# Best practices for security

# Best practices for making a business portfolio more secure

<div id="bkmrk-best-practices-for-m"><div id="bkmrk-best-practices-for-m-1"><div><div>## Best practices for making a business portfolio more secure

</div></div></div><div id="bkmrk-to-help-keep-your-bu"><div><div><div><div><div id="bkmrk-to-help-keep-your-bu-1"><div><div>To help keep your business portfolio secure and protect your business and accounts from bad actors or unauthorized activity, follow these best practices and recommendations.

</div><div><div>### Security Center recommendations

</div>If you have full control of the business portfolio, you can go to the [Security Center](https://business.facebook.com/settings/security) to see if you’ve been urged to take action on any of the following security improvements. You can also track the progress of completing these recommended tasks.

**Remove inactive users**

Bad actors often target inactive accounts in an effort to gain access to a business portfolio. Remove people who haven't logged into the portfolio within the past 90 days, especially those with full control of the portfolio. [Learn more about how to remove people from your business portfolio.](/business/help/353397428740939)

**Close or remove inactive ad accounts**

Bad actors are more likely to target ad accounts that haven’t run ads within the last year. Close or remove ad accounts you no longer need. **Note**: Ad accounts can’t be deleted from the portfolio. [Learn more about how to close an ad account that's in a business portfolio.](/business/help/190760004667059)

**Remove users without two-factor authentication**

People who don’t have two-factor authentication set up pose a security risk. Remove them from the portfolio until they have set it up using their Facebook account.

**Remove users with public email domains**

Bad actors often use public email domains to create email addresses anyone can get in order to gain access to a business portfolio. Remove users whose email addresses aren’t related to your business.

**Limit number of users with full control of the business portfolio**

Having too many users with full control of the business portfolio may pose a security risk. Limit full control to only those who need it, ideally 10 or fewer people.

[Learn more about how to change people’s access to a business portfolio.](/business/help/299504287548592)

**Add another review of your ads with peer approval**

Bad actors often run unauthorized ads, and these ads may be published without requiring a peer review. To require a review by a trusted user before ads are published, set up ad account and domain security in peer approval.

[Learn more about how to add a second review with peer approval ](/business/help/529947753306370)

**Remove users detected with possible malware**

Malware is malicious software that could lead to harmful activity in a business portfolio. Remove people from the portfolio who may have malware on one of their devices.

[Learn more about protecting your accounts from malware.](/help/773912954219636)

**Review shared credit lines with suspicious activity**

Bad actors may gain access to shared credit lines to run their own ads. Review your credit lines and the businesses they’re shared with. Remove any that have suspicious or unauthorized activity.

[Learn more about billing and payments.](/business/help/475130714076592)

</div><div><div>### Other recommendations

</div>Here are some additional actions you can take to help make your business portfolio more secure.

**Set up passkeys**

Set up passkeys for every Facebook user in your business portfolio, particularly admins. Passkeys are a stronger, more secure two-factor authentication method than SMS codes, helping protect access to your portfolio settings.

[Learn more about how to create a passkey to access your portfolio settings.](/business/help/910360017835904)

**Avoid two-factor authentication issues**

To avoid login issues with two-factor authentication:

- <div>Use an [authenticator app](/help/358336074294704). Remember to back up your authenticator app in case you lose access to, or switch, your device.</div>
- <div>Set up multiple methods, including saving your [recovery codes](/help/148104135383285). This way you can still access your business portfolio, even if you lose one of the recovery methods.</div>
- <div>[Update your phone number](/help/1756727521321961) in your Facebook account settings after changing your mobile phone number to make sure you can receive security codes by text message or SMS.</div>

[Learn more about how two-factor authentication works on Facebook.](/help/148233965247823/)

**Make sure 2 people have full control of the business portfolio**

It’s recommended (but not required) that 2 active people have full control of a business portfolio. Also known as “second admin approval,” this provides additional security by adding a second layer of approval to sensitive actions, such as requests to share credit lines or change the access of someone with full control of the portfolio.

Having more than one person with full control also ensures someone else has top-level access to the portfolio in the event that one of your accounts or business assets shows suspicious activity.

[Learn more about how to change people’s access to a business portfolio.](/business/help/299504287548592)

**Report suspicious or unauthorized activity**

If you notice suspicious or unauthorized activity, [contact our support team](https://www.facebook.com/business-support-home/contact-support?source=bmc_article_entrypoint).

**Audit people’s level of access**

Perform an audit of people in your portfolio to make sure they don’t have more permissions than they need. People with full control of the portfolio can export a file with users’ permissions from the **People** tab in Meta Business Suite's [**Settings**](https://business.facebook.com/latest/settings). You’ll also find information on when they were last active and whether they have two-factor authentication turned on. **Note:** People who have been invited to join your portfolio but have not yet accepted are not included in this report.

[Learn more about how to download people permissions.](/business/help/996373447409365)

**Monitor business portfolio activity**

Review your [business history](/business/help/2512887368958412), a file of important events that occurred in your portfolio, to look for any unauthorized activity, such as changes to portfolio details, business assets and people. You can download your business history from the **People** tab or **Business info** tab in Meta Business Suite's [**Settings**](https://business.facebook.com/latest/settings).

[Learn more about how to download your business history.](/business/help/996373447409365)

</div></div></div><div><section><div id="bkmrk-common-support-topic"><div><div><div>![]()<span>###### Common support topics

</span></div><div><div><div><span>[About advertising restrictions](/business/help/975570072950669)</span></div><span>###### Business Help Center

</span></div><div><span>![]()</span></div></div><div><div><div><span>[Troubleshoot a disabled or restricted account](/business/help/422289316306981)</span></div><span>###### Business Help Center

</span></div><div><span>![]()</span></div></div><div><div><div><span>[About Meta Business Support Home](/business/help/254088759757736)</span></div><span>###### Business Help Center

</span></div><div><span>![]()</span></div></div><div><div><div><span>[Fix a failed payment issue on Meta](/business/help/268196136699959)</span></div><span>###### Business Help Center

</span></div><div><span>![]()</span></div></div><div>[![]()](#bkmrk-business-help-center-3)</div></div></div></div></section></div></div></div></div></div></div></div>

# Turn on the two-factor authentication requirement in your business portfolio

<div id="bkmrk-turn-on-the-two-fact"><div id="bkmrk-turn-on-the-two-fact-1"><div><div>## Turn on the two-factor authentication requirement in your business portfolio

</div></div></div><div id="bkmrk-two-factor-authentic"><div><div><div><div><div id="bkmrk-two-factor-authentic-1"><div>Two-factor authentication can help protect your account from unauthorized access.

If you created your business portfolio less than 90 days ago, you can choose to require two-factor authentication for people in your account.

If two-factor authentication is required for your business portfolio, people must also turn on two-factor authentication to access the business portfolio. **Note:** For security reasons, turning on two-factor authentication is required for certain business portfolios that are more than 90 days old.

You can share this article with people in your business portfolio for directions on how[ to turn on two-factor authentication for Facebook accounts](/help/148233965247823).

<div>### Before you begin

</div>Only people with full control of the business portfolio can turn on the two-factor authentication requirement.

<div>### Turn on the two-factor authentication requirement 

</div>1. Go to [**Settings**](https://business.facebook.com/latest/settings) in Meta Business Suite.
2. Click **Business portfolio info**.
3. Scroll down to **Business options.**
4. Click the dropdown menu next to **Two-factor authentication**.
5. Select **Admins only** or **Everyone** to choose who this requirement applies to. To turn off two-factor authentication requirement, choose **No one**.

After you turn on the two-factor authentication requirement, Meta needs to remember your computer and browser info so we recognize it next time you log in. Some browser features block this. If you've turned on private browsing or set up your browser to clear your history every time it closes, you might have to enter a code every time you log in. If you use a third-party app to manage the Pages or ad accounts in your business portfolio, you’ll be asked to enter a login code the next time you sign in from the app.

If you've turned on two-factor authentication requirement and get a prompt to enter a code for security purposes, you can generate one from your phone. Learn how to [receive a code for two-factor authentication](/help/132694786861712/).

</div></div><div id="bkmrk-basicsabout-security"><div><div><div><div><div><div><div><div><div><div id="bkmrk-basicsabout-security-1"><div><div>[<div><div><div><div>#### Basics

</div></div></div></div>](#bkmrk-set-up-1)</div><div id="bkmrk-about-security-cente"><div>[About Security Center](/business/help/216940652189296)[About brand safety in Meta Business Suite ](/business/help/2086293468348582)[About domain verification in Meta Business Suite ](/business/help/286768115176155)[Permissions for block lists](/business/help/2529752777040791)</div></div></div></div></div></div></div></div></div><div><div><div><div><div><div id="bkmrk-set-upmanage-publish"><div><div>[<div><div><div><div>#### Set Up

</div></div></div></div>](#bkmrk-set-up-1)</div><div id="bkmrk-manage-publisher-blo"><div>[Manage publisher block lists](/business/help/315497702388979)[Turn on the two-factor authentication requirement in your business portfolio](/business/help/280940009201586)[Receive a code for two-factor authentication on Facebook](/business/help/2098272590487298)</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>

# Share your domain with a partner

<div id="bkmrk-share-your-domain-wi"><div id="bkmrk-share-your-domain-wi-1"><div><div>## Share your domain with a partner 

</div></div></div><div id="bkmrk-you-can-give-a-partn"><div><div><div><div><div id="bkmrk-you-can-give-a-partn-1"><div>You can give a partner access to your business’s domain in Meta Business Suite. Sharing your domain lets trusted partners run and manage ads for your business.

Sharing your domain doesn’t give your partner ownership of managing the domain. You can remove your partner’s access at any time.

<div><div>### Before you begin

</div>- <div>You must have a business portfolio</div>
- <div>The intended partner must have a business portfolio.</div>
- <div>You can only share a verified domain. Learn more about how to [verify your domain.](/business/help/321167023127050)</div>

</div><div><div>### Share your domain with a partner

</div>To share your domain with a partner's business portfolio in Meta Business Suite:

1. Go to [**Settings**](https://business.facebook.com/latest/settings) in Meta Business Suite.
2. Select the **Brand Safety** tab from the left navigation menu. Then select [**Domains**](https://business.facebook.com/settings/owned-domains).
3. Select the verified domain you want to share.
4. Click **Assign partner**.
5. Enter your partner’s business portfolio ID. The business portfolio ID can be found in the **Business Info** tab.
6. Select whether you’d like to give your partner **Partial access** or **Full control** of your domain.
7. Click **Next.**
8. Click **Done** to finish.

You should see your partner’s information under the **Partners** tab. You can stop sharing your domain with a partner at any time by clicking the trash icon and removing the partner.

</div><div><div>### Learn more

</div>- <div>[Manage ad link editing permissions](/business/help/1250224602025715)</div>

</div></div></div></div></div></div></div></div></div>

# About brand suitability on Meta platforms and Audience Network

<div id="bkmrk-about-brand-suitabil"><div id="bkmrk-about-brand-suitabil-1"><div><div>## About brand suitability on Meta platforms and Audience Network

</div></div></div><div id="bkmrk-brand-suitability-co"><div><div><div><div><div id="bkmrk-brand-suitability-co-1"><div>Brand suitability controls help advertisers control where ads are delivered on Meta platforms and Audience Network. You can use brand suitability controls to help you place ads adjacent to organic content and publishers that are suitable to your brand.

There are controls that can be applied to your entire ad account and to specific ad campaigns.

<div>###  Meta Community Standards

</div>Our goal is to create a safe and welcoming community for the more than 3 billion people who use Meta technologies around the world, across cultures and perspectives. To help achieve this goal, our [ Community Standards](https://l.facebook.com/l.php?u=https%3A%2F%2Ftransparency.meta.com%2Fpolicies%2Fcommunity-standards%2F&h=AT6EfOaxgIxQkJBCsBrhLYo538SK1_wTj0Gr8Z-l4YdYv5BPDISdiPV9F1c0VXSqNyIhnK6L6sXatVqvRKpq-0mxR7ayrT9c2ymDBchopyffFAxH4LeO2ZGTQbEUCZGxVYeOQ4qdpm1GGkj0z-znHw) define what content is and isn't allowed on our technologies. Our policies are based on feedback from our community and the advice of experts in fields such as technology, public safety and human rights.

We have around 40,000 people working on safety and security, which includes removing billions of fake accounts a year. We also invest in technology to reduce the spread of false news and help identify content that violates our policies—often before anyone sees it. And we routinely release the [Community Standards enforcement report](https://transparency.facebook.com/community-standards-enforcement) to track our progress to make [Facebook and Instagram](https://l.facebook.com/l.php?u=https%3A%2F%2Ftransparency.meta.com%2Fpolicies%2Fcommunity-standards%2F&h=AT7KwIsmEIwP_DKsFnEMPxzK2D-Spei0oEbdFmMoC8NwzPTPFwEQ_iUgz5czSb0b5naX9Wv_J347XUiU1g1qbM_yO8hJj202cljNe5dKEjN2x7GdTnzrrvNrfrI-hfrDqbrWVP1SnhT71l69mPSwqQ) safe and inclusive.

<div>###  Monetization Policies

</div>Community Standards apply to everyone and all content on Facebook and Instagram, we also have additional policies to hold creators and [publishers](/help/publisher/169845596919485) accountable. Our Partner Monetization Policies apply at the account level. Learn more about [Facebook’s Partner Monetization Policies](/business/help/169845596919485) and [Instagram’s Partner Monetization Policies](https://l.facebook.com/l.php?u=https%3A%2F%2Fhelp.instagram.com%2F512371932629820&h=AT7SI0bn0lKHJ9DSjQ7EoG95J1mm1AI8yKGv7NFYPnQ5F4E5MqTh7x0wiE3XfoKxzOJ1eDUp6N144MGTejIPnInRNEGiwK87yuDidj7QAjGzTOasleBOD1AXKfP2DvaJPKNSmZK-x9q-Hp3602zMiw). They include [rules](/business/help/185404538833362) for the content you create, how that content is shared, and how your account receives and makes online payments. Additionally, all content on Facebook and Instagram must comply with our Terms and Community Standards and Guidelines. However, content appropriate for Facebook and other Meta technologies isn't necessarily appropriate for monetization. This content has to follow our [Content Monetization Policies](/business/help/169845596919485)—they include prohibited formats, behaviors and restricted categories. This means that not all content on Facebook and Instagram is monetizable.

There are rigorous brand suitability controls, including publisher and content block lists, inventory filters, live stream exclusions and some recent tools that are both at the publisher and content level to allow advertisers greater control over where their ads may appear.

<div>###  Brand suitability controls

</div>Controls that allow you to manage brand suitability settings directly within the [Meta Brand Safety and Suitability Center](/brand_safety/overview). Learn more about our [brand suitability controls](/business/help/1926878614264962).

<div>### Learn more

</div>- <div>[Making platforms safer for brands and people](/business/good-questions/safety)</div>
- <div>[Best practices for brand suitability](/help/2116031745379221)</div>

<div><div>![](https://support.chatarchitect.com/uploads/images/gallery/2026-04/embedded-image-bgpb4l1k.webp)</div><div><div> Brand suitability controls, such as inventory filter, help you place ads adjacent to organic content that are suitable for your brand in certain ad placements. We define organic content as content posted without being promoted as an advertisement. </div></div></div></div></div><div id="bkmrk-basicsabout-brand-su"><div><div><div><div><div><div><div><div><div><div id="bkmrk-basicsabout-brand-su-1"><div><div>[<div><div><div><div>#### Basics

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-brand-suitabil-3"><div>[About brand suitability on Meta platforms and Audience Network](/business/help/1559334364175848)[Best practices for brand suitability](/business/help/2116031745379221)[About brand suitability controls and transparency tools](/business/help/1926878614264962)[Manage brand suitability controls within the Meta Brand Safety and Suitability Center from Meta Business Suite](/business/help/297590664193809)[About the publisher review process](/business/help/409950705796014)[About community content reviews](/business/help/373506759931554)[Request brand safety support](/business/help/815988365533261)[Use brand suitability controls on individual ads or on your whole ad account](/business/help/260992311471821)[Meta's brand safety description of methodology](/business/help/4360253257396424)[About Feed and In-content brand safety and suitability controls](/business/help/401717758239899)</div></div></div><div><div>[<div><div><div><div>#### Publisher List

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-partner-publis"><div>[About partner-publisher lists](/business/help/1382467665184382)[View or download partner-publisher lists](/business/help/1738245236284278)[Review partner-publisher lists](/business/help/449365955591474)</div></div></div><div><div>[<div><div><div><div>#### Block Lists

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-publisher-and-"><div>[About publisher and content block lists](/business/help/255483958155378)[Create a publisher block list in the Meta Brand Safety and Suitability Center](/business/help/1314478651899918)[Upload a publisher block list in the Meta Brand Safety and Suitability Center](/business/help/2106983649615547)[Apply a publisher block list in Meta Ads Manager](/business/help/775487392843817)[Apply a publisher block list in the Meta Brand Safety and Suitability Center](/business/help/427707251064766)[Best practices for publisher block list limit warnings](/business/help/176672796210945)[Best Practices For Block List Levels](/business/help/1380831305350871)[Share publisher block lists](/business/help/240346943246169)</div></div></div></div></div></div></div></div></div><div><div><div><div><div><div id="bkmrk-exclusionsabout-live"><div><div>[<div><div><div><div>#### Exclusions

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-live-video-exc"><div>[About live video exclusions](/business/help/316775769311120)[About content type exclusions](/business/help/238895801250217)[About topic exclusions ](/business/help/433829137593158)[Apply topic exclusions ](/business/help/393490178306457)[About content from nonpartner-publishers](/business/help/450249596293788)[Apply content type exclusions](/business/help/1123082561476516)</div></div></div><div><div>[<div><div><div><div>#### Inventory Filter

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-inventory-filt"><div>[About inventory filter](/business/help/3001448133206080)[Use inventory filter from the Meta Brand Safety and Suitability Center](/business/help/643079416901247)[Use inventory filter in Meta Ads Manager](/business/help/252190302162738)[Content inventory table: in-content placements](/business/help/468154293719742)[Content inventory table: Meta Audience Network](/business/help/2122368217844346)</div></div></div><div><div>[<div><div><div><div>#### Delivery Reports

</div></div></div></div>](#bkmrk-delivery-reports-1)</div><div id="bkmrk-about-delivery-repor"><div>[About delivery reports](/business/help/1547244292106324)[View delivery reports in the Meta Brand Safety and Suitability Center](/business/help/148229179267759)[Download delivery reports in Ads Manager](/business/help/143679106461925)[Review delivery reports](/business/help/602174603449509)[About approximate impressions](/business/help/522651758305671)</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>