To add two-factor authentication to your website admin, turn it on in four places: your CMS (for WordPress, a 2FA plugin such as Two Factor), your hosting control panel (cPanel's Two-Factor Authentication under Security), your hosting provider's customer account, and your domain registrar. Use an authenticator app or passkey, and store backup codes somewhere safe so you can't get locked out.
The rest of this guide gives step-by-step instructions for each, explains which second factor to choose, and covers how to roll 2FA out to staff and freelancers.
Key takeaways
- Turn on two-factor authentication in four places, namely your CMS, hosting control panel, hosting customer account and domain registrar.
- Use a passkey where offered, otherwise an authenticator app, and keep SMS codes as a fallback only.
- WordPress core has no 2FA, so add it with a plugin such as Two Factor and ask every administrator and editor to set it up.
- Store backup codes before you need them, because without them account recovery can take days.
Why does website admin 2FA matter so much?
Most website takeovers don't involve clever hacking. They involve a correct username and password, guessed by a bot, reused from an old breach or captured by a phishing page. A second factor stops a stolen password on its own from being enough.
It matters beyond the CMS. Whoever controls your hosting account can replace the whole site. Whoever controls your registrar or DNS account can point your domain, and your email, somewhere else. Those logins deserve at least as much protection as the WordPress admin.
Cyber Essentials, the UK government-backed scheme, now treats missing MFA on cloud services where it's available as an automatic fail under version 3.3, which took effect on 27 April 2026.
Which type of two-factor authentication should I use?
In April 2026 the UK's National Cyber Security Centre (NCSC) announced it would "begin recommending passkeys wherever a service supports them, and two-step verification (2SV) where it does not". It also points out that traditional methods, including SMS, email codes, authenticator apps and push approvals, are all phishable to some degree, though any of them is far better than a password alone. In the US, CISA likewise urges organisations to move to phishing-resistant MFA such as FIDO security keys and passkeys.
| Method | How it works | Phishing resistance | Notes |
|---|---|---|---|
| Passkey or hardware security key | Cryptographic login tied to the real site | High | Best option where supported |
| Authenticator app (TOTP) | Six-digit code that changes every 30 seconds | Medium | Widely supported, works offline |
| Push approval | Tap "approve" in an app | Medium | Watch for repeated unexpected prompts |
| Email code | Code sent to your inbox | Low to medium | Only as strong as your email account |
| SMS code | Code by text message | Low to medium | Vulnerable to SIM-swap; better than nothing |
For most small business admins: use a passkey where offered, otherwise an authenticator app, and keep backup codes offline.
How do I add 2FA to WordPress?
WordPress core doesn't include 2FA, so you add it with a plugin. The Two Factor plugin from the WordPress.org community is a lightweight option with more than 100,000 active installs.
- In Plugins > Add New, search for "Two Factor", install and activate it.
- Go to Users > Profile and scroll to Two-Factor Options.
- Enable Authenticator App (TOTP), scan the QR code with your app and enter the code to confirm.
- Enable Backup Verification Codes and generate the 10 one-time codes. Store them in your password manager or print them.
- Choose your primary method and click Update Profile.
- Log out and back in to check it works.
For passkeys or hardware keys, the Two Factor plugin's older FIDO U2F method has been removed; install the separate Two-Factor Provider: WebAuthn plugin instead. Many broader security plugins also include 2FA, along with options to require it for administrator and editor roles.
Each user has to set up their own second factor, so after installing, ask every administrator and editor to do it, then check their profiles. Our WordPress security checklist covers the other settings to tighten at the same time.
How do I enable two-factor authentication in cPanel?
- Install an authenticator app on your phone first.
- Log in to cPanel and open Security > Two-Factor Authentication.
- Click Set Up Two-Factor Authentication.
- Scan the QR code, or type the account and key into your app manually.
- Enter the six-digit code in Security Code and click Configure Two-Factor Authentication.
If the option is missing, your host hasn't enabled it in WHM; ask them to. If setup fails with an invalid code, the server clock may be wrong, which your host can fix. cPanel notes that if you lose your phone you'll need your hosting provider to disable 2FA on your account, so keep their support details handy.
One gap to be aware of: cPanel 2FA protects logins to the interface, but password-based API requests can bypass it unless your host enforces API security policies. Use API tokens for integrations rather than your main password.
How do I secure my hosting and registrar accounts?
Your hosting provider's customer account (where you pay bills and open tickets) is usually separate from cPanel, and often more powerful: it can reset cPanel passwords or cancel services. Your domain registrar account controls nameservers and renewals.
- Log in to each account and look for Security, Login settings or Two-step verification.
- Turn on the strongest method offered, ideally a passkey or authenticator app.
- Save backup codes.
- Check the account email address belongs to a mailbox you control and that has its own 2FA.
- At the registrar, switch on the transfer lock (often called registrar lock) and auto-renew.
- If you use a separate DNS or CDN provider such as Cloudflare, enable 2FA there too.
For high-value .uk domains, Nominet offers a chargeable Domain Lock through registrars, which blocks changes at the registry level until an authorised person unlocks them. Ask your registrar if it's available.
How do I roll out 2FA to staff and freelancers?
- List every account with admin access: CMS, hosting, registrar, DNS, CDN, email admin, analytics and payment providers.
- Give each person their own login. You can't enforce 2FA on a shared account sensibly, and you can't revoke one person's access.
- Require 2FA for privileged roles, using your plugin's or provider's enforcement setting where available.
- Agree a recovery process before someone loses a phone: who holds backup codes, and who can reset 2FA.
- Remove access promptly when contracts end.
What to do next
Start with the account that would hurt most to lose, usually your registrar or hosting account, and enable 2FA there today, then WordPress or your CMS. Afterwards, check the rest of your setup: MakeItFlow's free website security scan reviews your HTTPS, security headers, cookie flags and exposed files, and you can run a free website audit with MakeItFlow for a full picture. If you think an account has already been misused, read signs your website was hacked.
Frequently asked questions
What happens if I lose my phone with my authenticator app?
Use one of your backup codes to log in, then set up 2FA again on your new device. Without backup codes, you'll need the provider's account recovery process, which can take days, so store codes before you need them.
Is SMS two-factor authentication good enough?
It's much better than a password alone, but codes can be intercepted through SIM-swap fraud or phishing. Use an authenticator app or passkey where the service supports one, and keep SMS as a fallback only.
Can I use one authenticator app for all my accounts?
Yes. Any standard TOTP app works with WordPress, cPanel and most hosts and registrars. Choose one that offers encrypted backup or sync so a lost phone doesn't mean re-enrolling everything.
Will 2FA stop all attacks on my website?
No. It protects logins, but not out-of-date plugins, vulnerable code or exposed files. Combine it with updates, backups and a web application firewall.
Should I force 2FA for customers on my online shop?
Usually make it optional for customers and mandatory for staff. Forcing it on shoppers can hurt conversion; offering passkeys is an increasingly user-friendly middle ground.
Sources
More guides for your industry
Free checklist (PDF)
Free law firms website checklist
30 practical checks for law firms: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
