How to turn on two-factor authentication

A password is a single piece of information, and single pieces of information leak — through a breach at an unrelated service, a phishing page, or malware sitting on a shared device. Two-factor authentication adds a second, independent check on top of the password, so having the password alone is no longer enough to sign in. It is one of the highest-value security changes available for the effort involved, and it takes a few minutes per account to set up.

How it actually works

After entering the correct password, you are asked for a second piece of proof — most commonly a six-digit code that changes every thirty seconds, generated by an app on your phone rather than sent anywhere over the network. The app and the service both calculate the same code independently, using a shared secret set up once during enrolment and the current time, which is why the codes match without needing to be transmitted between them.

Setting it up

The exact wording differs between services, but the process is consistent almost everywhere:

1. Install an authenticator app first

   Any reputable time-based one-time passcode app works, and one is enough to manage codes for every account you set up this way — you do not need a separate app per service.

2. Find the two-factor authentication option in account security settings

   In your control panel, and separately in your CMS admin area if it offers this independently, look under account security or login settings.

3. Scan the code shown during setup

   This is usually a QR code, which the authenticator app scans using your phone's camera to set up the shared secret, without you needing to type anything manually.

4. Confirm with a live code

   Enter the six-digit code currently showing in the app to prove the setup succeeded before it is switched on for real.

5. Save the backup codes immediately

   Write them down or store them in a password manager, somewhere other than the phone running the authenticator app. These are the only way back in if that device is lost, damaged, or replaced.

Which accounts to enable it on

Prioritise accounts in proportion to what they can reach if compromised:

• Your control panel account — reaches hosting, domains and email settings for everything on the account.
• Your CMS administrator account — direct access to your site's content and configuration.
• Your domain registrar account — controls where your domain points, and losing it can mean losing the domain itself.
• Your email account — usually the account used to reset passwords everywhere else, which makes it a priority even though it is not directly part of your website.

If a service only offers a text message code

Not every service supports an authenticator app, and some only offer a code sent by SMS. This is still a meaningful improvement over a password on its own, and it is worth enabling rather than skipping while waiting for a better option to appear. Treat an authenticator app as the preferred method wherever it is offered, and SMS-based codes as a reasonable fallback where it is the only option available, rather than a reason to leave two-factor authentication off entirely on that account.

What it does and does not protect against

Two-factor authentication specifically stops a leaked or guessed password being enough on its own, which covers the majority of account takeover attempts. It does not protect against every scenario — a sufficiently convincing phishing page can, in some cases, capture a one-time code in real time as well as a password, so continuing to check the actual address of any login page before entering anything remains worthwhile. It is a substantial improvement over a password alone, not a guarantee that makes every other precaution unnecessary.

Once this is set up on your important accounts, pair it with a genuinely strong, unique password for each one, and consider limiting repeated login attempts as an additional layer on top.