Why X accounts get suspended, and what actually reduces it

If you run more than three or four X accounts, you will lose some. The useful question is not how to reach zero. It is which of the things people spend money on actually move the rate, and which are folklore.

What follows is the operator view: the signals that get accounts caught when you are running many of them on purpose. It is not about recovering one personal account that got locked. If that is your situation, the appeal form is the whole answer and the rest of this page will not help you.

The four signals that matter

X does not publish its detection rules, and anyone who claims to know them exactly is guessing. What is observable, from watching accounts fail, is that suspensions cluster around four things. They are listed here in rough order of how often they are the cause.

1. Where the account connects from

This is the big one, and it is the one most people get wrong first. A data centre IP address is identifiable as a data centre IP address. Every major cloud provider publishes its ranges, and the commercial IP intelligence databases cover the rest. When an account logs in from one, it is not automatically suspended, but it starts from a worse position and every other signal is weighted more harshly.

The second half of this is sharing. If five accounts log in from one address, they are related, and X can see that as plainly as you can. When one of them gets actioned, the others are the obvious next place to look. This is why operators report losing accounts in batches rather than one at a time.

2. How old and how consistent the browser looks

A browser that has never been used before is unusual. Real people have cookies, a history, a local storage cache and a session that persists between visits. An automated session that starts from a blank profile every time produces an account that appears to log in fresh from a new machine on every single visit, which almost no real person does.

Consistency matters as much as age. An account whose timezone says Berlin, whose language header says English, and whose IP address geolocates to Singapore is describing three different people. Each value on its own is fine. The contradiction is the signal.

3. Speed

Rate limits are the part operators most often underestimate, because the limit that gets you suspended is far below the limit the interface will let you hit. You can click follow two hundred times in ten minutes. The button works. The account is what pays.

Speed shows up in three ways: actions per hour, actions per day, and the shape of the gaps between them. The third is the one that is easiest to get wrong. Twenty follows spaced exactly one hundred and eighty seconds apart is a more obvious machine than twenty follows spread unevenly across an afternoon, even though the hourly total is identical.

4. Content that already exists

Posting the same text from several accounts is the fastest way to link them together, and it does not require any clever analysis on X's side. Near duplicates count. So do the same link, the same image file, and the same reply template with a word swapped.

This is where a lot of otherwise careful setups fail. The proxies are right, the pacing is right, and then thirty accounts post the same launch announcement within an hour.

What actually reduces the rate

Ranked by how much difference they make relative to what they cost. The first two are worth more than everything below them combined.

Pace below the visible ceiling

Concrete numbers help more than the principle, so here are the per hour ceilings flottra ships with by default. They are deliberately conservative, and they are the ceiling rather than the target:

• Likes: 12 per hour
• Follows: 10 per hour
• Replies: 5 per hour
• Posts: 3 per hour, and in practice four to six a day inside a daytime window
• Direct messages: 3 per hour, which is the one worth being most careful with

You can run higher than this. Plenty of people do, for a while. The point of picking numbers like these is that an account operating at them is indistinguishable from an enthusiastic human, which means pacing stops being the thing that gets it caught.

Ramp new accounts instead of starting at full speed

A three day old account that follows eighteen people and posts four times looks nothing like a three day old account that likes two posts and follows one. The second one survives. This is the whole idea behind warming, and it is worth doing even though almost nobody searches for the word.

The ramp flottra uses by default runs over about three weeks, with the per day figures drawn from a range rather than fixed, so two accounts on the same phase do not move in lockstep:

Note what the first phase does not contain. For the first three days the account posts nothing at all. It reads. Operators hate this phase because it feels like doing nothing, and it is the phase that most improves survival.

Stop night activity

An account that acts at a steady rate across all twenty four hours is describing a machine, because people sleep. Confining activity to a waking window is free, costs you nothing in volume that matters, and removes an obvious tell.

The detail people miss is that the window should match the account's claimed location. An account whose profile says London and whose activity runs from 09:00 to 22:00 Pacific time is contradicting itself. If the proxy is in a country, derive the timezone from the proxy rather than from the machine running the browser.

What does not work

These come up constantly and are mostly wasted money.

• Buying aged accounts. An account that was created in a batch carries that batch's history. You are buying a liability with a nice looking creation date. This is the single most common way people lose money in this space.
• Fingerprint spoofing as a first move. Randomised canvas noise and a fake GPU string do nothing for an account that is posting from a data centre IP at four actions a minute. Fix the network and the pacing first. Spoofing is a refinement, not a foundation.
• Free and cheap shared proxies. A cheap residential proxy is frequently a shared one, which means you have bought a neighbourhood rather than an address. Some of the cheapest pools are measurably worse than no proxy at all.
• Deleting and remaking suspended accounts. Creating a replacement account after a suspension is ban evasion under X's rules, and it is one of the few things that reliably gets the replacement suspended too.
• Headless browsers. Running a browser in headless mode is detectable, and X does detect it. There is no reason to accept that cost when a real window works.

What to expect anyway

Even with all of the above, a share of accounts will go. Fresh accounts are most fragile in their first two weeks. Accounts that do outreach by direct message are more fragile than accounts that post and reply. Accounts in crowded topics get reported more, and reports matter.

The practical response is to plan for it rather than to be surprised by it. Keep more accounts than the job strictly needs. Do not let one account become load bearing. Stagger creation dates so a bad week does not remove a cohort. Keep a record of what each account did before it was actioned, because the pattern across several losses is more informative than any single one.

Doing this across many accounts

Everything above is achievable by hand for three accounts. At thirty it stops being realistic, because the parts that matter are the boring parts: remembering that this account uses that proxy, that it is on day four of its ramp, that it has already posted twice today, and that it is 03:00 where it claims to live.

That bookkeeping is the actual product in this category. flottra keeps the schedule in a panel and runs the browsers on your own computer through your own proxies, so the caps, the gaps, the quiet hours and the per account profile are applied without you tracking them. What it does not do is promise the outcome. Some accounts will still go.

1. Give every account its own proxy before you give it anything else. See choosing proxies for X accounts.
2. Let the browser profile persist so the account stops looking new. See whether you need an antidetect browser.
3. Ramp for three weeks before running an account at full speed.
4. Cap daily actions well under what the interface allows, and vary the gaps. See what X automation can actually do.
5. Write per account content rather than broadcasting one message from many.

Do those five and the accounts you lose will mostly be ones that were compromised before you started. That is roughly the best available outcome, and it is a lot better than the default.