Short answer: Sign in at dash.cloudflare.com, go to My Profile → Authentication, and enable Two-Factor Authentication. Use a hardware security key if you have one — Cloudflare supports WebAuthn — or an authenticator app otherwise. Save the backup codes offline, then audit your API tokens, because a leaked token bypasses your login entirely.
Why this account outranks almost everything else you own
Cloudflare usually sits in front of your website and controls your DNS. That means it decides where your domain points, what certificates are issued, and who sees your traffic.
An attacker with your Cloudflare account can redirect your website to their server, redirect your email by changing MX records — which hands them your password resets everywhere — and issue valid certificates so nothing looks wrong to visitors. They can do all of it without ever touching your hosting or your CMS.
If you also use Cloudflare for Zero Trust, tunnels, Workers or R2, the account controls internal access and application code as well.
It belongs in the same tier as your email and your domain registrar: infrastructure accounts that everything else depends on.
Step 1: Enable two-factor authentication
- Sign in at dash.cloudflare.com.
- Click your profile icon (top right) → My Profile.
- Open the Authentication tab.
- Under Two-Factor Authentication, click Manage or the toggle.
- Enter your password to confirm.
Step 2: Choose a security key if you possibly can
Cloudflare supports both:
- Security keys (WebAuthn) — hardware keys such as a YubiKey, or platform passkeys. These are phishing-resistant: the credential is bound to Cloudflare’s domain, so a convincing fake login page simply cannot use it. See hardware security keys and WebAuthn and FIDO2.
- Authenticator app (TOTP) — six-digit codes, generated offline. Fine, and better than nothing by a wide margin.
For an account that controls your DNS, the extra cost of two hardware keys is easily justified. Register both — a primary and a backup stored elsewhere — so losing one is an inconvenience rather than an outage.
If you set up TOTP, scan the QR code with any standard app: Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or a password manager. See what is an authenticator app if this is new.
Do not screenshot the QR code. And be aware that many people configure Cloudflare during screen shares with developers or hosts — set this up alone.
Step 3: Save the backup codes
Cloudflare issues downloadable backup codes. Store them offline, and not on the website Cloudflare is protecting — an obvious point that is missed surprisingly often.
See where to store 2FA backup codes safely. For a business-critical account, a printed copy in a physical safe is appropriate.
Step 4: Audit your API tokens — this is the important bit
Two-factor authentication protects the dashboard login. It does not protect API access, and Cloudflare’s API can do everything the dashboard can.
Under My Profile → API Tokens:
- Review every token and Global API Key. Delete anything you cannot account for.
- Stop using the Global API Key. It has full account permissions and cannot be scoped. Replace it with scoped API tokens.
- Scope tokens narrowly — specific zones, specific permissions, read-only where possible.
- Set IP restrictions and expiry dates on tokens where you can.
- Rotate tokens that have been in CI systems, deployment scripts or shared with contractors.
Leaked API tokens in public repositories are a well-documented problem. A token in an old GitHub commit gives an attacker your DNS regardless of how strong your login security is.
Step 5: For teams and businesses
- Members — under Manage Account → Members, review who has access and at what role. Remove former developers, agencies and hosts. Use scoped roles rather than making everyone Super Administrator.
- Enforce 2FA for all members where your plan supports it.
- Use SSO on Enterprise plans, enforcing phishing-resistant methods at the identity provider.
- Audit logs — check them periodically for configuration changes you did not make.
- Notifications — turn on alerts for DNS record changes and login events. On an infrastructure account, early warning is everything.
The wider pattern for shared access is in 2FA for small teams.
Step 6: The registrar underneath
Cloudflare protects your site, but your domain lives at a registrar — sometimes Cloudflare itself, often elsewhere. Whoever controls the registrar can point the domain away from Cloudflare entirely.
Secure both, and turn on registrar lock. Full checklist: how to secure your domain name with 2FA.
Frequently asked questions
Does 2FA on Cloudflare protect my website’s visitors?
No. It protects your account. Visitor-facing security comes from your WAF rules, TLS settings, bot management and origin protection — separate configuration entirely.
Can I use both a security key and an authenticator app?
Yes, and you should. Register multiple methods so losing one device does not lock you out of your DNS.
What if I lose access completely?
Use backup codes or a second registered key. Cloudflare support can assist with verification, but expect a rigorous process — appropriate for an account of this power. See recovering accounts after losing your 2FA phone.
Why is my TOTP code rejected?
Usually clock drift on your phone. Turn on automatic network time. More: why 2FA codes get rejected.
Do API tokens stop working when I enable 2FA?
No — that is exactly the point to understand. API access is independent of dashboard 2FA, which is why auditing tokens is part of securing the account rather than an optional extra.
My Cloudflare account was compromised. What first?
Change the password and end all sessions, then immediately check DNS records — especially MX and any A records — and revoke every API token. Then check your email account, which is usually how they got in (what to do if your email is hacked).
The bottom line
Two hardware keys if you can, an authenticator app if not, backup codes printed and stored physically, and — most importantly — every API token reviewed and scoped. The login is only half of this account’s attack surface, and the half most people secure is not the half that usually leaks.
Also running WordPress behind it? See how to set up 2FA on WordPress.