Learning Hub · Beginner · 15 minutes
How to Enable Two-Factor Authentication
Make stolen passwords insufficient everywhere that matters — a practical, no-jargon walkthrough with the classic mistake flagged before you make it.
The short answer
Goal: make stolen passwords insufficient everywhere that matters. Time needed: 15 minutes. Difficulty: beginner.
The walkthrough below covers each step, the mistake most people make, and the shortcut worth knowing. On HostingAlly plans, several of the steps are handled for you — we note where.
Beginner
Difficulty
15 minutes
Time needed
5
Steps
24/7
Help if you're stuck
You don't need to be technical for this — the walkthrough is written for first-timers, tested against our own platform, and honest about which parts are genuinely fiddly versus merely unfamiliar.
Rule of the road: read the gotcha section before you begin, not after — it's harvested from the support tickets of people who didn't.
Overview before the detail
The whole job breaks into clear stages: start with an authenticator app, enable in the client area, enable in cpanel, store the recovery codes properly and extend to the satellite logins.
None of the stages requires code or a terminal unless the guide explicitly says so — and where it does, the exact commands are given. The full step-by-step sits below; the surrounding sections cover the context that makes it stick.
Where this goes wrong (and how to not)
Enabling 2FA and skipping the recovery codes — the lost or reset phone then locks you out of your own protection, converting a security feature into a support ticket with identity verification.
It's worth internalising because it's not a rare edge case — it's the single most common way this task generates a support ticket. Knowing it in advance converts the whole job from risky to routine.
The tip we give everyone
When changing phones, migrate the authenticator before wiping the old one — TOTP secrets transfer via the app's export; the two minutes of foresight beats re-enrolling every account.
It costs a minute now and repays it every time this task comes around again — which, like most hosting tasks, it will.
The parts you can skip on our hosting
Several steps in this guide exist because hosting historically made you do them — on our plans, SSL issues itself, backups run daily without being asked, and one-click installers replace manual setup entirely. What remains is the genuinely-yours part of the task.
And when a step misbehaves anyway, support answers around the clock — with the actual fix, not a knowledge-base link and a shrug. Half our best guides started as patterns in the tickets.
The platform this guide assumes
Every walkthrough in our Learning Hub is tested on the platform we actually run — cPanel, LiteSpeed, NVMe, one-click installs — so instructions match your screen instead of gesturing at it.
Renewal prices match signup prices, so the year-two invoice is the most boring email you'll get from us.
- Step-by-step, tested as written
- The gotcha flagged before you hit it
- Automation covers the boring steps
- 24/7 support if you get stuck
Why HostingAlly
What you get with every plan
No jargon tax
Terms are explained in place or linked to the glossary — nothing assumes you already know.
Help on standby
Stuck at step three at midnight? Support answers around the clock, mid-guide included.
Written from real tickets
Our guides come from the support desk — the gotchas are the ones people actually hit.
The undo is always named
Where a step could bite, the guide says so and gives the reversal.
Works as written
Every step tested on our own platform — no 'your host may vary' hand-waving.
Automation where it belongs
SSL, backups and installs run themselves here — the guide covers only what's genuinely yours to do.
Getting Started
How to get going
- 1
Start with an authenticator app
Any TOTP app (Aegis, Google Authenticator, 1Password) — app codes beat SMS, which is vulnerable to number-porting attacks.
- 2
Enable in the client area
Security settings → scan the QR into the app → confirm with a code — the billing account guards services and domains; it goes first.
- 3
Enable in cPanel
The panel's Two-Factor Authentication feature, same ritual — panel access can modify everything hosted, so it gets its own enrolment.
- 4
Store the recovery codes properly
The backup codes shown at setup go into your password manager — they're the answer to the lost-phone scenario, and setup is the only time they're offered.
- 5
Extend to the satellite logins
WordPress admin, the domain registrar if separate, the email that recovers it all — 2FA's value compounds with coverage.
Included
What's covered on our plans
- 99.9% uptime commitment, monitored around the clock
- 24/7 support from real people
- NVMe SSD storage as standard
- SSH, Git and Composer access on developer-friendly plans
- Free website migration handled by our team
- DDoS protection at the network level
- Free domain for the first year on annual plans
- Per-site PHP version selection
- No setup fees, ever
- Renewal prices that match signup prices
FAQ
Your questions, answered
Is app-based 2FA really necessary for a small site?
It's the highest-value security minute available — credential leaks are constant and automated, and 2FA converts every leaked password from incident to non-event. Size isn't the criterion; having anything worth keeping is.
What if I lose my phone?
Recovery codes (stored at setup) restore access, after which you re-enrol the new device. Without codes, support can verify identity and reset — slower by design, since that same door is what attackers would try.
Will you move my existing website for free?
Yes — open a ticket with your current host's access details and we handle the whole move: files, databases, email and configuration, verified by you before DNS switches. The old site keeps serving until the new copy takes over, so visitors never see a gap.
Which control panel do you provide?
cPanel — the industry standard, which means every tutorial on the internet matches your screen, your backups restore anywhere cPanel runs, and skills learned here transfer for life. Plesk and DirectAdmin options exist on specific plans for those who prefer them.
Is SSL really included at no cost?
On every plan, with no exceptions — certificates are issued automatically when your domain points to us and renew themselves before expiry. The encryption is identical to paid DV certificates; paid tiers exist only for wildcard convenience or organisation-level validation.
Can I host more than one website on a plan?
On the Pro tier and above, yes — multiple sites with their own domains, email and SSL under one account. If the extra sites belong to clients rather than you, reseller hosting gives each one proper isolation instead.
Do prices go up at renewal?
No — the price you sign up at is the price you renew at. We don't run teaser-rate economics, so there's no year-two ambush to plan around, and your bookkeeping can rely on the number staying put.
Keep exploring
How to Set Up DKIM Signing
Cryptographically sign your mail so tampering and spoofing show — intermediate level, 15 minutes.
How to Stop Your Email Going to Spam
Diagnose and repair your mail's reputation systematically — intermediate level, an afternoon.
Domain Names
Search, register and transfer domains — first year free on annual hosting.
VPS Hosting
KVM virtual servers with root access, DDoS protection and flat pricing.
Launch it properly this time.
Every plan includes the essentials others sell as extras — and support that actually answers.
See Hosting Plans