What Is Two-Factor Authentication, and Why Should Your Site Admin Use It?

A password on its own is a weak lock. Passwords get guessed, reused, leaked and stolen. Two-factor authentication adds a second check, so that knowing the password is no longer enough to get in.

How it works

You log in with your password as usual. Then the system asks for a second proof that you are really you, such as a short code from your phone. Someone who stole your password but does not have your phone is stopped at the door. It is the same idea as a bank card that needs a PIN: having the card alone is not enough.

Why it works so well

Most break-ins start with a stolen or guessed password. Criminals buy lists of leaked passwords and try them against many websites at once. If one of your passwords has ever appeared in such a list, two-factor authentication is what stands between them and your site. It is a very effective safeguard for how little effort it takes.

The common types

• An authenticator app. It shows a code that changes every thirty seconds or so. This is a strong, practical choice for most people
• A text message code. Better than nothing, but less secure, because phone numbers can sometimes be taken over
• A physical security key. A compact device you plug in or tap. This is the strongest option, and a good fit for the most important accounts
• Backup codes. One-time codes to use if you lose your phone. Store them somewhere safe

Where to turn it on

Start with the accounts that could do the most damage if someone took them over:

• Your business email, since it can be used to reset almost every other password
• The account where your domain is registered. See what happens when your domain expires for why that account matters
• Your hosting account
• Your website admin login

Setting it up usually takes a few minutes. Open the security settings of the account, look for a two-step or two-factor option, and follow the prompts. Save your backup codes straight away, and test that the new login works before you close the page.

Common worries

• It sounds like a hassle. It adds a few seconds to a login, and most systems can remember a trusted device
• What if I lose my phone? That is what backup codes and recovery options are for. Set them up on day one
• Our team shares one login. Give each person their own account instead. Sharing a login makes it impossible to see who did what, or to remove one person's access cleanly

Pair this with strong, unique passwords, which a password manager makes easy. And if you are ever worried about a break-in, see how to know if your website has been hacked.