Two-factor authentication for websites: why and how

Passwords fail in predictable ways. People reuse them across sites, so a leak from one unrelated service gives attackers a list of working combinations to try everywhere else. People choose guessable ones. Phishing emails trick people into typing them into fake login pages. Malware on a computer records them as they are typed.

Automated attacks make this worse. Bots try thousands of leaked username and password pairs against login pages every day, which is called credential stuffing, and bots also try common passwords on every account name they can find. You do not need to be a target for your login page to be tried thousands of times.

Two-factor authentication changes the maths. Even with the correct password, the attacker still needs the second factor, which lives on your phone or in a physical key. For a website owner, that turns a catastrophic event, such as a stolen admin password, into an annoyance.

Start with your email. Almost every other account can be reset by email, so whoever controls your mailbox can take over everything else. Next, the account where you manage hosting and domains. A stolen hosting login can lead to deleted sites, redirected email and a changed domain, and a domain account compromise is among the worst things that can happen to a business online.

Then your website admin login. For WordPress, this protects the dashboard that attackers target most. After that, add it to anything holding customer data, payments or social media accounts. Do the most valuable accounts first and work down the list.

Each service has its own settings page, usually called security or sign-in, and enabling two-factor takes only a couple of minutes. The effort is tiny compared with the protection.

Two-factor authentication stops the majority of password-only attacks, but a determined phishing site can ask for your code as well and pass it to the real site in real time. Always check the address bar before typing a password, and treat any message that urges you to log in urgently with suspicion. Security keys and passkeys are better here because they refuse to work on a fake address.

Keep your devices updated too. An infected phone or computer can capture codes. Two-factor is one layer, not the whole wall, and it works best alongside updates, backups and a good security checklist.

Any mainstream authenticator app follows the same open standard, so a code from one will work with any service that supports it. Pick one that offers encrypted backup, a lock with a PIN or fingerprint, and the ability to move accounts to a new phone. Many password managers also include a built-in authenticator, which is convenient, though keeping your passwords and your codes in separate places means one breach does not give away both.

Treat the app like a key. Lock the phone, keep the operating system updated, and do not let codes be screenshotted or read out over the phone. No genuine support agent will ever ask you for a code. If someone does, hang up and contact the company through its official channels.