Two-Factor Authentication (2FA) for Your Website, Hosting and Email: A Practical Guide

Passwords get leaked, guessed and tricked out of people. Two-factor authentication (2FA) adds a second step, so a stolen password alone is not enough to get into your account. It is one of the most effective security steps you can take.

How 2FA works

After entering your password, you also provide something else: a code from an authenticator app, a hardware security key or, less securely, a text message.

Which accounts to protect first

1. Email. Whoever controls your email can reset almost every other account.
2. Domain registrar and hosting. These control your website’s address and files.
3. Website admin accounts. For WordPress, use a reputable 2FA plugin for administrators and editors.
4. Payment accounts. Stripe, PayPal and your bank.
5. Store platforms. Shopify and Wix accounts.
6. Social and advertising accounts.

Choose the strongest method available

• Hardware security keys and passkeys are the strongest.
• Authenticator apps are a good, widely available option.
• Text messages are better than nothing but can be intercepted or SIM-swapped.

Keep recovery codes safe

Save your recovery codes in a password manager or a secure place. Without them, losing your phone can lock you out.

Never share your codes

A one-time code is only meant for you. If anyone, including someone claiming to be support, asks you to read it out or send it to them, it is a scam. Read about phishing emails and fake calls.

Using 2FA with delegated access

When a developer has their own account on your site, ask them to enable 2FA too. It protects you if their password is ever compromised. See our safe access guide.

Want help setting it up?

We can enable and test 2FA across your WordPress site as part of our security service.