---
title: "Instagram Security Checklist: A 15-Minute Account Lockdown"
description: "Authenticator-app two-factor, backup codes, active sessions, login requests, real Instagram emails, current contact details: eight settings to lock it down."
url: https://getmyinstaback.com/blog/instagram-account-security-checklist/
language: en
updated: 2026-10-27
publisher: GetMyInstaBack (https://getmyinstaback.com/)
---

# A 15-minute Instagram lockdown: eight settings that keep your account yours

Published 18 October 2026 4 min read [By the GetMyInstaBack team](https://getmyinstaback.com/about/)

**In one minute:** Set aside fifteen minutes. Switch on two-factor authentication, ideally with an authenticator app, and store the backup codes somewhere you can reach without your phone. Review active sessions, leave login requests on, and learn where to verify Instagram's real emails. Finish by updating contact details for the long haul and locking down your inbox. Each item shuts a door attackers commonly use.

## The eight settings at a glance

Instagram is gradually renaming "Accounts Center" to "Meta Account", so menu labels on your phone may differ slightly. The settings are the same.

| # | Setting | Closes this door |
|---|---|---|
| 1 | Two-factor authentication | A stolen password on its own |
| 2 | Authenticator app as the method | SIM swaps and lost signal |
| 3 | Backup codes stored offline | Being locked out by your own security |
| 4 | Active sessions reviewed | Someone already logged in |
| 5 | Login requests on | Silent sign-ins from new devices |
| 6 | Knowing Instagram's real emails | Phishing |
| 7 | Current email and phone | Losing the means to prove ownership |
| 8 | A secured email account | Password resets by an attacker |

## 1. Two-factor authentication

Two-factor adds a code to every sign-in from unfamiliar hardware, which makes a leaked password useless on its own. You'll find **Two-factor authentication** among the password and security settings; pick the account and follow the prompts.

## 2. The right method

| Method | Notes |
|---|---|
| Authenticator app (Duo Mobile, Google Authenticator and similar) | Instagram's recommendation; works on several devices; can only be set up from the Android or iPhone app |
| Text message | Tied to your phone number |
| WhatsApp | Requires SMS codes to be set up first |

An authenticator app keeps working without signal and survives a SIM change, which is why it suits most people best.

## 3. Backup codes, stored offline

When no code can reach you, a backup code finishes the login. You can only view them while signed in, so get them today from the additional methods inside the two-factor settings (**Backup codes**). Copy them, screenshot them or write them down, but keep them reachable if your phone is gone, and never share them. Think someone saw them? **Get new codes** voids the old set.

## 4. Active sessions

The **Where you're logged in** screen shows every recent session; end any you can't account for. Older layouts call it **Login Activity**, where a stranger's login gets **This Wasn't Me** and a password reset. More: [signing out everywhere](https://getmyinstaback.com/blog/log-out-of-instagram-on-all-devices/).

## 5. Login requests

Once two-factor is on, Instagram can alert you to every sign-in attempt from an unfamiliar device or browser, naming the device and its location so you can let it in or not. Rejecting one triggers a password reset, which locks the other person out. Enable **Login requests** in the two-factor settings and allow Instagram's push notifications. What to do when one arrives: [login alerts](https://getmyinstaback.com/blog/instagram-suspicious-login-attempt/).

## 6. Real Instagram emails

The **Recent emails** screen keeps two weeks of real Instagram mail, security messages listed apart; anything missing there didn't come from Instagram. Security mail only ever arrives by email, from @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com or @global.metamail.com, and never through Direct. More: [fake emails and DMs](https://getmyinstaback.com/blog/fake-instagram-emails-and-messages/).

## 7. Contact details with a future

Your registered email and number are how Instagram recognises you as the owner. Employer addresses and numbers you may drop one day are where people usually come unstuck, so swap them now, while you still have access, for details you'll keep for years. Already lost them? [No access to email or phone](https://getmyinstaback.com/guides/instagram-no-access-email-phone/).

## 8. The inbox behind it all

An attacker in your inbox can typically reset Instagram at will. Give that inbox a long password of its own and turn on two-factor there too.

## Common questions

### What's the safest two-factor method for Instagram?

An authenticator app; Instagram recommends that option itself. SMS and WhatsApp are fine as backups but hinge on your number.

### Where are my Instagram backup codes?

In the two-factor settings under additional methods, visible only while signed in. A new set generated there cancels the previous one.

### How can I verify that an email is from Instagram?

Two checks: it appears in Recent emails (14 days of genuine mail), and its sender domain is on Instagram's official list.

### Will Instagram contact me about security by DM?

No. It says it never does, so any such DM is phishing and its links shouldn't be opened.

## Already locked out?

Too late for prevention? List what the intruder altered and you'll get a free pointer to the matching official route. Passwords and codes stay with you.

[Open a free case](https://getmyinstaback.com/#start)

[Chat on WhatsApp](https://wa.me/447308693453?text=Hi%2C%20I%20found%20you%20on%20getmyinstaback.com%20and%20I'd%20like%20a%20free%20analysis%20of%20my%20Instagram%20account.)

## Key terms in this article

- [Two-factor authentication (2FA)](https://getmyinstaback.com/glossary/#two-factor)
- [Backup codes](https://getmyinstaback.com/glossary/#backup-codes)
- [Security email](https://getmyinstaback.com/glossary/#security-email)
- [Accounts Center](https://getmyinstaback.com/glossary/#accounts-center)

## Sources

1. [Securing your Meta Account with two-factor authentication (Instagram Help Center)](https://help.instagram.com/566810106808145/) help.instagram.com
2. [How you can use a backup code on Instagram (Instagram Help Center)](https://help.instagram.com/1006568999411025/) help.instagram.com
3. [View your recent Instagram login activity (Instagram Help Center)](https://help.instagram.com/2761108904184084/) help.instagram.com
4. [Turn login requests on or off on Instagram (Instagram Help Center)](https://help.instagram.com/154776793259282/) help.instagram.com
5. [Review recent emails sent from Instagram (Instagram Help Center)](https://help.instagram.com/760602221058803/) help.instagram.com

## Related guides

- [Hacked Instagram account: what to do, in the right order](https://getmyinstaback.com/guides/instagram-account-hacked/)
- [No access to your Instagram email or phone? How to prove the account is yours](https://getmyinstaback.com/guides/instagram-no-access-email-phone/)
- [Instagram recovery scams: how to tell a fake "recovery expert" from real help](https://getmyinstaback.com/guides/instagram-recovery-scams/)

## From the blog

- [Passkeys on Instagram: setting one up, signing in with it, and what to do when it fails](https://getmyinstaback.com/blog/instagram-passkey/)
- [Instagram backup codes: where they are, how to log in with one, and what to do without them](https://getmyinstaback.com/blog/instagram-backup-codes/)
- [Instagram says it suspects automated behavior on your account: the causes and the safe fix](https://getmyinstaback.com/blog/instagram-automated-behavior/)
- [An Instagram login alert you don't recognise: the first five minutes](https://getmyinstaback.com/blog/instagram-suspicious-login-attempt/)
- [Your Instagram is posting and messaging without you: how to take back control](https://getmyinstaback.com/blog/instagram-posting-without-you/)
- [Waiting for an Instagram code or reset email that never comes? Work through this](https://getmyinstaback.com/blog/instagram-code-not-received/)
- [Stuck on "Try again later"? What triggers Instagram's action block and how to clear it](https://getmyinstaback.com/blog/instagram-try-again-later/)
- [Phone gone, two-factor on: every way back into your Instagram](https://getmyinstaback.com/blog/instagram-two-factor-lost-phone/)

---

Other languages: [de](https://getmyinstaback.com/de/blog/instagram-sicherheits-checkliste/) · [fr](https://getmyinstaback.com/fr/blog/checklist-securite-instagram/) · [es](https://getmyinstaback.com/es/blog/lista-seguridad-instagram/) · [it](https://getmyinstaback.com/it/blog/checklist-sicurezza-instagram/) · [pt](https://getmyinstaback.com/pt/blog/lista-seguranca-instagram/) · [nl](https://getmyinstaback.com/nl/blog/instagram-beveiligingschecklist/) · [pl](https://getmyinstaback.com/pl/blog/lista-bezpieczenstwa-instagram/) · [sv](https://getmyinstaback.com/sv/blog/instagram-sakerhetschecklista/) · [da](https://getmyinstaback.com/da/blog/instagram-sikkerhedstjekliste/) · [nb](https://getmyinstaback.com/nb/blog/instagram-sikkerhetssjekkliste/) · [fi](https://getmyinstaback.com/fi/blog/instagram-tietoturvan-tarkistuslista/) · [cs](https://getmyinstaback.com/cs/blog/kontrolni-seznam-zabezpeceni-instagramu/) · [sk](https://getmyinstaback.com/sk/blog/kontrolny-zoznam-zabezpecenia-instagramu/) · [hu](https://getmyinstaback.com/hu/blog/instagram-biztonsagi-ellenorzolista/) · [ro](https://getmyinstaback.com/ro/blog/lista-securitate-instagram/) · [bg](https://getmyinstaback.com/bg/blog/kontrolen-spisak-sigurnost-instagram/) · [el](https://getmyinstaback.com/el/blog/lista-asfaleias-instagram/) · [hr](https://getmyinstaback.com/hr/blog/sigurnosni-popis-instagram/) · [sl](https://getmyinstaback.com/sl/blog/varnostni-seznam-instagram/) · [lt](https://getmyinstaback.com/lt/blog/instagram-saugos-kontrolinis-sarasas/) · [lv](https://getmyinstaback.com/lv/blog/instagram-drosibas-kontrolsaraksts/) · [et](https://getmyinstaback.com/et/blog/instagrami-turvalisuse-kontrollnimekiri/) · [tr](https://getmyinstaback.com/tr/blog/instagram-guvenlik-kontrol-listesi/) · [uk](https://getmyinstaback.com/uk/blog/kontrolnyi-spysok-bezpeky-instagram/)

HTML version: https://getmyinstaback.com/blog/instagram-account-security-checklist/