The measure that stops most attacks.
WHAT IT IS
A second step beyond your password: a code from an app, or a key.
WHY IT MATTERS
A stolen password alone is not enough.
That defeats the most common attack entirely.
WHERE TO ENABLE IT
Your hosting account Your domain registrar Your site administrator account Your email Your payment gateway
WHAT KIND
An authenticator app is better than codes by message.
Messages can be intercepted or redirected.
WHAT TO KEEP
Your recovery codes, somewhere safe and not on the same device.
Losing access to your second factor without recovery codes is a serious problem.
FOR TEAMS
Require it for everyone with administrative access.
WHAT IT DOES NOT PROTECT AGAINST
A compromised device Someone already inside your session
WHAT IT DOES PROTECT AGAINST
Every attack that relies on knowing your password.
That is most of them.
