Two-factor authentication is a login method that asks for a second proof of identity on top of your password.
Two-factor authentication, often shortened to 2FA, means you need two different things to log in: something you know, like your password, plus something you have, like your phone or a security key. Even if someone steals or guesses your password, they still can't get in without the second factor.
In practice, you enter your password as normal and then type a six-digit code from an app on your phone, tap a prompt, or touch a hardware key. It adds a few seconds to each login and stops most account takeover attempts.
How two-factor authentication works
The most common method uses time-based one-time passwords (TOTP):
- When you turn on 2FA, the site shows a QR code containing a shared secret.
- You scan it with an authenticator app, which stores the secret.
- The app and the server both use the secret and the current time to generate the same six-digit code, which usually changes every 30 seconds.
- At login, you type the current code and the server checks that it matches.
Because the code changes constantly, an attacker who sees an old one can't reuse it later.
Types of two-factor authentication
- Authenticator apps: a strong choice and widely supported.
- Security keys and passkeys: hardware keys or device-based passkeys that resist phishing, because they only work on the genuine site.
- Push notifications: approve or deny a login on your phone.
- SMS codes: better than nothing, but vulnerable to SIM swap attacks.
- Backup codes: one-time codes you store safely in case you lose your device.
Why two-factor authentication matters for your website
Your hosting account, domain registrar, cPanel and WordPress admin are high-value targets. Whoever controls them controls your website, email and domain. Password leaks from other sites are common, and automated tools try those leaked passwords everywhere. 2FA blocks these attacks even when the password is known. Use a unique, strong password too; a password generator makes that easy.
Common two-factor authentication mistakes
- Not saving backup codes, then losing your phone
- Relying on SMS when an authenticator app or security key is available
- Turning 2FA on for the hosting account but not the domain registrar or email
- Approving a push prompt you didn't start, which is how "MFA fatigue" attacks work
2FA vs MFA
Multi-factor authentication (MFA) is the broader term for using two or more factors to log in. Two-factor authentication is the most common form of MFA, so the terms are often used interchangeably. Some services also offer passwordless logins with passkeys, which combine your device and a fingerprint or PIN into a single, phishing-resistant step.