A Facebook or Instagram account can hold years of project photos, customer conversations and access to your business Page. Losing access can disrupt enquiries as well as marketing, so account security belongs in the same routine as protecting keys and customer records.
Meta recommends unique passwords and warns businesses not to share passwords with people who need Page access. Its business tools let you assign people to specific assets, and it provides a setting to require two-factor authentication for people using a business portfolio.
Secure the individual logins
- Use a unique password for each account; do not reuse your email password.
- Turn on two-factor authentication for every person with business access.
- Keep recovery email addresses and phone numbers current.
- Store backup codes in a secure place that is not the phone being protected.
- Remove access when a staff member or contractor leaves.
If an unexpected message claims that your Page will be deleted or asks you to sign in through a link, do not enter your password from that message. Open Meta's app or website directly and check account notifications there.
Limit who can change the business
Give people the minimum permissions they need. Someone who only drafts posts may not need full control of the business portfolio, ad account or billing. Review access periodically and after every staffing or agency change.
Keep a short record of who is responsible for the main business email, phone number and recovery method. Avoid making a contractor the only person with full control.
If you suspect access was lost
Use Meta's official recovery flow from a trusted device, secure the email account linked to the profile, review active sessions and remove unknown people or assets. Tell colleagues not to follow suspicious messages sent from the compromised account.
Read Meta's two-factor authentication guidance for business portfolios and its business account scam-protection lesson. For safe delegation, see our guide to giving staff or an agency Page access.