How Do I Get My Hacked Facebook Business Page Back?

Short answer: go fix your personal Facebook profile first, before you touch anything else. Business Pages don't have their own login. They're controlled by personal profiles, so if someone got into your Page it's because they got into a profile that had admin access to it. Start at facebook.com/hacked, get your profile locked back down, then go into the Page and rip out whoever they added.

If you've already been removed as an admin completely, that's a different and slower road, and I'll get to it below. But do the profile step first either way. Chasing the Page while your profile is still wide open is how people get locked out a second time an hour later.

What do I do in the first ten minutes?

Move fast and in this order.

Go to facebook.com/hacked from a device you've logged in from before. That matters. Facebook trusts a familiar phone or laptop far more than a brand new one, and the recovery flow gets noticeably easier on a device it recognizes. Change your password to something you have never used anywhere else. Then go into Security and Login and look at where you're logged in. Log out every session you don't recognize, all of them, including the ones in cities you've never been to.

Now check the email address and phone number on the account. Attackers change these first so the reset links come to them instead of you. If yours got swapped, change it back. Turn on two factor authentication while you're in there, and use an authenticator app instead of text messages if you have the option.

Then, and only then, go to the Page. Open Meta Business Suite, find the people and access settings, and remove every admin you didn't put there yourself. Look at Business Manager too, because a lot of these takeovers work by quietly adding the Page to a business portfolio you've never heard of.

What about my ad account?

Go handle this right now if you run ads, because it's the piece that actually costs real money while you're busy dealing with everything else.

Pause every active campaign. Then pull the payment method off the ad account entirely. The whole point of most Page takeovers is running scam ads on somebody else's credit card, and a hijacked account can burn through a few thousand dollars over a weekend before anybody notices. If charges already hit, call your bank and dispute them, and don't wait on Meta to sort it out for you first. I wrote up the related mess of a locked ad account in why your Facebook ad account got disabled.

How did they get in if I never gave out my password?

You almost certainly did, you just didn't know it at the time.

The scam that gets local businesses is a fake policy violation notice. You get an email or a Messenger message saying your Page violated community standards and will be permanently deleted in 24 hours unless you appeal. There's a link. The link opens something that looks exactly like a Facebook login screen, right down to the fonts and the little blue button. You type your email and password because you're panicking about losing your Page, and that's it. They're in.

These have gotten good. The grammar is clean now, they use your real Page name, and some of them come from an actual facebookmail.com address, which is the part that gets people who consider themselves careful. Bitdefender tracked one campaign that pushed more than forty thousand of these emails.

So here's the rule that solves it forever: never log into Facebook from a link in a message. Not one time. If you get a scary notice about your Page, close it, open the app or type facebook.com yourself, and go look at your Support Inbox and Page Quality tab. Real enforcement always shows up in there. If those are empty, the message was fake. And Meta doesn't give you a 24 hour countdown to hand over a password.

What if I've been removed as an admin completely?

This is the bad version, and I want to be straight with you about it. When you're not on the Page in any role, you can't remove anybody, you can't change anything, and there's no button that just gives it back.

First, check whether anyone else at your business still has access. An old employee, your spouse, the guy who built your website four years ago. If any of them are still listed as an admin, you're in luck, because they can add you back in about thirty seconds and you can skip the whole support process.

If nobody's left, you're filing with Meta. Start at business.facebook.com/help and look for the Page access and ownership options. You'll be asked to prove the business is yours, so have your documents ready before you start: a business license or registration, a utility bill or bank statement with the business name and address, and your photo ID. Meta may also ask you to verify your identity with a short video selfie, where you turn your head side to side and it gets matched against your profile photos.

One more thing that helps: if the Page is attached to a domain you own, verifying that domain in Business Manager is real evidence of ownership and it strengthens your case.

Will Meta actually help me?

Sometimes, and slower than you want.

People do get their Pages back through this process. But there's no phone number to call, no rep assigned to you, and the first few replies you get will be automated. Reports of a few business days are common for simpler cases. Full ownership disputes routinely run much longer. Anybody promising you a specific turnaround is guessing.

What actually moves the needle is submitting complete documents the first time and not spamming duplicate cases. Opening six tickets doesn't get you six chances, it just makes a messier file for whoever eventually reads it. File once, respond quickly when they ask for something, and keep every case number.

And be careful who you accept help from during this. The comment sections under every "my page got hacked" post are full of accounts offering to recover it for a fee. Those are the same people, or their friends. A real agency will never ask for your password.

Should I just start a new Page?

Give recovery an honest shot first. A new Page means starting over on followers, and worse, you lose your reviews and your check-in history, and those are hard to rebuild.

That said, don't let a dead Page keep you off social media for six months while you wait. If you're weeks in with nothing but automated replies, put up a new Page and start posting again while the case sits open. You can always merge or redirect later if the old one comes back. Being invisible costs you more than starting over does.

If your Page vanished from search but wasn't hacked, that's usually a totally different problem, and I went through it in why your Facebook page is unpublished.

How do I make sure this never happens again?

Two factor on every profile that has admin access to the Page, not just yours. You're only as protected as your least careful admin, and that part-time kid who posts your specials is a way easier target than you are.

Then go clean out your admin list. Most small businesses have two or three people on there who left years ago. Every one of those is another door. Do it once a quarter, it takes five minutes.

Give people the smallest role that lets them do their job. Somebody who writes captions needs an editor or content role, not full admin. Admin can delete the Page and remove you. Almost nobody needs that.

Last one, and people hate this: your business Page should not be hanging off a single personal profile. Set up a Business Manager portfolio, put the Page inside it, and add at least two admins on separate accounts with separate emails. That way one person getting phished doesn't take the whole thing down.

If you want somebody to just handle your Facebook presence and keep the security side buttoned up, that's the kind of thing we do for local businesses around Northwest Ohio. Here's what that looks like on our social media management services page.

Common questions

How long does it take to get a hacked Facebook page back?
If your personal profile is the only thing that got compromised and you catch it fast, you can be back in within the hour. If you were fully removed as an admin and have to go through Meta support, plan on several business days at minimum, and it can stretch a lot longer than that. Nobody can promise you a date.

Should I just make a new Facebook page instead?
Not right away. You'd lose your reviews, your followers, your check-ins, and any ad history tied to that Page. Give the recovery process a real shot first. If you're months in with no movement, then a new Page is a reasonable fallback, but treat it as the last option.

Can the hacker spend money on my ad account?
Yes, and this is the part that actually costs you. If your Page is attached to an ad account with a card on file, go pause every active campaign and remove the payment method as soon as you have access. Call your bank if charges already went through.

How did they get in if I never gave anyone my password?
Almost always a fake policy violation notice. You get an email or a Messenger note saying your Page is about to be deleted, you click through to a login screen that looks exactly like Facebook, and you type your password into it. Some of these even arrive from a real facebookmail.com address, which is why smart people fall for them.

Will two factor authentication actually stop this?
It stops most of it. Use an authenticator app rather than text messages if you can, since SMS codes can be intercepted. It won't help if you hand over a live code on a phishing page, so the habit of never logging in from a link matters just as much as the setting does.

← Back to all posts