Short video (28 seconds)
Why turn on two-factor authentication? #
Imagine someone learned your email and password from a leak elsewhere or a phishing message. Without two-factor authentication they can log in just like you. With it, they also need a number that changes every 30 seconds and lives only on your phone.
- Protects you if your password leaks from another site.
- Free, and takes less than two minutes to set up.
- The code comes from an app on your phone, not a text message, so it cannot be intercepted.
What does it protect? #
Your client area account is the key to all your services: it opens cPanel without a password, manages domains and nameservers, requests transfer codes and opens tickets in your name. Anyone who gets in could transfer your domain, repoint it, or reach your website files. Two-factor authentication closes that door, because logging in needs two things together: a password you know and a phone you own.
| Without 2FA | With 2FA |
|---|---|
| The password alone is enough to log in | You need the password + a number from your phone |
| A leaked password means access to your account | A leaked password is not enough on its own |
| You do not know if someone tries | No login happens without your phone |
Step 1: install the app #
Install the free Google Authenticator app on your phone: Android | iPhone.
Step 2: turn it on for your account #
- Log in, and from the Hello menu choose Security Settings, or open it directly.
- Under Two-Factor Authentication click Click here to Enable, then Get Started.
- Open the app, tap + then Scan a QR code, and point the camera at the code on screen. The app shows a 6-digit number; enter it on the page and click Submit.
- You will see “Two-Factor Authentication is now enabled” with your Backup Code. Copy it and keep it safe: it is your way in if you lose your phone.
Logging in after you turn it on #
After your email and password, you will see “Your second factor is required to complete login”. Open the app and enter the number it shows. If it changes before you finish, enter the new one.
Lost your phone or want to turn it off? #
- On the code page click Login using Backup Code and enter your backup code. It works once, and a new one is shown: save that too.
- In Security Settings click Click here to Disable and enter your account password (not the app code) to confirm.
- Turn it on again on your new phone with the same steps.
FAQ #
Is it free? #
Yes, for all our clients.
Do I enter a code every time? #
At each new login. It takes seconds.
My code is rejected. #
Make sure your phone time is set automatically, and enter the number before it changes.
I changed phones; how do I move it? #
If you still have the old phone: disable it in Security Settings, then enable it again on the new phone. If not: log in with your backup code, then do the same.
Does it protect cPanel and email too? #
It protects your client area account, which opens cPanel directly, so that route is covered too. cPanel itself also has its own separate two-factor option under “Security”.
Does every user on my account need it? #
It is per user. We recommend everyone you invited to your account turns it on for themselves.
Can I use another app? #
Yes. Any TOTP app such as Microsoft Authenticator works the same way.
