Short answer: There are two separate logins to secure — your hosting billing account (where you manage the plan) and cPanel or the control panel itself. Enable 2FA on both. In cPanel it is under Security → Two-Factor Authentication, where you scan a QR code with any authenticator app. Then lock down SSH, FTP and database access, because those bypass the panel entirely.
Why hosting sits near the top of the stack
People secure their WordPress admin carefully and leave the hosting account on a password from 2019. That is backwards.
Your hosting account controls the files under your website, the databases behind it, the email accounts on your domain, and often the DNS. Someone with that access does not need your WordPress password — they can edit files directly, create an admin user in the database, or read every email your domain receives.
Email is the part people miss. If your business email runs on your hosting, an attacker there receives your password resets for everything else.
Step 1: Secure the billing account first
Your account at the hosting company — Hostinger, SiteGround, Bluehost, Namecheap, GoDaddy, whoever — is the master. It can reset the cPanel password, restore backups, transfer domains and open support tickets in your name.
Look under Account settings or Security, and enable two-factor authentication with an authenticator app rather than SMS where the option exists. New to this? See what is an authenticator app.
Also check:
- The email address on the account — and make sure it is not an address hosted on that same account. If the hosting breaks, so does your recovery route.
- Support PIN where offered, so a caller cannot social-engineer the helpdesk.
- Sub-users and delegated access — remove developers and agencies who no longer work with you.
Step 2: Enable 2FA in cPanel
- Log in to cPanel.
- Find the Security section and open Two-Factor Authentication.
- Click Set Up Two-Factor Authentication.
- Scan the QR code with your authenticator app, or use the displayed account key manually — see manual key entry.
- Enter the six-digit code and click Configure.
Any standard TOTP app works — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or a password manager. Do not screenshot the QR code; it contains your raw secret (what’s inside a 2FA QR code).
One important caveat: cPanel’s 2FA has no backup codes. If you lose your authenticator, you need your hosting provider to disable it — which is why enrolling a second device at setup matters more here than almost anywhere else. See how to back up your authenticator app.
If your host uses Plesk, DirectAdmin or a custom panel, look for the equivalent under security settings — all the major panels support TOTP now.
Step 3: Close the doors 2FA does not cover
This is where hosting security is actually won or lost. Panel 2FA protects the panel; these protocols do not go through it.
- SSH — disable password authentication entirely and use key-based login. Change the default port if you like, but keys are the substantive change. Disable direct root login.
- FTP — turn it off. It transmits credentials in clear text. Use SFTP or FTPS instead, and delete old FTP accounts created for developers years ago.
- phpMyAdmin and database users — restrict remote MySQL access to specific IPs, and use distinct users with minimum privileges per application.
- WHM — if you have reseller or server-level access, secure it with its own 2FA. It sits above cPanel.
- API tokens — cPanel and WHM issue API tokens that work without 2FA. Review and revoke anything unfamiliar, exactly as you would at Cloudflare.
- Email accounts — each mailbox on your domain has its own password. Weak ones are a common route in, and mail credentials are heavily brute-forced.
Step 4: The rest of the chain
Your website’s security is the weakest link across four accounts:
- Domain registrar — controls where the domain points. See securing your domain name.
- DNS provider — often Cloudflare: 2FA on Cloudflare.
- Hosting — this article.
- The application — for example 2FA on WordPress.
Securing one and ignoring the others is common and pointless. An attacker takes whichever is easiest.
Step 5: Backups you have actually tested
Not strictly 2FA, but it belongs in the same conversation: if your host holds your only backups and your hosting account is compromised, the attacker can delete them.
Keep at least one copy of your site and database somewhere the hosting account cannot reach — a separate cloud storage account or a local copy. And restore it once, to a staging site, so you know it works.
Frequently asked questions
Does cPanel 2FA have backup codes?
No. If you lose your authenticator, your hosting provider must disable it for you. Enrol two devices at setup to avoid needing that call.
Which authenticator app works with cPanel?
Any standard TOTP app — cPanel uses the normal algorithm. See how TOTP codes work.
Why is my cPanel code rejected?
Frequently a server clock issue rather than your phone. TOTP requires both ends to agree on the time, so ask your host to check NTP sync if your codes work everywhere else. More: why 2FA codes get rejected.
My host does not offer 2FA at all. What now?
Use a long unique password, restrict panel access by IP if the option exists, and treat it as a reason to consider moving. In 2026, a host without 2FA on the control panel is behind.
Should my developer have their own login?
Yes. Create a separate cPanel user or FTP/SFTP account with limited scope, and remove it when the work ends. Never share your main credentials — see 2FA for freelancers for how this looks from the other side, and 2FA on Upwork and Fiverr if you hire through those marketplaces.
My site was hacked. Is 2FA enough now?
No. Change every password, rotate API tokens and database credentials, check for added cPanel users and cron jobs, look for injected files and backdoors, and restore from a known-clean backup. Attackers leave persistence behind; 2FA added afterwards does not remove it.
The bottom line
Two logins to protect, not one — billing account and control panel — and then the protocols that skip both: SSH, FTP, database and API access. Enrol two devices in cPanel because there are no backup codes, keep a backup your host cannot delete, and make sure the recovery email is not hosted on the account it is meant to recover.
Running WordPress on top? Finish the job with 2FA on WordPress.
One Response