Take a look at your URL (top box on your screen). If you see "http" or just "www" instead of "https" you DO NOT have a secure session & can be hacked.

Go to Account Settings -
Account Security - click Change.
Check box (secure browsing), click Save.

FB has automatically set it on the non-secure setting!

Do everyone a huge favour, copy & re-post.