The Annual X Account Audit: 12 Checks to Run Once a Year

Why a yearly cadence beats a quarterly one

Cleanup gets driven two ways. One is event-driven: a job change, a search result, an unexpected retweet forces your hand, and you work under time pressure, usually over-correcting. The other is cadence-driven: you walk a known list on a fixed schedule and deal with problems before they grow.

A year is the right interval because the state that matters changes on that scale. Archive size, index status of old tweets, apps you have authorized, platform terms. Checking weekly would show no movement; checking yearly catches exactly one full cycle.

A complete audit runs about two hours. Splitting it into four half-hour blocks is easier to sustain. For the split, see the 30-day habit plan and how often to run a footprint check.

Group 1: Archive and retention (3 checks)

Check	Pass criteria	Time
Download the current archive	This year's ZIP is on disk, covering up to the last month	Hours (background)
Compare archive size	Growth against last year matches how active you actually were	5 min
Store it offline	Two copies minimum, one held on offline media	15 min

The archive is the base layer for everything after it. Without one, risk scanning means scrolling your own timeline, which always misses things. Download steps are in downloading your X data archive, and if the download stalls, troubleshooting a failed archive download.

The second check is the one people skip. The growth curve carries information. A year that suddenly adds a few hundred megabytes usually means heavy image posting or a large like history. Likes go into the archive too, and they are just as much a privacy surface. What drives the size is covered in why an archive can hit 200MB.

Group 2: Risky content (3 checks)

Check	Pass criteria	Time
Phone and email scan	Zero hits, or historical hits no longer publicly visible	10 min
Address and location scan	Nothing that resolves to a street number or a specific workplace	10 min
Sensitive topic review	Emotional posts about former employers, industries or clients are no longer public	20 min

These three are the core output of a footprint report, and a tool handles the first two categories automatically. The third needs a human call. What counts as sensitive depends on your field and where you are applying next. The same sentence carries a different risk level for an engineer and for a compliance officer.

Write pass criteria concretely or every year ends with "looks fine to me." For phone numbers, the standard is that nobody can assemble a complete number from your public posts, not that you cannot recall posting one. For detection, see checking for exposed phone numbers.

Group 3: Permissions and sessions (2 checks)

Check	Pass criteria	Time
Third-party app access	Only apps you used this year remain; everything else revoked	10 min
Logged-in devices and sessions	No unknown devices; all unrecognized sessions signed out	10 min

The authorization list is where things balloon. Every "sign in with X" leaves a long-lived grant behind, and some of those carry write access. Cleanup steps are in auditing third-party app access, and the device side in reviewing login devices.

This group runs on a separate track from content cleanup. Plenty of people scrub their posts thoroughly while leaving a three-year-old write grant in place, which undercuts most of the benefit.

Group 4: Index state and third-party copies (2 checks)

Check	Pass criteria	Time
Search result review	Searching your name plus handle returns no old tweets above the fold	15 min
Third-party copy check	Spot-check two or three high-risk posts for reposts or cache sites	15 min

Search results do not vanish the moment you delete a tweet. That is expected, and the path through it is in getting Google to remove old tweets. What this group examines is the state after the deletion work is already done, which is often mistaken for the finish line.

Group 5: Rules and cadence (2 checks)

Check	Pass criteria	Time
Posting rules review	One or two new self-imposed limits written down, such as no live location	10 min
Next year's date	A specific date on the calendar, not "sometime next year"	2 min

The last one sounds trivial and is the single item that decides whether you do this again next year. On the rules side, see setting a few posting rules for yourself.

A two-hour running order

1. Start with the archive. Kick the download off in the background and work the checks that do not depend on it.
2. Then scan for risk. Once the archive lands, run a full check and export the risk list.
3. Next, permissions. This group is content-independent and fits in the download window.
4. Finally, index state. Come back to search results a few days after deletion work, once the index has caught up.

The one order that cannot be reversed: the archive comes before the risk scan. It is a read-only snapshot, and having it gives every later action a rollback point.

About Digital Footprint Health

Digital Footprint Health (digital-footprint-health.shop) automates the most time-consuming group on this list. It parses your X archive on your own machine, flags tweets that carry phone numbers, emails, street addresses, precise locations or sensitive subject matter, and returns a 0-100 health score. Nothing is uploaded at any point.

Two things make it a reasonable starting point for an annual audit. The check is free and read-only, so running it costs you nothing and changes nothing on your account. And it works from the archive rather than from your live timeline, which means it sees the posts you have already scrolled past a hundred times without registering.

Run a free check from the homepage to get this year's risk list. Deletion scope and per-post pricing are laid out on the pricing page, and the checks that no tool can perform for you are covered throughout the blog.