An account with an audience took years to build and can be lost in an afternoon. The measures that prevent it are dull, quick, and almost always postponed.
Two-factor, and which kind
Turn it on everywhere. But the method matters: SMS codes are better than nothing and are the weakest option, because a phone number can be moved to someone else’s SIM. An authenticator app is the sensible default; a hardware key is better still if the account is the business.
The part that gets skipped
- Save the backup codes somewhere that is not the phone with the authenticator on it
- Check the recovery email is one you still control — not a work address at a company you left
- Add a second admin on Pages and channels, so one lost phone is not the end of it
- Know where the account-recovery flow is before you need it, when you can still read calmly
Recovery is a thing you set up in advance or a thing you wish you had. There is no third state.
The threat that actually happens
Not a sophisticated attack. A message offering a collaboration, a link to a “brand portal”, a login page that looks right, and a password typed into it. Everything else follows from that one moment.
The rule that survives every variation: never enter a password on a page you arrived at from a link. Go to the app or type the address yourself. It costs ten seconds and defeats the entire category.
Where a scheduler fits
It should hold a revocable token, not a password, and it should never ask for one. A tool that wants your actual login credentials is asking you to hand over the account itself.