Social Media Account Recovery: An Owner's Checklist
Organize account-recovery evidence, use official support routes, secure connected access, and review business activity after recovery.
Recovering a social media account begins with identifying the problem and using the platform's legitimate recovery route. A forgotten password, a compromised login, a disabled account, and a lost page-management permission are different situations. Treating all of them as a “hack” can lead you to the wrong form and make the evidence harder to explain.
This checklist is for an account owner or an authorized administrator. It explains how to organize recovery work and review access afterward. Recovery is not guaranteed, and the steps available can depend on the platform and the account's circumstances. Do not share passwords or verification codes with someone claiming to have a special recovery shortcut.
Record what happened before making changes
Write down the account identifier, the last time legitimate access worked, and the change you observed. Save relevant notices and screenshots in a private incident record. Include timestamps and the exact message shown by the platform where possible.
Separate what you know from what you suspect. An unexpected logout does not establish that an attacker accessed the account. A changed recovery email is a different kind of evidence. Clear notes help you choose the next action and explain the issue to legitimate support.
Avoid repeatedly submitting slightly different stories through several forms. Keep one accurate account of the incident and update it when you receive new information. Never fabricate ownership documents or claim authority over an account you do not own.
Secure the connected recovery accounts
Use a trusted device to check the email account that receives password resets and account notices. If that mailbox is compromised, recovering the social account without addressing the mailbox can leave the same route open.
Review the security of the associated phone number and any other account that can authorize access. The exact procedure depends on the service, but the objective is to keep recovery messages under the legitimate owner's control.
When handling identity or business documents, send them only through the platform's verified process when requested. Do not post them publicly as proof that you need help. Keep sensitive recovery records out of a shared marketing calendar or public project folder.
Use the official path for the actual issue
For Facebook compromise, the official recovery help and hacked-account entry point provide a starting route. Follow the instructions the platform presents for your account rather than an unrelated third-party script.
For other platforms, start from their official application or help center and confirm the destination before entering information. A search advertisement, direct message, or copied support logo is not evidence that a recovery service is official.
If the account is disabled for an enforcement reason, look for the relevant review or appeal process. If only a page or business asset is inaccessible, inspect whether the problem concerns a management role rather than the underlying login. Document which asset is affected so the request is specific.
Prepare evidence the owner can verify
Keep legitimate ownership records organized: previous account identifiers, business relationship records where relevant, and platform notices associated with the incident. Provide only the information required by the official process.
Do not promise that a particular document will guarantee reinstatement. The platform determines what evidence it accepts and whether the account is eligible for recovery or review. Your role is to make the account history accurate and understandable.
If a colleague or service provider assists, clarify their authorization and what information they may handle. Assistance does not require handing over every account credential. Keep the owner involved in consequential verification steps.
Check access after recovery
Once access returns, review recovery details, active sessions, connected applications, and people who can manage related assets. Remove access that is not authorized through the platform's normal controls. Record important changes so the team understands the new configuration.
Update affected credentials through the official interface and use unique passwords. Check whether other services reused the compromised password. A recovered social account may still be connected to an unrelated compromised account or application.
Meta's account security guidance points owners toward additional protections such as two-factor authentication. Choose a supported method, secure the recovery information, and make sure the owner can use the process without relying on a former team member's device.
Inspect business activity and public content
Review posts, profile changes, messages, advertising activity, and connected assets relevant to the incident. Record unfamiliar changes before correcting them when retaining evidence matters. Prioritize anything that could mislead customers or continue unauthorized activity.
Check links in the profile and recent posts. A recovered login does not establish that every destination or message is safe. Review the organization's public contact details and remove misleading changes through the appropriate controls.
If customers received suspicious messages, plan a clear correction through an official channel. Describe the verified issue and the action customers should take without speculating about unconfirmed details. Preserve an internal timeline for later review.
Reduce dependence on a single account
Maintain an accurate inventory of business accounts, asset owners, administrators, and recovery contacts. Review it when people join or leave the team. Keep permissions aligned with their responsibilities rather than giving everyone permanent full access.
Preserve important original media and editorial records outside the social platform. A publication should be able to explain its content history even when an account is temporarily unavailable. The multi-platform media workflow covers that operational planning.
For a website connected to these accounts, also review the WordPress hardening checklist. Account recovery is complete only when access, connected systems, and the publication workflow have been checked. A successful login is an important milestone, but it is not the entire recovery review.