Two-factor authentication on hosting and domain accounts

Why the accounts that control your domain, DNS and hosting need a second factor more than any other, which kind to use, and how to avoid locking yourself out.

3 minread 744words last updated

The short answer

The accounts that control your domain registration, your DNS and your hosting are the most powerful accounts your business has online. Whoever holds them can redirect your website, intercept your email, issue certificates in your name and take the domain itself. A password alone protects them only until it is reused somewhere that gets breached, guessed, or typed into a convincing fake login page. A second factor means the password is not enough: the attacker also needs something you hold. Enable it on every account that touches the site, registrar, DNS, hosting platform, repository, email service, payment provider and automation platform, using an authenticator app or a hardware key rather than text messages where you can. Store the recovery codes in the business’s password manager, give two people owner access with their own second factors, and a lost phone becomes an inconvenience rather than a lockout.

Second factors compared

MethodStrengthWeaknessUse for
Hardware security keyStrongest; resists phishing entirelyCosts a little; must be kept safe; needs a backup keyRegistrar, DNS, hosting, repository
Authenticator appStrong; codes generated on the devicePhishable by a live fake page; phone loss needs recovery codesEverything, where keys are not supported
Push approval in an appStrong when read carefullyFatigue attacks that spam approvals until someone taps yesAcceptable if the app shows details
Codes by text messageBetter than nothingPhone number takeover, interceptionOnly when nothing else is offered
Email codesWeak if the mailbox shares the passwordSame as text plus mailbox compromiseLast resort

Setting it up across the business

  1. List the accounts that touch the site, from the access register.
  2. Enable two-factor on each, choosing a key or an app; avoid text messages where an alternative exists.
  3. Store recovery codes in the password manager, shared with a second administrator.
  4. Confirm two owners on every critical account, each with their own second factor.
  5. Turn on the registrar lock and login and change alerts at the registrar and host.
  6. Buy a backup hardware key if keys are used, and register it too.
  7. Review yearly, and whenever someone joins or leaves.

Why these accounts specifically

A compromised website can be restored from the repository in minutes. A compromised registrar account can lose the domain, and with it the website, the email and the brand, for weeks or permanently. DNS control lets an attacker route email through their servers unnoticed. These are the accounts attackers target when they want a business rather than a website, and they are the ones most often protected by a password chosen years ago and reused since.

What this means for you

Put a second factor on every account that controls your domain, DNS, hosting and the services behind the site, prefer hardware keys or authenticator apps to text messages, keep recovery codes in the business’s password manager and have two owners with their own factors. It closes the most common route to losing control of your online presence, and it takes an afternoon across all the accounts.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Which second factor should we use?

A hardware security key where the platform supports it, an authenticator app otherwise. Codes sent by text message are better than nothing but can be intercepted by taking over the phone number, and the accounts that control a domain are exactly the ones worth that effort. Most registrars and hosting platforms support authenticator apps; the major ones support keys.

What if the person with the authenticator leaves or loses their phone?

That is what recovery codes and a second administrator are for. Recovery codes are generated when two-factor is enabled and stored in the business's password manager, accessible to at least two people. A second person holds owner access with their own second factor. Together they make a lost phone or a departure a minor event; without them, a lost phone can lock the business out of its own domain.

Is two-factor enough on its own?

It closes the most common attack, a reused or phished password, and it is the single most valuable step. It should sit alongside a registrar lock on the domain, per-person accounts rather than shared logins, an access register, and alerts from the registrar and host on logins and changes. Two-factor is the lock; those are the frame.

Sources

  1. NCSC (UK): Multi-factor authentication for online services (accessed 2026-09-12)