Unless you're completely new to Instagram, it's likely that you've linked your account with a third-party service at some point and forgotten about it. Those services still have access to data such as your media and profile information, so it's important that you not only know how to find these "authorized" apps, but that you know how to revoke their permissions.
You may not even realize that you connected your Instagram account with another app, and it's even more plausible that you forgot you did. Maybe you used an app to monitor who unfollowed you, manage multiple social media accounts, enter a contest, or share info on dating platforms. Even if you stop using these third-party apps, they'll still have access to your account unless you do something about it.
Even if you sign out or delete a third-party app from your iPhone or Android phone, apps with access to your Instagram profile can potentially perform unauthorized actions such as posting content, liking media, and leaving comments. Apps that have access to your login email and password are at risk of getting hacked, and they might just flat out be trying to steal your credentials.
To increase security and get rid of services you no longer use, as well as possibly malicious apps and other bad apples, revoke their access. However, for some reason, Instagram doesn't make this option convenient, so you won't find the ability to revoke apps from within the in-app settings on iOS and Android.
Since you can't revoke services from within the Instagram app, you'll need to do so in a browser. Visit instagram.com/accounts/manage_access in your web browser of choice, then log in to your account. If it asks you to save your credentials after logging in, select "Not Now" — there's no reason to save your login in a browser unless you use the browser for all your Instagramming.
Alternatively, you can access these settings by logging into instagram.com in your web browser, choosing to save credentials or not, tapping the cog on your profile page, and selecting "Authorized Apps" from the menu that appears.
Under Authorized Apps, you can see every application that has access to your Instagram account with an app summary of each. If you don't have any connected services, it will say "you have not authorized any applications to access your Instagram account."
If you do have some, you'll see it lists what permissions each app has, such as access to your basic information, like viewing photos, commenting on posts, uploading to your account, etc. To stop an app from doing any of this, tap on "Revoke Access," then on "Yes" when it asks if you're sure.
Do this for every third-party application you want to revoke access for. By revoking access, the connection between Instagram and that app will break. For example, if you revoke access to Hootsuite, you'll no longer be able to set up scheduled posts on Instagram with it. You would have to re-grant access to the social media management platform to access this feature once again.
If you suspect that a third-party app has posted unauthorized content on your Instagram account, or if you don't recognize a service you just revoked, you should definitely change your password.
To set a new Instagram password, open the app on iOS or Android, and tap on the profile icon. Next, tap on the three-dash menu, and go into "Settings." Finally, go to "Privacy and Security" on iOS or Account on Android, and select "Password." Type in your old password, enter a new one, then save.
For extra security, you should set up two-factor authentication, which requires anyone trying to log in to enter a special login code sent through text message. Although 2FA is optional, we highly suggest it.
This article was produced during Gadget Hacks' special coverage on smartphone privacy and security. Check out the whole Privacy and Security series.