{"id":17580,"date":"2017-04-28T01:42:31","date_gmt":"2017-04-27T22:42:31","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/%d9%83%d9%8a%d9%81%d9%8a%d8%a9-%d8%aa%d9%81%d8%b9%d9%8a%d9%84-%d8%ad%d9%85%d8%a7%d9%8a%d8%a9-%d8%a7%d9%84%d8%af%d8%ae%d9%88%d9%84-%d9%84%d8%ad%d8%b3%d8%a7%d8%a8%d9%83%d9%85-%d8%a8%d9%85%d9%86%d8%b7\/"},"modified":"2026-10-08T00:07:24","modified_gmt":"2026-10-07T21:07:24","password":"","slug":"how-to-enable-two-factor-authentication-2fa-for-your-client-area-account","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/how-to-enable-two-factor-authentication-2fa-for-your-client-area-account\/","title":{"rendered":"Two-Factor Authentication for Your Client Area Account"},"content":{"rendered":"<div class=\"hy-tldr\" style=\"background:#f6f7fb;border-left:4px solid #d83954;border-radius:10px;padding:14px 18px;margin:0 0 20px;line-height:1.9\"><strong>In short:<\/strong> Two-factor authentication stops anyone logging in to your account even if they know your password. To turn it on: install Google Authenticator on your phone, then in the client area: Hello \u2192 Security Settings \u2192 &#8220;Click here to Enable&#8221; \u2192 &#8220;Get Started&#8221;, scan the code with the app and enter the 6-digit number. Save your backup code somewhere safe.<\/div>\n<div class=\"hy-vid\" style=\"margin:0 0 22px\">\n<p><strong>Short video (28 seconds)<\/strong><\/p>\n<div style=\"width: 1280px;\" class=\"wp-video\"><video class=\"wp-video-shortcode\" id=\"video-17580-1\" width=\"1280\" height=\"720\" poster=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/acc-2fa-en-poster.jpg\" preload=\"none\" controls=\"controls\"><source type=\"video\/mp4\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/acc-2fa-en.mp4?_=1\" \/><a href=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/acc-2fa-en.mp4\">https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/acc-2fa-en.mp4<\/a><\/video><\/div><\/div>\n<h2>Why turn on two-factor authentication?<\/h2>\n<p>Imagine someone learned your email and password from a leak elsewhere or a phishing message. Without two-factor authentication they can log in just like you. With it, they also need a number that changes every 30 seconds and lives only on your phone.<\/p>\n<ul>\n<li>Protects you if your password leaks from another site.<\/li>\n<li>Free, and takes less than two minutes to set up.<\/li>\n<li>The code comes from an app on your phone, not a text message, so it cannot be intercepted.<\/li>\n<\/ul>\n<h2>What does it protect?<\/h2>\n<p>Your client area account is the key to all your services: it opens cPanel without a password, manages domains and nameservers, requests transfer codes and opens tickets in your name. Anyone who gets in could transfer your domain, repoint it, or reach your website files. Two-factor authentication closes that door, because logging in needs two things together: a password you know and a phone you own.<\/p>\n<table style=\"width:100%;border-collapse:collapse;margin:12px 0 20px\">\n<tr>\n<th style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top;background:#f1f5fb;font-weight:700\">Without 2FA<\/th>\n<th style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top;background:#f1f5fb;font-weight:700\">With 2FA<\/th>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">The password alone is enough to log in<\/td>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">You need the password + a number from your phone<\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">A leaked password means access to your account<\/td>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">A leaked password is not enough on its own<\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">You do not know if someone tries<\/td>\n<td style=\"border:1px solid #e3eaf3;padding:10px 12px;vertical-align:top\">No login happens without your phone<\/td>\n<\/tr>\n<\/table>\n<h2>Step 1: install the app<\/h2>\n<p>Install the free <strong>Google Authenticator<\/strong> app on your phone: <a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.google.android.apps.authenticator2\" target=\"_blank\" rel=\"noopener\">Android<\/a> | <a href=\"https:\/\/apps.apple.com\/app\/google-authenticator\/id388497605\" target=\"_blank\" rel=\"noopener\">iPhone<\/a>.<\/p>\n<h2>Step 2: turn it on for your account<\/h2>\n<ol>\n<li>Log in, and from the <strong>Hello<\/strong> menu choose <strong>Security Settings<\/strong>, or <a href=\"https:\/\/www.hyyatdomain.com\/index.php?rp=\/user\/security&#038;language=english\" target=\"_blank\" rel=\"noopener\">open it directly<\/a>.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" class=\"alignnone hy-dcimg\" src=\"https:\/\/www.hyyat.com\/zasogooh\/hyyat-kb-img\/account\/acc-2fa-1-en.svg\" alt=\"The Hello menu with Security Settings\" width=\"860\" height=\"520\" loading=\"lazy\" decoding=\"async\" \/><\/p>\n<ol>\n<li>Under <strong>Two-Factor Authentication<\/strong> click <strong>Click here to Enable<\/strong>, then <strong>Get Started<\/strong>.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" class=\"alignnone hy-dcimg\" src=\"https:\/\/www.hyyat.com\/zasogooh\/hyyat-kb-img\/account\/acc-2fa-2-en.svg\" alt=\"Two-Factor Authentication in Security Settings with Click here to Enable\" width=\"860\" height=\"470\" loading=\"lazy\" decoding=\"async\" \/><\/p>\n<ol>\n<li>Open the app, tap <strong>+<\/strong> then <strong>Scan a QR code<\/strong>, and point the camera at the code on screen. The app shows a 6-digit number; enter it on the page and click <strong>Submit<\/strong>.<\/li>\n<li>You will see &#8220;Two-Factor Authentication is now enabled&#8221; with your <strong>Backup Code<\/strong>. Copy it and keep it safe: it is your way in if you lose your phone.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" class=\"alignnone hy-dcimg\" src=\"https:\/\/www.hyyat.com\/zasogooh\/hyyat-kb-img\/account\/acc-2fa-3-en.svg\" alt=\"QR code, app number entry and backup code\" width=\"860\" height=\"440\" loading=\"lazy\" decoding=\"async\" \/><\/p>\n<h2>Logging in after you turn it on<\/h2>\n<p>After your email and password, you will see &#8220;Your second factor is required to complete login&#8221;. Open the app and enter the number it shows. If it changes before you finish, enter the new one.<\/p>\n<p><img loading=\"lazy\" class=\"alignnone hy-dcimg\" src=\"https:\/\/www.hyyat.com\/zasogooh\/hyyat-kb-img\/account\/acc-2fa-4-en.svg\" alt=\"Second factor page with the backup code login option\" width=\"860\" height=\"420\" loading=\"lazy\" decoding=\"async\" \/><\/p>\n<h2>Lost your phone or want to turn it off?<\/h2>\n<ol>\n<li>On the code page click <strong>Login using Backup Code<\/strong> and enter your backup code. It works once, and a new one is shown: save that too.<\/li>\n<li>In <strong>Security Settings<\/strong> click <strong>Click here to Disable<\/strong> and enter your account password (not the app code) to confirm.<\/li>\n<li>Turn it on again on your new phone with the same steps.<\/li>\n<\/ol>\n<div style=\"border:1.5px solid #e3eaf3;border-inline-start:5px solid #f7931e;border-radius:14px;padding:12px 16px;margin:16px 0;line-height:1.9\"><strong>Lost both your phone and backup code?<\/strong> Open a <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/open-support-ticket\/\">support ticket<\/a> from your account email and we will verify your identity before removing it.<\/div>\n<h2>FAQ<\/h2>\n<h3>Is it free?<\/h3>\n<p>Yes, for all our clients.<\/p>\n<h3>Do I enter a code every time?<\/h3>\n<p>At each new login. It takes seconds.<\/p>\n<h3>My code is rejected.<\/h3>\n<p>Make sure your phone time is set automatically, and enter the number before it changes.<\/p>\n<h3>I changed phones; how do I move it?<\/h3>\n<p>If you still have the old phone: disable it in Security Settings, then enable it again on the new phone. If not: log in with your backup code, then do the same.<\/p>\n<h3>Does it protect cPanel and email too?<\/h3>\n<p>It protects your client area account, which opens cPanel directly, so that route is covered too. cPanel itself also has its own separate two-factor option under &#8220;Security&#8221;.<\/p>\n<h3>Does every user on my account need it?<\/h3>\n<p>It is per user. We recommend everyone you <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/invite-users-client-area\/\">invited to your account<\/a> turns it on for themselves.<\/p>\n<h3>Can I use another app?<\/h3>\n<p>Yes. Any TOTP app such as Microsoft Authenticator works the same way.<\/p>\n<div class=\"hy-rel\" style=\"border:1.5px solid #e3eaf3;border-radius:14px;padding:14px 18px;margin:24px 0 0;line-height:1.9\"><strong>Related guides<\/strong><\/p>\n<ul style=\"margin:8px 0 0\">\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/client-area-login-google-facebook\/\">Log in with Google<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/change-security-question\/\">Change your security question<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/invite-users-client-area\/\">Invite users and manage permissions<\/a><\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In short: Two-factor authentication stops anyone logging in to your account even if they know your password. To turn it on: install Google Authenticator on your phone, then in the client area: Hello \u2192 Security Settings \u2192 &#8220;Click here to Enable&#8221; \u2192 &#8220;Get Started&#8221;, scan the code with the app and enter the 6-digit number. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":18667,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2939],"doc_tag":[2926],"class_list":["post-17580","docs","type-docs","status-publish","has-post-thumbnail","hentry","doc_category-account-and-security","doc_tag-google-authenticator-en"],"year_month":"2026-10","word_count":694,"total_views":"368","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"admin","author_nicename":"admin","author_url":"https:\/\/www.hyyat.com\/en\/author\/admin\/"},"doc_category_info":[{"term_name":"Account and Security","term_url":"https:\/\/www.hyyat.com\/en\/kb\/account-and-security\/"}],"doc_tag_info":[{"term_name":"google authenticator","term_url":"https:\/\/www.hyyat.com\/en\/docs-tag\/google-authenticator-en\/"}],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/17580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=17580"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/17580\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media\/18667"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=17580"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=17580"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=17580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}