Two-factor authentication on hosting and domain accounts
Why the accounts that control your domain, DNS and hosting need a second factor more than any other, which kind to use, and how to avoid locking yourself out.
The short answer
The accounts that control your domain registration, your DNS and your hosting are the most powerful accounts your business has online. Whoever holds them can redirect your website, intercept your email, issue certificates in your name and take the domain itself. A password alone protects them only until it is reused somewhere that gets breached, guessed, or typed into a convincing fake login page. A second factor means the password is not enough: the attacker also needs something you hold. Enable it on every account that touches the site, registrar, DNS, hosting platform, repository, email service, payment provider and automation platform, using an authenticator app or a hardware key rather than text messages where you can. Store the recovery codes in the business’s password manager, give two people owner access with their own second factors, and a lost phone becomes an inconvenience rather than a lockout.
Second factors compared
| Method | Strength | Weakness | Use for |
|---|---|---|---|
| Hardware security key | Strongest; resists phishing entirely | Costs a little; must be kept safe; needs a backup key | Registrar, DNS, hosting, repository |
| Authenticator app | Strong; codes generated on the device | Phishable by a live fake page; phone loss needs recovery codes | Everything, where keys are not supported |
| Push approval in an app | Strong when read carefully | Fatigue attacks that spam approvals until someone taps yes | Acceptable if the app shows details |
| Codes by text message | Better than nothing | Phone number takeover, interception | Only when nothing else is offered |
| Email codes | Weak if the mailbox shares the password | Same as text plus mailbox compromise | Last resort |
Setting it up across the business
- List the accounts that touch the site, from the access register.
- Enable two-factor on each, choosing a key or an app; avoid text messages where an alternative exists.
- Store recovery codes in the password manager, shared with a second administrator.
- Confirm two owners on every critical account, each with their own second factor.
- Turn on the registrar lock and login and change alerts at the registrar and host.
- Buy a backup hardware key if keys are used, and register it too.
- Review yearly, and whenever someone joins or leaves.
Why these accounts specifically
A compromised website can be restored from the repository in minutes. A compromised registrar account can lose the domain, and with it the website, the email and the brand, for weeks or permanently. DNS control lets an attacker route email through their servers unnoticed. These are the accounts attackers target when they want a business rather than a website, and they are the ones most often protected by a password chosen years ago and reused since.
What this means for you
Put a second factor on every account that controls your domain, DNS, hosting and the services behind the site, prefer hardware keys or authenticator apps to text messages, keep recovery codes in the business’s password manager and have two owners with their own factors. It closes the most common route to losing control of your online presence, and it takes an afternoon across all the accounts.
Frequently asked questions
Which second factor should we use?
A hardware security key where the platform supports it, an authenticator app otherwise. Codes sent by text message are better than nothing but can be intercepted by taking over the phone number, and the accounts that control a domain are exactly the ones worth that effort. Most registrars and hosting platforms support authenticator apps; the major ones support keys.
What if the person with the authenticator leaves or loses their phone?
That is what recovery codes and a second administrator are for. Recovery codes are generated when two-factor is enabled and stored in the business's password manager, accessible to at least two people. A second person holds owner access with their own second factor. Together they make a lost phone or a departure a minor event; without them, a lost phone can lock the business out of its own domain.
Is two-factor enough on its own?
It closes the most common attack, a reused or phished password, and it is the single most valuable step. It should sit alongside a registrar lock on the domain, per-person accounts rather than shared logins, an access register, and alerts from the registrar and host on logins and changes. Two-factor is the lock; those are the frame.
Sources
- NCSC (UK): Multi-factor authentication for online services (accessed 2026-09-12)