X (formerly Twitter) Privacy & Security Guide 2026
X is fast-moving and highly public. Geo-tagged posts, reply patterns, and follower lists are all OSINT goldmines.
Start with discoverability rather than the padlock: disable Discoverability by email and by phone number, because those two turn a leaked address into your handle in a single step. Then turn on Protect your posts, switch Photo tagging off entirely, and work back through old posts that name a workplace or a neighbourhood.
Key steps to lock down X (formerly Twitter) in 2026
- Profile → Settings and privacy → Privacy and safety.
- Turn on Protect your posts.
- Set Who can message you to People you follow.
- Enable sensitive media marking and hide sensitive content.
- Turn off Photo tagging entirely.
- Disable Discoverability by email and by phone number.
- Audit and delete old tweets that reference location, employer, or family.
- Enable two-factor authentication via an authenticator app.
Quick checklist
- Profile visibility: Private or friends-only
- Search engine indexing: Off
- Location sharing: Off
- Two-factor authentication: Enabled (authenticator app, not SMS)
- Data partner sharing / personalized ads: Off
- Linked apps + sessions: Audited and revoked where unfamiliar
Why these settings still aren't enough
Even with every X (formerly Twitter) setting locked down, your data still leaks through three channels these settings can't reach: historical exposures already in breach corpora, third-party scrapers that mirrored your old public data, and people-search aggregators that re-list your details every time you remove them. That's where continuous external monitoring becomes essential.
How Warden extends your X (formerly Twitter) privacy
Warden by GalaxyWarden monitors X usernames and linked data across breach corpora, including the 2022 Twitter API leak (5.4M records).
Run a free Warden scan to see exactly what is exposed about you across every platform — not just X (formerly Twitter).
