Keep your page yours

Authenticator app codes

Turn on two-factor login in Settings and scan the QR code with any authenticator app: 1Password, Google Authenticator, Authy, Apple Passwords and others that support standard time-based codes. From then on, signing in needs your password and a six-digit code.

Each code works once, so a code someone watched you type cannot be reused. Too many wrong codes lock code entry on your account for a while, whichever device they come from.

Ten recovery codes

When you turn it on, you get ten single-use recovery codes. Store them in a password manager or print them. If you lose your phone, one recovery code gets you in. You can generate a fresh set at any time, which cancels the old ones.

Your authenticator secret is encrypted at rest.

See and end sessions

Settings lists the browsers signed in to your account, with when they were last used. Sign out any one of them, or sign out everywhere at once if you think something is off. Resetting your password signs out every session too.

Combined with two-factor login, that covers the common ways accounts get taken over.

Why it matters for a link in bio

A hijacked link in bio is a quiet attack: someone swaps your project links for scams, and your followers trust them because they came from you. Revenue connections deserve protection too, even though they are read-only.

Two-factor login is available on every plan, free included. See verified revenue for how keys are stored.