---
title: "Two-Factor Authentication for Your Client Area Account"
description: "**In short:** Two-factor authentication stops anyone logging in to your account even if they know your password. To turn it on: install Google Authenticator on your phone, then in the client area: Hello → Security Settings → \"Click here to…"
url: "https://www.hyyat.com/en/knowledgebase/how-to-enable-two-factor-authentication-2fa-for-your-client-area-account/"
updated: "2026-10-07"
category: Use the customer area / Account and Security
tags:
  - google authenticator
---

# Two-Factor Authentication for Your Client Area Account

**In short:** Two-factor authentication stops anyone logging in to your account even if they know your password. To turn it on: install Google Authenticator on your phone, then in the client area: Hello → Security Settings → "Click here to Enable" → "Get Started", scan the code with the app and enter the 6-digit number. Save your backup code somewhere safe.

**Short video (28 seconds)**

## Why turn on two-factor authentication?

Imagine someone learned your email and password from a leak elsewhere or a phishing message. Without two-factor authentication they can log in just like you. With it, they also need a number that changes every 30 seconds and lives only on your phone.

- Protects you if your password leaks from another site.
- Free, and takes less than two minutes to set up.
- The code comes from an app on your phone, not a text message, so it cannot be intercepted.

## What does it protect?

Your client area account is the key to all your services: it opens cPanel without a password, manages domains and nameservers, requests transfer codes and opens tickets in your name. Anyone who gets in could transfer your domain, repoint it, or reach your website files. Two-factor authentication closes that door, because logging in needs two things together: a password you know and a phone you own.

| Without 2FA | With 2FA |
| --- | --- |
| The password alone is enough to log in | You need the password + a number from your phone |
| A leaked password means access to your account | A leaked password is not enough on its own |
| You do not know if someone tries | No login happens without your phone |

## Step 1: install the app

Install the free **Google Authenticator** app on your phone: [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) | [iPhone](https://apps.apple.com/app/google-authenticator/id388497605).

## Step 2: turn it on for your account

1. Log in, and from the **Hello** menu choose **Security Settings**, or [open it directly](https://www.hyyatdomain.com/index.php?rp=/user/security&language=english).

![The Hello menu with Security Settings](https://www.hyyat.com/wp-content/uploads/hyyat-kb-img/account/acc-2fa-1-en.svg)

1. Under **Two-Factor Authentication** click **Click here to Enable**, then **Get Started**.

![Two-Factor Authentication in Security Settings with Click here to Enable](https://www.hyyat.com/wp-content/uploads/hyyat-kb-img/account/acc-2fa-2-en.svg)

1. Open the app, tap **+** then **Scan a QR code**, and point the camera at the code on screen. The app shows a 6-digit number; enter it on the page and click **Submit**.
2. You will see "Two-Factor Authentication is now enabled" with your **Backup Code**. Copy it and keep it safe: it is your way in if you lose your phone.

![QR code, app number entry and backup code](https://www.hyyat.com/wp-content/uploads/hyyat-kb-img/account/acc-2fa-3-en.svg)

## Logging in after you turn it on

After your email and password, you will see "Your second factor is required to complete login". Open the app and enter the number it shows. If it changes before you finish, enter the new one.

![Second factor page with the backup code login option](https://www.hyyat.com/wp-content/uploads/hyyat-kb-img/account/acc-2fa-4-en.svg)

## Lost your phone or want to turn it off?

1. On the code page click **Login using Backup Code** and enter your backup code. It works once, and a new one is shown: save that too.
2. In **Security Settings** click **Click here to Disable** and enter your account password (not the app code) to confirm.
3. Turn it on again on your new phone with the same steps.

 **Lost both your phone and backup code?** Open a [support ticket](https://www.hyyat.com/en/knowledgebase/open-support-ticket/) from your account email and we will verify your identity before removing it.

## FAQ

### Is it free?

Yes, for all our clients.

### Do I enter a code every time?

At each new login. It takes seconds.

### My code is rejected.

Make sure your phone time is set automatically, and enter the number before it changes.

### I changed phones; how do I move it?

If you still have the old phone: disable it in Security Settings, then enable it again on the new phone. If not: log in with your backup code, then do the same.

### Does it protect cPanel and email too?

It protects your client area account, which opens cPanel directly, so that route is covered too. cPanel itself also has its own separate two-factor option under "Security".

### Does every user on my account need it?

It is per user. We recommend everyone you [invited to your account](https://www.hyyat.com/en/knowledgebase/invite-users-client-area/) turns it on for themselves.

### Can I use another app?

Yes. Any TOTP app such as Microsoft Authenticator works the same way.

 **Related guides**

- [Log in with Google](https://www.hyyat.com/en/knowledgebase/client-area-login-google-facebook/)
- [Change your security question](https://www.hyyat.com/en/knowledgebase/change-security-question/)
- [Invite users and manage permissions](https://www.hyyat.com/en/knowledgebase/invite-users-client-area/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)