Social Media Privacy Settings: A Practical Safety Checklist

Most privacy tools on social platforms sit in a settings menu that few people open after the day they sign up. A short review can reduce how much strangers can see about you, who can contact you, and how easily someone can gather details to use against you. It cannot make you invisible, and it cannot stop a determined person from posting about you, but it does shrink the surface they have to work with.

The steps below are deliberately platform-neutral, because menus and names change often. Look for the equivalent option in each app you use.

Why privacy settings matter if you are being targeted

People who harass others online often start with whatever is easy to reach: a public profile, a list of friends, a photo with a recognisable street in the background. The more that is visible, the more material there is to misuse. If you are already being trolled, the page on what to do if you are being trolled covers the immediate steps. This page is about reducing exposure before and during a bad patch, and about understanding how online abuse affects wellbeing so that you take the practical side seriously.

A ten-minute review routine

Set a timer and work through these in order.

1. Audience for new posts. Choose a default such as friends or followers only, instead of public. Check the setting for older posts as well; many apps have a bulk option to limit past posts.
2. Who can find and message you. Restrict who can send you direct messages, friend requests or follow requests. Filters that move messages from strangers into a separate folder are useful.
3. Tags and mentions. Turn on approval before tags appear on your profile, and limit who can mention you.
4. Location. Switch off precise location sharing for the app and for photos. Photos can carry location data, so check the camera and upload options too.
5. Contact details and personal fields. Remove or hide phone number, email address, birthday, workplace and school from your public profile.
6. Connected apps. Review third-party apps and games that have access to your account and remove those you no longer use.
7. Search visibility. If the platform lets you, stop your profile from appearing in search engines.
8. Comment controls. Use word filters, limit replies to people you follow, or hold comments for approval when a post attracts unwanted attention.

Lock down the account itself

Privacy settings protect what others see; security settings protect against someone taking over the account.

• Use multi-factor authentication. CISA describes multi-factor authentication as requiring two or more separate factors, such as something you know, have or are, before an account is opened. It lists email, financial services, social media, online shops and gaming or streaming services as accounts where it should be switched on, and says that “any MFA is better than no MFA”. It calls phishing-resistant authentication the top tier, so where a platform offers a choice, pick the strongest option available rather than the weakest.
• Use a unique password for each account, ideally kept in a password manager.
• Secure your email first. Anyone who controls your email can usually reset every other password.
• Check login alerts and active sessions now and then, and sign out of devices you do not recognise.

What not to share, even with tight settings

Settings are not a promise of secrecy. Friends can screenshot, groups can grow, and rules can change. Think twice before posting:

• your home address, or photos that show it, a school badge or a regular route
• travel plans while you are away
• identity documents, boarding passes or tickets with barcodes
• other people’s private information, including children
• anything you would be unhappy to see quoted out of context

The safest habit is to treat every post as something that could be seen by people you did not intend.

Check what the outside world can see

Log out, or open a private window, and search for your own name and usernames. Look at what appears on the first couple of pages of results. If you find private details on a site you do not control, many sites have a removal request process, and search engines also offer tools to request removal of certain personal information. Results vary, so keep expectations modest.

Also ask friends and family to review their own settings. Details about you can leak through tagged group photos or a relative’s public profile.

Keep a calm, regular habit

Platforms change their defaults and add features without much notice, so repeat the review a few times a year. Put it in your calendar. If a new feature appears, such as a location map or a “suggested friends” function, check its default before you start using it.

If an account has already been compromised, secure your email, change passwords from a trusted device, and use the platform’s account recovery tools. If you are worried about your safety or feel overwhelmed, speak to someone you trust or a qualified professional. For ideas on helping a friend through this, see the page on supporting someone who is being targeted online.

Frequently asked questions

Does a private account stop trolls?

It stops strangers from seeing your posts and reduces unsolicited contact, but approved followers can still share screenshots. Be selective about who you approve.

Should I delete old posts?

It can help if old posts reveal personal details, but it is not required. Limiting the audience of past posts or archiving them can be a middle option. Keep any evidence of abuse before deleting anything related to it.

Are privacy settings the same on every platform?

No. Names, defaults and options differ, and they change over time, so review each app separately and check its help pages.

Is text-message verification safe enough?

It is better than a password alone. CISA describes phishing-resistant authentication as the top tier and says any multi-factor method is better than none, so use the strongest option the platform offers.