What Is Podcast Hijacking?
Podcast hijacking is when someone other than the owner takes control of a show’s RSS feed or platform listings, usually by getting into a hosting or platform account or by claiming the show, and then changes, moves or publishes episodes under its name. The RSS feed is the file that tells Apple Podcasts, Spotify and other apps which episodes exist. Because the platforms trust the feed, whoever controls the feed largely controls the show.
The industry newsletter Podnews described one such case on October 26, 2026, summarizing the latest episode of the podcast Hyperfixed. According to Podnews, Sanderson Jones had stopped making his podcast when “Someone else hacked his podcast account, switched his podcast host, cloned his voice… and just carried on making shows for him.” Podnews says the show was moved to the host RSS.com, where it earned $1,293, and that after Hyperfixed got involved, RSS.com paid that money to Jones and helped transfer the podcast back to him (Podnews). This account is Podnews’s; we have not heard the Hyperfixed episode or confirmed the details with Jones or RSS.com, and Podnews does not say which account was compromised. For a company with a branded show, or an executive whose voice is on dozens of interviews, the same pattern is a reputation problem. Our guide on whether a podcast can use your name and voice covers the legal side.
How Do You Protect a Podcast at a Glance?
You secure the logins, control the feed email and claims, lock the feed and keep a record. The table summarizes each step.
| Step | Action | Expected result |
|---|---|---|
| 1 | List every account that can change the show | A complete map of host, Apple, Spotify, YouTube and email logins |
| 2 | Turn on two-factor sign-in for each account | A stolen password alone no longer opens the account |
| 3 | Put the feed email on a company-controlled mailbox | Verification codes go to you |
| 4 | Block or control show claims | No one can claim the show through Apple without your choice, and Spotify’s one claim is yours |
| 5 | Set <podcast:locked>yes</podcast:locked> | Hosts that honor the tag refuse to import the feed |
| 6 | Review team access on each platform | Only current staff hold admin rights |
| 7 | Keep a dated record of the feed and IDs | Proof of ownership if you need to recover the show |
Time: 1 to 2 hours, our estimate. Tools: hosting dashboard, Apple Podcasts Connect, Spotify for Creators, an authenticator app or trusted phone. Cost: Free. Skill level: Beginner to intermediate.
What Do You Need Before Starting?
You need admin access to the hosting account and to each platform listing, plus the ability to edit the feed’s settings. If you are not sure which platforms list the show, our guide to submitting a podcast to Apple, Spotify and YouTube shows where each listing lives.
- The RSS feed URL and a saved copy of the current feed.
- Admin logins for the host, Apple Podcasts Connect and Spotify for Creators.
- A shared company mailbox (for example, podcast@ your domain) that more than one person can reach, which is our recommendation, not a platform rule.
- A trusted phone or authenticator app for two-factor codes.
Step 1: List Every Account That Can Change the Show
Write down each account that can edit the feed, the listing or the audio. For most shows that means the hosting provider, the Apple Account used for Apple Podcasts Connect, the Spotify account used for Spotify for Creators, any YouTube channel carrying the show, and the email inbox named in the feed. Note who holds each login and when it was last used. Shows that have gone quiet are worth checking first: in the case Podnews described, the owner had stopped making the show (Podnews).
Step 2: Turn On Two-Factor Sign-In Everywhere
Two-factor sign-in means a password alone is not enough to log in. Apple describes its version as “an additional layer of security for your Apple Account,” asking for a six-digit verification code after the password when you sign in on a new device or the web (Apple Support). Turn it on under Settings, your name, Sign-In & Security on an Apple device, or via “Upgrade Account Security” at account.apple.com.
Google calls its version 2-Step Verification, which it says lets you “add an extra layer of security to your account in case your password is stolen”; turn it on in the Google Account security section (Google Account Help). Do the same in your hosting provider’s account settings; the options vary by host, and we did not check each one.
Step 3: Put the Feed Email on a Mailbox You Control
Make sure the email address in the RSS feed belongs to the company, not to a former producer or a personal account. Spotify verifies claims with the line “We’ll send a verification code to the email address in your RSS feed” and asks you to “Copy the 8-digit code and paste it in the submit form” (Spotify for Creators). Whoever reads that inbox can complete a Spotify claim.
The feed email is usually set in the host’s show settings. After changing it, check the live feed to confirm the new address appears. Secure that mailbox with two-factor sign-in too.
Step 4: Block or Control Show Claims
In Apple Podcasts Connect, decide whether anyone should be able to claim the show. Apple says “Claiming a show requires that the user attempting to claim it has access to change the RSS feed,” and that to block claims you select the show, open the Availability tab and, under Show Claiming, choose “Don’t allow show to be claimed” (Apple Podcasts for Creators). A legitimate claim uses a token: “The token is valid for seven days,” it is added to the RSS feed through the host, and “Within 24 hours, Apple Podcasts will verify it.”
Days, as published by Apple
Source: Apple Podcasts for Creators, “Change the RSS feed URL” and “Claim your show.” Read October 26, 2026.
Apple publishes “at least four weeks” (shown as 28 days) and “Within 24 hours” (shown as 1 day). The first is a minimum for a legitimate feed move, the second a processing time; neither is a security guarantee.
The chart shows how short Apple’s claim windows are compared with the four weeks it asks for a legitimate feed move (Apple Podcasts for Creators), which is why a takeover can complete quickly once someone controls the feed.
On Spotify, “A show can only be claimed once on Spotify for Creators,” and whoever claims it is “the admin of the claimed show by default” (Spotify for Creators). The claim process applies to shows hosted elsewhere; a show hosted on Spotify for Creators already sits in an account. Claim the show yourself if it is not yet claimed, so no one else can. If someone else already holds it, Spotify directs the request to the existing admin or owner.
Step 5: Lock the Feed Against Imports
Add the podcast:locked tag to the feed’s channel and set it to “yes.” The Podcast Index namespace, an open set of RSS tags maintained by the Podcasting 2.0 project, says the tag exists to “tell other podcast hosting platforms whether they are allowed to import this feed,” and that when it is “yes,” “any attempt to import this feed into a new platform should be rejected” (Podcast Index namespace). An optional owner attribute holds “an email address that can be used to verify ownership of this feed during move and import operations.”
Two limits apply. The tag is honored only by hosts that support it, and it does nothing if an attacker is already inside your hosting account, since they can switch it off. Many hosts expose it as a setting rather than a raw tag. When you move hosts on purpose, set it to “no” first; our guide to moving a podcast to a new host covers that sequence.
Step 6: Review Who Has Team Access
Remove anyone who no longer works on the show. Spotify for Creators lets the admin invite team members, with access levels described in a separate help article (Spotify for Creators), and Apple says “Any Admin with access to the show must initiate the transfer request by contacting us” to move a show between accounts (Apple Podcasts for Creators). Every admin is a route to the show, so keep the list short.
Step 7: Keep a Dated Ownership Record
Save a dated copy of the feed and a note of the show’s IDs. Apple’s transfer page says “Before we can transfer a show, we’ll need to verify ownership” and asks for the Apple Podcasts URL, show ID, RSS feed URL, contact email and the new account’s Account ID (Apple Podcasts for Creators). Having those on file, along with hosting invoices, is our recommendation for proving ownership quickly if a show is taken.
Some platforms also verify control with a code placed in the feed. The namespace’s podcast:txt tag, with purpose “verify,” carries a string “given by a third party platform to a podcaster” “in order to prove that they are the owner of the feed and are in control of it,” for example <podcast:txt purpose="verify">...</podcast:txt> (Podcast Index namespace). Remove any verification strings you do not recognize.
How to Verify It Worked
Open the live feed and each dashboard and confirm the settings stuck.
- Feed: load the RSS feed URL in a browser and check for
<podcast:locked>yes</podcast:locked>and the company email. - Apple: in Apple Podcasts Connect, the Availability tab shows “Don’t allow show to be claimed” selected, if you chose it.
- Spotify: the show appears in your Spotify for Creators account with you as admin.
- Logins: sign out and back in to each account and confirm a second-factor code is requested.
What Should You Do if a Show Is Hijacked?
Act on the host first, then the platforms. Contact the hosting provider where the show now sits; in the case Podnews described, it was the new host, RSS.com, that paid out the earnings and helped transfer the show back (Podnews). Then contact Apple through Podcasts Connect, which its transfer page names as the route for ownership changes, and the existing admin or Spotify support on Spotify. Apple’s support footer also links a Content Dispute page, which we could not read in full, so we do not describe its process. Our guide on reporting impersonation covers related steps.
Common Problems and Fixes
| Problem | Likely cause | Fix |
|---|---|---|
| Spotify says the show is already claimed | Someone else completed the claim first | Contact the existing admin, as Spotify directs, or Spotify support if it was not authorized |
| Spotify code never arrives | Old or wrong email in the feed | Update the feed email at the host, wait for the feed to refresh, then retry |
| Apple claim not possible | Show includes a subscription, contains Apple-hosted audio, has no RSS feed, or its host does not support claiming yet | Apple says to “contact us” for help moving it to a new account |
| Locked tag missing from live feed | Host does not support it or setting not saved | Ask the host; add it as a custom channel tag if allowed |
| Unknown verify string in feed | A platform or person added it | Identify it, then remove it if not yours |
What Not to Do
Do not let a former agency or producer own the feed email. Consequence: Spotify sends claim codes to that address. Correction: move it to a company mailbox.
Do not abandon a dormant show without securing it. Consequence: the case Podnews described involved a show its owner had stopped making. Correction: lock the feed, keep two-factor on, or remove the show deliberately.
Do not leave the feed unlocked between moves. Consequence: hosts that honor the tag cannot block an import. Correction: set podcast:locked to “yes” except during a planned move.
Do not share one login across a team. Consequence: you cannot tell who changed what or remove one person. Correction: use each platform’s team access.
Frequently Asked Questions
Can someone steal my podcast?
Yes, if they get control of the hosting account, the feed or its email. Podnews reported on October 26, 2026, summarizing an episode of Hyperfixed, that a show was taken over, moved to RSS.com and published with a cloned voice before it was returned to its owner.
What does the podcast:locked tag do?
It tells other hosting platforms whether they may import the feed. When set to “yes,” the Podcast Index namespace says any attempt to import it into a new platform should be rejected, though only hosts that support the tag honor it.
How does Spotify verify podcast ownership?
Spotify for Creators sends an 8-digit code to the email address in the RSS feed. A show can only be claimed once, and the claimer becomes admin by default.
Can I stop people from claiming my show on Apple Podcasts?
Yes. In Apple Podcasts Connect, open the show’s Availability tab and, under Show Claiming, select “Don’t allow show to be claimed.”
What do I do if someone else claimed my podcast on Spotify?
Spotify directs requests to the existing admin or owner of the show. If the claim was not authorized, contact Spotify for Creators support with proof that you control the feed.
Does two-factor authentication protect a podcast?
It protects the accounts that control it. Apple and Google both describe two-factor sign-in as an extra layer of security; turn it on for the host, Apple, Spotify, YouTube and the feed email.
Sources and Methodology
This guide is built from Apple Podcasts for Creators and Spotify for Creators help pages on claiming and transferring shows, the Podcast Index namespace documentation for the locked and txt tags, Apple and Google account-security help pages and Podnews’s October 26, 2026 item, all read October 26, 2026. Platform steps and limits are the platforms’ own; the account inventory, shared-mailbox advice and ownership record are our recommendations, not platform rules. The hijacking case is reported only by Podnews, summarizing Hyperfixed; we did not hear the episode or contact Jones or RSS.com. We did not test claims, imports or the tag on any host, and did not check each hosting provider’s security settings.
- platform documentation Spotify for Creators, Claiming your podcast on Spotify for Creators. 8-digit code, feed email, one claim per show, default admin, team members. Read October 26, 2026.
- platform documentation Apple Podcasts for Creators, Claim your show. Feed-access requirement, token validity, 24-hour verification, blocking claims, ineligible shows. Read October 26, 2026.
- platform documentation Apple Podcasts for Creators, Transfer ownership of a podcast. Admin-initiated transfer, ownership verification, information required. Read October 26, 2026.
- platform documentation Apple Podcasts for Creators, Change the RSS feed URL. Four-week redirect minimum. Read October 26, 2026.
- standards Podcast Index, Podcast Namespace: Locked. Purpose, values, owner attribute. Read October 26, 2026.
- standards Podcast Index, Podcast Namespace: Txt. The verify purpose. Read October 26, 2026.
- platform documentation Apple Support, Two-factor authentication for Apple Account. Read October 26, 2026.
- platform documentation Google Account Help, Turn on 2-Step Verification. Read October 26, 2026.
- trade press Podnews (Ray Hennessy), The cloned podcast that carried on publishing, October 26, 2026. The hijacking case, as summarized from Hyperfixed. Read October 26, 2026.