Keeping a bought X (Twitter) account safe
The first hour with a bought account decides more than any setting. An account that changes owner, password, mail address, device and behaviour all at once looks, from X's side, like an account that has been taken over — because it has. This checklist is the order we recommend, based on what we see with the accounts we sell. None of it is an official X rule; it is what, in our experience, keeps accounts working.
1. Test the login before you change anything
Reveal the account on your Orders page and log in straight away, with the cookies or the password (how to do either). If the details do not work, stop there and report it to support with the order number, within 24 hours of revealing it. Accounts whose details were invalid at delivery are replaced or refunded to your balance; accounts that stopped working after they were changed are not — so test first.
Keep the original line somewhere safe — a password manager, or the .txt file from your order — until you have finished the steps below.
2. Change the password
In the account's settings on X, set a new password of your own; X asks for the current one, which is on your line. In our experience a password change can end the account's other sessions, the delivered auth_token included. That works in your favour here: whoever held the old session loses it. Sign in again with the new password and keep that session.
3. Put your own mail address on it
The mail field on your line is the address (or phone number) the account is registered to, not access to that mailbox. Password resets and security codes go there, so replace it in the account settings with an address you control and confirm the code X sends to it. If the account is registered to a phone number, add your own address all the same.
Once the account answers to your mail and your password, turn on two-factor authentication with an authenticator app.
4. Keep the cookies — and the browser
A signed-in session is worth keeping. Use one browser profile per account and stay signed in rather than logging out and back in every day; each fresh login from a new place is one more thing for X to check. If you drive the account with a tool, export the new ct0 and auth_token from your session and store them like a password.
5. Go slowly for the first days
Avoid instant mass actions. In our experience the accounts that get locked are the ones that, on the first day, follow hundreds of profiles, send the same message to many people, or post the same link again and again. A believable first week looks like this:
- Day one: log in, make the changes above, look around, like a few posts.
- The next days: post a little, reply, follow a handful of accounts that fit the profile.
- After that, raise the pace gradually, and change the name, picture and bio one at a time rather than all together.
6. Proxy and IP hygiene
- One IP per account, and keep it. Logging the same account in from a different country every session is a classic trigger for a verification prompt.
- Do not crowd accounts on one IP. Several accounts acting at the same moment from one address look linked, because they are.
- Prefer residential or mobile addresses. In our experience datacenter IPs draw more checks.
- Keep the browser consistent. The same profile, language and time zone each time, matching the IP's region where you can.
If X does ask you to verify something, answer the prompt calmly from the same browser and IP instead of hopping to another one. Bought from the No shadowbanned accounts shelf? These habits are also what keeps that result intact — see what the shadowban check means.
Frequently asked questions
Should I change the password straight away?
Test the login first, then change it. A test takes a minute and keeps you inside the 24-hour window in which an account whose details did not work at delivery is replaced or refunded.
Why was I signed out after changing the password?
In our experience a password change can end the account's other sessions, including the one the delivered cookies belonged to. Sign in with the new password and keep that new session.
Can I run several accounts from one IP?
We advise against it. Accounts that share an address and act at the same time look connected. Give each account its own stable IP and its own browser profile.