A private profile creates the feeling that you cannot be seen. In practice some data stays public regardless, and the main leak happens not through settings but through the content of posts: what you told people yourself becomes the answer to a security question.
What stays visible on a private profile
- Your name and profile picture. They cannot be hidden — they are how people find you.
- The fact that an account exists for a given phone number, if lookup by number is enabled.
- Comments in public groups. The profile is closed but the comment is visible to everyone.
- Tags in other people's photos, if their profile is open.
- Old posts indexed before the profile was closed.
Settings worth changing
| Setting | What it affects | Recommendation |
|---|---|---|
| Lookup by phone number | Links your number to your profile | Disable or restrict to friends |
| Who sees your friends list | A list of relatives is material for the “mum, I'm in trouble” scheme | Friends only |
| Geotags on posts | They reveal your home address and daily routine | Disable, especially on photos taken at home |
| Date of birth | Half the answer to a security question | Hide the year, or the date entirely |
| Active sessions | Shows sign-ins that are not yours | Review every couple of months |
| Third-party apps | Access granted long ago and forgotten | Revoke everything unfamiliar |
What actually protects the account
A feeling of safety
- A private profile
- A hidden friends list
- Deleting old posts
- Turning off geotags
Real protection
- A unique, long password
- A second factor by app
- Checking the address before typing a password
- Current recovery contacts
The left column is not useless — it reduces what is known about you. But accounts are taken through the right one, and that is where to start.
A ten-minute review
A hijacked social account is most often used to message the owner's contacts — what that looks like from the receiving end is covered in messenger scams.