Stolen passwords are one of the most common ways websites are hacked. Two-factor authentication (2FA) adds a second check, stopping most of these attacks.
Where to enable it
- Website admin (WordPress, Shopify, builder accounts).
- Hosting control panel.
- Domain registrar.
- Business email.
- Google Analytics, Search Console and ad accounts.
- Payment gateway dashboards.
Methods
| Method | Security |
|---|---|
| Authenticator app | Strong and convenient |
| Security keys | Strongest |
| SMS codes | Better than nothing, but vulnerable to SIM swaps |
Set-up tips
- Save backup codes securely.
- Use business-owned devices and email.
- Give each person their own login; never share accounts.
- Remove access when people leave.
WordPress
Security plugins add 2FA to WordPress logins.
Document access in your privacy and security procedures (start with our privacy policy generator). Read website security basics.
Want the full picture? This article is part of Business websites: the complete guide, our in-depth guide with everything in one place.
