Apps Connected to Your Facebook and Twitter Accounts

Permissions nobody remembers giving

Every contest tool, scheduler and analytics service a business has tried on Facebook or Twitter asked for permission first. A box said the app wanted to post on your behalf, and someone clicked allow.

The contest ended in 2012. The scheduler was replaced. The quiz was a one-week fad. The permissions stayed.

A connected app can keep doing what it was allowed to do for as long as it stays connected. If the company behind it is broken into, or sold to someone with other plans, that access goes with it.

Most owners have never looked at the list.

What tends to be connected

• Contest and giveaway tools from campaigns long finished.
• Scheduling services tried for a month and dropped.
• Quiz and game apps someone played while signed in.
• Follower and analytics tools that promised insights.
• Cross-posting tools that copy one network to another.
• Anything a former agency or student set up.

The fifth is the one most likely to be running still. A tool that copies every new post or listing onto Twitter keeps working quietly, and nobody checks what it publishes.

Why an old app matters

An app with permission to post can publish whatever its owner sends through it: links to spam, fake offers, messages to your followers.

Many of these permissions last until someone removes them. Changing the account password does not always cut them off, because the app was never using the password.

Followers see the spam under your business's name. Some report it, some unfollow, and the platform may restrict the account while it looks into what happened.

On Facebook, check the people too

A Facebook page is run through the personal accounts of its admins. An app connected to an admin's own profile, with permission to manage pages, can post as the business.

So every admin needs to open their own account settings, look under apps, and remove anything they do not use for the page. Checking the page alone misses most of it.

Then look at the page itself for contest tabs and apps added years ago, and at the list of people with page roles.

On Twitter, one list

Twitter keeps it simpler. The apps section of the account settings lists every connected app with its access: read only, read and write, or read, write and direct messages.

Each has a button to revoke access. Anything that can read your direct messages deserves particular scrutiny, since customers sometimes send order details or phone numbers that way.

Revoking takes one click, and an app that turns out to be needed can be connected again in a minute.

A worked example

A sports card shop in a strip mall sells packs, boxes and single cards, buys collections, and posts new arrivals and trade night photographs on Facebook and Twitter most days.

Over five years its accounts had picked up a giveaway app, two schedulers, a tool that tweeted every new online auction listing, a quiz someone played while signed in, and an app that reported who had unfollowed.

One morning the Twitter account sent dozens of followers a direct message with a link to a diet pill site. The password had not changed, and nobody had signed in from anywhere unusual.

The unfollow tracker, unused for two years, still had read, write and direct message access. The service had changed hands, and its access was being used to send spam.

The owner revoked every app on Twitter, then each page admin cleared the apps on their own Facebook profile. Only the current scheduler went back on, after a look at what it asked for.

Passwords changed anyway, login verification went on, and a short apology went out to followers explaining the messages.

Signs that something is posting for you

Most owners find out from a customer: a message asking why the shop sent them a strange link, or a comment under a post nobody remembers writing.

Look at the account's own activity now and then, not just the home feed. Posts and messages nobody sent, apps nobody recognises and followers mentioning spam all point back to the same list.

Passwords and login verification

Removing apps closes one door. A changed password closes another, in case someone has it directly.

Twitter calls its two-step check login verification, and Facebook calls it login approvals. Either sends a code to a phone when someone signs in from a new device, which makes a stolen password far less useful on its own.

The short list

Write down what stays: the app, the account, what it can do, who added it, when and why. A page in a shared document is enough.

Review it every few months and whenever someone who handled the accounts leaves.

Instagram, LinkedIn and Google accounts keep similar lists of connected apps, and deserve the same look.

Before you allow the next one

The permission screen says what the app wants: to read your posts, to post as you, to read your messages, to manage your pages. Read it before clicking allow.

Ask whether the job needs that much. A tool that only reports on followers has no reason to post, and a scheduler has no reason to read direct messages.

Connect it from the account of the person who will actually use it, and add it to the list the same day.

The counter-case

A business with one account and no apps ever added has little to clean up. And some connected tools earn their place: the scheduler that runs your posting calendar should stay.

Removing an app can also break something useful, such as the tool that shares each new blog article automatically. Check what each one does before revoking it, and note it on the list.

The point is to know what can post as your business. Remove what nobody uses, and keep the list current.

Clearing the old apps

1. Open the Twitter apps settings and read the list.
2. Revoke anything nobody uses now.
3. Ask every Facebook admin to check their own apps.
4. Remove old contest tabs from the page.
5. Change passwords and turn on two-step checks.
6. Write down the apps that stay.
7. Repeat the check whenever someone leaves.

Step three is the one most businesses miss. The page settings look tidy while an admin's personal account quietly carries apps that can post as the business.

Who holds the logins in the first place is covered in the summer student who runs the Facebook page.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.