TweetAttacks

Free tool · Runs in your browser

How hard is your X account to take over?

Answer 11 quick questions about your X (Twitter) settings and get a score with a printable list of fixes. Then paste any link you were sent and see what it really points to. Nothing you enter leaves this page.

Start the security check Explain a suspicious link

What we see most often

  1. Phishing DM"Your account will be suspended"
  2. Fake copyright notice"Appeal within 24 hours"
  3. SIM swapYour number moves to their SIM
  4. Session theftLogin cookie stolen by malware
  5. Rogue connected appPosts on your behalf
  6. Crypto giveawayYour hacked account sells it
How each one works

X account security check

Pick the answer that is true today, not the one you plan to make true. You can open X in another tab and look while you go. Your answers stay in this tab and are gone when you close it.

01 How is your X password set?

Reused passwords are the first thing attackers try, using lists leaked from other sites.

02 What protects your login beyond the password?

Settings and privacy > Security and account access > Security. Two-factor authentication and Passkey both live there.

03 Do you have your X backup code saved somewhere safe?

The backup code gets you in if you lose the phone or key that holds your second factor.

04 Is the email address on your X account locked down too?

Whoever controls that inbox can reset your X password.

05 When did you last review your connected apps?

Security and account access > Apps and sessions > Connected apps.

06 Have you checked which devices are logged in to your account?

Security and account access > Apps and sessions > Sessions.

07 Is password reset protection turned on?

With it on, anyone requesting a reset must confirm your email or phone number first.

08 Can people find your account by your email address or phone number?

Settings and privacy > Privacy and safety > Discoverability and contacts.

09 Is your phone number protected against SIM swaps?

Most carriers offer a port-out PIN or a number lock in the account settings.

10 Someone DMs you a link about a copyright strike or your verification. What do you do?

These messages are the most common way X accounts get phished.

11 How about the computers and browsers you use X on?

Session-stealing malware usually arrives as a cracked app, a fake game or a sketchy browser extension.

Guides, one attack at a time

01The most common attacks on X accounts, and how to block each oneSix attacks account for most X takeovers we hear about. Each one has a tell you can learn to spot and a setting that blunts it. 02How to set up two-factor authentication and passkeys on XX offers an authenticator app, security keys, passkeys and, for Premium subscribers only, text-message codes. Here is which to pick and how to turn each on. 03What to do in the first hour after your X account is hackedSpeed matters more than anything else. Work through these steps in order, starting with the email inbox, because that is how you get the account back. 04How to spot impersonation and fake X support accountsImpersonators copy a name and photo in seconds. The handle, the badge type, the account history and what they ask you to do are much harder to fake. 05Securing a brand or business X account shared by a teamMost brand account takeovers start with a shared password that too many people know. X Delegate lets your team post without ever holding the login. 06How to check and revoke connected apps and sessions on XYour password isn't the only way into your account. Connected apps and logged-in sessions keep access until you remove them, and both lists take two minutes to review. 07Protecting high-profile X accounts from doxxingDoxxing is rarely one brilliant discovery. It is usually small public details stitched together. Removing those details before you need to is the most effective defense. 08Free Twitter marketing software, and what it cost the accounts that used itFree follow-and-unfollow bots were everywhere around 2010. They promised followers across many accounts and usually delivered locks, suspensions and leaked passwords. 09Twitter account creator bots, fake account farms and how to defend against themAccount creator software turned out thousands of X accounts an hour. Those accounts still power follower selling, reply spam and giveaway scams, and you can learn to spot them.

Questions

Does the security check send my answers anywhere?

No. The checklist and the link explainer run as plain JavaScript inside this page. Your answers and any link you paste never leave your browser, and nothing is saved after you close the tab.

Which two-factor method should I use on X?

A passkey or a hardware security key is the strongest choice, followed by an authenticator app. X has offered text-message codes only to X Premium subscribers since March 2023, and SMS is the weakest option anyway because a SIM swap can redirect your codes.

Will X ever DM me about a copyright strike or my verification?

Treat any DM or email that threatens suspension and asks you to log in through a link as phishing. Check notices inside the X app or at x.com itself, never through a link someone sent you.

Is TweetAttacks part of X?

No. TweetAttacks is an independent site and is not affiliated with X Corp. We will never ask for your password, codes or backup codes.