Turn on two-factor sign-in

Two-factor sign-in asks for a six-digit code from an app on your phone as well as your password. It stops someone who has only your password from getting into an account that holds your hosting and your invoices.

What you need

An authenticator app that produces time-based codes (Google Authenticator, Microsoft Authenticator, Aegis, 1Password and most others).

Steps

1. Open Settings → Security. Under Two-factor sign-in, the row Authenticator app reads Not set up; press Turn on.
2. Press Enable two-factor.
3. 1. Scan this QR with your authenticator app. If you cannot scan, open Can't scan? Enter this key manually and use Copy key to paste the key into the app.
4. 2. Enter the 6-digit code it shows, then press Confirm & enable.
5. The page shows Two-factor is on. Save these one-time recovery codes somewhere safe — each works once if you lose your authenticator. There are 10 codes. Press Copy all or Download .txt and keep them somewhere that is not the same phone (a password manager, a printout). Then press I've saved these codes. They are shown only this once.

Turning two-factor on signs out your other devices.

Signing in from now on

Enter your email and password as usual. The page then says Enter your two-factor code to continue and shows a field labelled Two-factor code with the hint 6-digit code or a recovery code. Type the code from your app. A recovery code works in the same field.

After 5 wrong codes within 15 minutes the code step is locked: Too many wrong codes. Sign in with one of your recovery codes, or try again in a few minutes. A recovery code still works while it is locked.

Recovery codes

• Each code works once.
• To get a fresh set, go to Settings → Security → Two-factor sign-in → Manage and press Regenerate recovery codes. The old codes stop working and your other sessions are signed out.

Turning it off

Under Turn it off, enter your Current password and a Current 6-digit code, then press Disable two-factor. Your recovery codes are deleted with it.

Good to know

• Changing your password, changing your sign-in email, closing your account and adding a passkey all ask for a two-factor code once it is on.
• A password reset by email also asks for a code (or a recovery code).
• Lost the phone? Read Lost your two-factor device? now, while you still have the codes.