Eugene's observations

The golden rule is to assume that your Facebook (and other) accounts will be broken into one day.  Your next potential employer or your ex-spouse's lawyer will be pouring over it.  Don't ever publish anything you would object to being posted on a bill board outside your house.

If you look hard enough, Facebook does offer plenty of controls to guard against your details being harvested by the bad folks.  Security settings and their defaults do get changed though, so it's a good idea to revisit this periodically.  To save some time looking for the key components, here are some suggestions.  

1. Setup login notifications.  This will alert you when the account is accesed from an unknown device.  Down arrow > Settings > Security > Login notifications.
   
   
2. Use two factor authentication.  Each time you access FB from a previously unused browser or computer your phone will be sent a verification code.  Down arrow > Settings > Security > Login Approvals.
   
   
3.  Limit timeline post access to your friends.  a) future posts:  Click the padlock icon top right > Who can see my stuff > Friends.   b) previous posts.  Down arrow > Settings > Privacy > Who can see my stuff > limit past posts.
   
   
4.  Lock down who can contact you.   Click the padlock icon top right > Who can contact me > Strict Filtering.
   
   
5. Prevent successfull searches based on your email address.   Settings > Security > Privacy > Who can look me up > Friends.

Please add a comment if you think this post can be improved.