator app (a free phone app that shows a short-lived code) or a security key (a small physical device) is stronger than codes sent by text message. CISA, the U.S. government's cybersecurity agency, ranks security keys as the strongest option.
4. Follow the prompts to confirm, and save any backup codes it shows you (see Step 5).
5. Repeat for every admin and every person with a login to the account.

If you manage several accounts, this step takes the most time. It's also the one that matters most.

Step 4: Store logins in your password manager

A password manager creates and remembers strong, unique passwords, so nobody has to keep them in their head, a spreadsheet, or on a sticky note. Our guide Password Managers for Small Teams: What They Do and How to Start explains how to get started.

Once you have one:

1. Create a shared folder just for social media logins, if your password manager supports it.
2. Change each account's password to a long, unique one that the password manager generates.
3. Save the login there, including the email address it's tied to.
4. Share access only with the people who need it.
5. Delete any copies of these passwords that sit in emails, chats, or documents.

Step 5: Set up recovery options

Recovery options are the backup ways into an account if you forget your password or lose your phone. Set them up before you need them.

1. In the account's security settings, find the recovery options (usually a recovery email and phone number).
2. Use a business-owned email address for recovery, not a personal one.
3. Be careful with phone numbers. If recovery codes only go to one person's mobile, that person is a single point of failure. Where possible, use a number the business controls.
4. If the platform offers backup codes, save them in your password manager or keep a printed copy in a locked drawer, not on the same phone that receives your codes.
5. Test it: check that the recovery email and phone shown in settings are the ones you expect.

Step 6: Review access whenever someone leaves

Do this each time an employee, contractor, or agency stops working with you, and set a reminder to repeat it a couple of times a year.

1. Remove the person from the access list on every business account, starting with the most important ones.
2. If they ever knew a shared password, change it now and update your password manager.
3. Check the account's list of connected apps for scheduling tools or other apps they linked, and remove any you don't recognize or no longer use.
4. Check the list of devices where the account is signed in, and sign out any you don't recognize.
5. Confirm the recovery email and phone numbers still belong to the business.
6. Make sure at least two people still have the top role.

Quick checklist

• Each account uses a business-owned email.
• At least two people have the top role, each with their own login.
• Two-step sign-in is on for everyone with access.
• Logins are in the password manager, not in emails or notes.
• Recovery email, phone, and backup codes are set up and checked.
• Access is reviewed whenever staff change.

Watch for tricks aimed at your accounts

Many account takeovers start with a fake message that looks like it came from the platform, asking you to "verify" your page or warning that it will be shut down. Before anyone clicks, review How to Spot a Phishing Email (Before Someone Clicks). For a broader look at where else your business might be exposed, see Five Common Security Risks at a Small Business.