Two-factor authentication for the client area and cPanel

A password can be guessed, stolen by malware or reused from a site that was breached. With two-factor authentication (2FA), the password alone is no longer enough: every sign-in also asks for a 6-digit code produced by an app on your phone. The code changes every 30 seconds.

What you need

An authenticator app on your phone: Google Authenticator, Microsoft Authenticator and Authy are common choices. A password manager that can generate these codes works too.

Turning it on in the TopHost client area

1. Sign in to the client area and open your security settings.
2. In the two-factor authentication section, start the setup.
3. In the phone app, add a new account and scan the QR code on the screen.
4. Type the 6-digit code from the app into the page and confirm.
5. Write down the backup code shown at the end and store it away from your phone. Without it, getting back in is much harder.

Turning it on in cPanel

1. In cPanel, go to the Security section and choose Two-Factor Authentication.
2. Click Set Up Two-Factor Authentication.
3. Open the authenticator app and read the QR code with it.
4. Enter the generated code and click Configure.

The setup page also shows a secret key, a string of letters and digits. Save it: with it you can add the account to an app again if you replace or lose your phone.

If you lose your phone

• Client area: sign in with the backup code, then set up 2FA again on the new phone.
• cPanel: add the saved secret key to an app on another device.
• Neither the code nor the key: write to us in a ticket sent from the email address registered on the account, so we can confirm you are the holder.

Tips and common mistakes

• The code is always rejected. Check the time on your phone. The codes depend on it, so the time should be set automatically.
• Getting a new phone. Move your accounts to the app on the new phone before you reset the old one.
• Moving a website to us. If you give us access to your old provider for the migration, switch 2FA off there for a while, then back on.
• Mail and WordPress have their own settings. 2FA on the client area and cPanel does not protect mailboxes or the WordPress dashboard. For WordPress, use a dedicated plugin such as Two Factor from wordpress.org.

Related articles

• Forgotten password? Where to reset it for the client area, cPanel, mail and FTP
• Hosting security at TopHost: what we protect and what is up to you
• Protecting and analyzing WordPress website security