Check a Facebook Page action button after a security incident

The action button below a Facebook Page cover can route visitors to a website, call or other action. If a manager account is misused, the public Page may look normal while the button points to a phishing or payment page. Meta documents that Page access is needed to change the button. Reviewing it is a quick, high-value check during offboarding or after any unexplained Page activity.

Before you start​

Do this from a trusted administrator device. Record the intended destination and any currently displayed button text. If you suspect compromise, save a screenshot of the old target before changing it. Do not open a suspicious destination on the same device you use to administer payments and customer data.

Do it step by step​

1. Open the Page as a visitor first and inspect the button label and apparent destination. Compare with the official website and current campaign. A familiar label such as 'Learn more' does not guarantee a safe target.
2. Switch into the Page with authorized Facebook access. Use the menu by the button to Edit action button and inspect its chosen action and URL or contact details. Check for lookalike domains and unexpected phone numbers.
3. Change the destination to the verified business URL or remove the button temporarily if no safe target exists. Meta documents an edit and a delete path; use the least disruptive one that prevents visitor harm.
4. Review Page bio links, pinned posts, recent Stories and ads for the same malicious destination. A corrected button alone does not stop a copied link elsewhere on the Page.
5. Check Page access and any business-portfolio assignments for the source of the change. Secure suspicious manager accounts and remove obsolete roles before announcing the incident is contained.
6. Test the revised button from a signed-out or ordinary visitor session on desktop and mobile. Confirm it resolves to the expected domain, uses HTTPS and leads to the intended business page, not a redirect to an unrelated site.

Check the result​

The Page's public button reaches the verified destination, related links have been checked and the person or tool able to alter it has been reviewed.

If something goes wrong​

If you lack an Edit action button control, check whether your role is task access rather than Facebook access, or ask a full-control owner. If the new URL redirects unexpectedly, inspect the business website itself; the Page setting may be correct while the site is compromised.

Know the limit​

Changing a Page button cannot revoke links already sent in Messenger, email or ads. Screenshots and cached previews may also persist. If visitors entered credentials or paid through the old target, communicate through a verified channel and direct them to appropriate account or payment support. Meta Page action button Meta Page access