Two-factor authentication means a stolen password is not enough to reach your account. Signing in also requires a code from your phone, which changes every thirty seconds.
It is the single most effective thing you can do to protect your hosting account, and it takes about two minutes.
Turning it on
Two-factor is off until you turn it on. We do not enable it for you, because the recovery burden falls on whoever holds the backup code — that has to be you. It takes about two minutes.
- Sign in to the client area.
- Open Security Settings from your account menu.
- Choose Enable Two-Factor Authentication.
- Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, Authy or 1Password all work.
- Enter the six-digit code it shows to confirm.
Save your backup code
You will be given a backup code when you enable it. Store it somewhere other than your phone.
That code is how you get in if the phone is lost, broken or replaced. Without it, recovery means proving your identity to us, which is deliberately slow — the whole point of two-factor is that it cannot be bypassed easily, and that applies to you as well.
Changing phones
Disable two-factor before wiping the old phone, then enable it again on the new one. Doing it in that order takes a minute. Doing it the other way means using the backup code, or contacting us.
This protects one account
Two-factor on the client area protects billing and account management. It does not protect your control panel, your WordPress admin or your email — those are separate systems with separate passwords.
Enable it wherever it is offered, and do not reuse passwords between them.
Locked out
Use your backup code first — that is what it is for, and it is instant.
If the backup code is gone too, open a ticket from the client area. We can disable two-factor on your account, but only after verifying you are who you say you are, and that is deliberately not instant. A process that unlocked an account quickly on request would defeat the point of enabling two-factor in the first place.
Which is the real argument for storing the backup code somewhere sensible when you set this up: it turns a support conversation into a five-second copy and paste.
