Recovery

How to secure YouTube permissions after a hack

Once you're back inside your Google Account, here's how to strip out every permission the attacker touched and close the doors they came through.

Getting back into your Google Account is step one — but an attacker who had access may have added themselves as a Manager or Editor in YouTube Studio, connected a third-party app, or changed your recovery contact. This page covers the specific permission clean-up that follows a successful account recovery.

If your situation is actually …

Secure permissions after regaining access

Stage 1 · Stabilize

Lock down the Google Account immediately

  1. Change your Google Account password to something new and unique.
    Any active attacker session ends when the password changes.
    Where: myaccount.google.com/security
  2. Sign out all other devices from your Google Account security page.
    Forces every active session — including the attacker's — to re-authenticate.
    Where: myaccount.google.com/security → Your devices
  3. Check that your recovery email and recovery phone belong to you. Remove any you don't recognise.
    Where: myaccount.google.com/security → How you sign in
Stage 2 · Diagnose

Find what was changed

  1. Review recent security activity to see when and from where accounts changes were made.
    Where: myaccount.google.com/security → Recent security activity
  2. Open YouTube Studio Permissions and look for any Manager or Editor you did not add.
    Attackers often add themselves as Manager for persistent access even if you change the password.
    Where: studio.youtube.com → Settings → Permissions
  3. Check connected third-party apps for anything you do not recognise.
    Where: myaccount.google.com/permissions
Stage 3 · Reclaim

Remove attacker access from YouTube

  1. Remove every unrecognised Manager and Editor from YouTube Studio Permissions.
    A Manager seat persists independently of the Google Account password — you must revoke it explicitly.
    Where: studio.youtube.com → Settings → Permissions → three-dot menu → Remove
  2. Revoke access for any connected app you don't recognise or no longer use.
    Where: myaccount.google.com/permissions
  3. If the channel is on a Brand Account, check the Brand Account owners list and remove any you did not add.
    Brand Account ownership is separate from Studio roles — an attacker who reached this level has deeper access.
    Where: myaccount.google.com/brandaccounts → select channel → Manage permissions
Stage 4 · Harden

Close the doors that let this happen

  1. Enable 2-Step Verification with an authenticator app or a physical security key.
    SMS-based 2FA can be intercepted. An authenticator app or security key stops most takeover methods.
    Where: myaccount.google.com/security → 2-Step Verification
  2. Add a backup owner to your Brand Account so a future account compromise doesn't orphan the channel.
    If the owning Google Account is ever lost again and no other owner exists, even Managers cannot reclaim the channel.
  3. Save your Google Account backup codes somewhere offline and separate from your devices.
    Where: myaccount.google.com/security → 2-Step Verification → Backup codes
If this flow does not restore access: Contact YouTube support for access problems →

Common questions after a hack

Not directly — a Manager can invite and remove other users, but they cannot remove the primary owner of the Brand Account. However, if the attacker reached your Google Account and changed the recovery contacts, they can prevent you from getting back in at the account level, which effectively locks you out of everything. That's why securing the Google Account comes first.

Why this happened

Most hacks succeed because there's no record of who had access to what

When roles, connected apps, and Brand Account owners aren't tracked anywhere, it's impossible to know what's legitimate until something goes wrong. Delvia helps you keep a clear record of access so clean-up is faster and future risks are visible before they become incidents.

Delvia is free on iPhone and Android. Keep a clear record of who has access to your accounts — and what to do when that changes — wherever you are.