Two-factor authentication for your website admin: why it is not optional
A password alone protects nothing that matters. Why two-factor belongs on every admin, hosting and domain login, which kind to use, and how to roll it out.
Our position, stated plainly
Why a password is not enough
Passwords fail in ways that have nothing to do with how strong they are. A phishing page that looks exactly like the real login collects them. A breach at an unrelated service leaks a password that was reused. Malware on one laptop reads them as they are typed. In every case the attacker now has a valid password, and without a second factor, that is the whole key.
Which accounts
| Account | Why it matters |
|---|---|
| Website admin or content system | Change or deface the site, inject scripts, harvest form data |
| Hosting platform | Take the site down, change it, read environment secrets |
| Domain registrar | Transfer the domain away; the business is gone |
| DNS provider | Redirect the site and email anywhere |
| Email accounts | Reset every other password; read everything |
| Analytics and search tools | Less damaging, but access to data and verification |
| Payment and shop platforms | Money |
| Code repository | Change the site at source |
Every one of these should have two-factor enabled for every user, with no exceptions for “the owner” or “the one person who uses it”.
Which kind
- Authenticator app codes (time-based one-time passwords): the standard. Works everywhere, free, not tied to a phone number.
- Hardware security keys: the strongest, resistant to phishing, right for owners and administrators of critical accounts.
- Passkeys: increasingly available, combining strong security with no codes to type. Use them where the platform supports them.
- SMS codes: better than nothing, weaker than the rest because phone numbers can be taken over. A fallback, not a default.
Rolling it out in an afternoon
- Inventory the accounts in the table above and who has access to each.
- Enable two-factor per account per person, with an app or a key.
- Store recovery codes in the company password manager, never on the same phone.
- Ensure two people can reach every critical account, so a lost device is an inconvenience rather than a lockout.
- Remove or replace any service that cannot support two-factor. Its absence in 2026 is a statement about the service.
What this means for you
List the accounts in the table, and for each one answer: is two-factor on for every person, and where are the recovery codes? If any answer is no, that is this afternoon’s task. It is the cheapest security control you will ever put in place and the one that stops the most common attack there is.
Frequently asked questions
Our passwords are strong. Do we still need this?
Strong passwords leak too: through a phishing page that looks like the real login, through a breach at another service where the same password was used, through malware on a laptop. A second factor means the leaked password alone does not open the door. It is the single most effective control against account takeover.
Which second factor should we use?
An authenticator app that generates codes, or a hardware security key, for anything important. Codes sent by SMS are vulnerable to phone number takeover and should be the fallback, not the default. Many platforms now support passkeys, which combine convenience and strong security.
What if someone loses their phone?
That is what recovery codes are for. Each account generates them at setup; store them in the company password manager, not on the phone. Also keep at least two people with access to each critical account, so one lost device never locks the business out.
Can we skip it on accounts that only one person uses?
Those are the riskiest accounts, because a takeover is noticed last. The domain registrar login that one person uses once a year is exactly the account an attacker wants, and exactly the one with a reused password from 2018.
Sources
- OWASP Cheat Sheet: Multifactor Authentication (accessed 2026-09-11)