The short answer
Two-factor authentication asks for a second proof after your password, such as a code from an app or a tap on a security key. Authenticator apps and security keys are stronger than text messages. Set it up on your email first, save your backup codes somewhere safe, and then turn it on for site, ads and analytics accounts.
What two-factor sign-in actually is
Two-factor authentication, often shortened to 2FA, means proving who you are in two different ways. Normally one is something you know, your password, and the other is something you have, such as your phone or a small key, or something you are, such as a fingerprint. CISA, the US cybersecurity agency, says that any multi-factor authentication is better than none, while stronger types are preferred.
The reason it matters is simple. Passwords leak in data breaches that have nothing to do with your site, and people reuse them. A criminal who has your password still cannot get in if they do not also have your phone or key. See the glossary entry for a short definition.
The options compared
CISA describes the FIDO protocol used by security keys and passkeys as the widely available method that is phishing-resistant: if you are tricked into signing in on a fake website, the key will not answer. Its guidance says that if phishing-resistant MFA is not available, text-based methods are exposed to SMS-based attacks.
| Method | How it works | Strength | Watch out for |
|---|---|---|---|
| Authenticator app | An app on your phone shows a six-digit code that changes every 30 seconds or so | Strong. Works without a phone signal | Moving to a new phone needs the codes transferred or backup codes |
| Security key or passkey | A small physical key you tap, or a device-based passkey using fingerprint, face or screen lock | Strongest. Google says passkeys and security keys protect against phishing attacks | Buy two so one is a spare. Check that each service supports them |
| Text message (SMS) | A code is texted to your phone | Better than nothing, weaker than the others | Google says codes sent by text are more vulnerable to phone-number-based hacks. Shopify no longer lets you set up SMS as a new method |
| Prompt on a trusted device | A pop-up on your phone asks you to approve the sign-in | Good, and easy to use | Do not approve a prompt you did not trigger |
| Email code | A code is emailed to you | Weak if the same email account is the thing being protected | Only as safe as the email account itself |
Which one should you choose?
- Business email account, the most important one: a security key or passkey if you can, otherwise an authenticator app. Every other account's password reset lands here.
- WordPress administrators and editors: an authenticator app is the sensible default, and many sites add it through a security plugin. The WordPress hardening guide recommends two-step authentication as an additional measure.
- Shopify admin: an authenticator app, security key or built-in authenticator. Shopify Payments requires two-step authentication to accept payments, and Shopify can require it on individual accounts.
- Google accounts used for Analytics, Search Console and Business Profile: the sign-in prompt, an authenticator app or a passkey.
- Password manager: the strongest option available, since it holds everything else.
- If a person cannot use an app, text message is still better than no second step. Move them up later.
Backup codes: set them up before you need them
Backup codes are single-use codes the service gives you when you turn 2FA on. Google describes them as eight-digit codes you can print or download for use if you lose your phone, and says not to give them to anyone. Shopify lists recovery options as well, such as a backup authentication method.
Treat them like a spare house key. They are worth having and worth protecting.
- 1When you set up 2FA, download or print the backup codes immediately.
- 2Store them somewhere separate from your phone: a locked drawer, a safe, or the password manager's secure notes.
- 3Do not keep them in a note on the same phone that holds the authenticator, or in your email inbox.
- 4After using a code, cross it off. Generate a new set when only a few are left.
- 5Add a second method as well, such as a security key kept at the office, so one lost device is not a crisis.
Lost phone? Recovery in order
If the phone that holds your authenticator is lost or broken, stay calm. You have more options than it feels like.
- 1Use another signed-in device if you have one. Services let you change the second step from a device that is already trusted.
- 2Use a backup code. This is what they are for.
- 3Use a spare security key or a second method you added earlier.
- 4Contact the service's own recovery process. For Google, Shopify and your email provider, this runs through their official account-recovery pages. Expect checks, and do not be surprised if it takes some time.
- 5If it is a WordPress site login, tell us. A person on our team can restore access for you without ever seeing a password.
- 6If the phone was stolen, change the password on your email account first, then others, and ask your carrier to lock the SIM. Remove the lost device from each account's list of trusted devices.
Be wary of anyone who offers to recover your account and asks for your password or a code. A code sent to you is for your eyes only. Support staff, ours included, never need to read one to you.
Rolling it out to a small team
People resist 2FA when it arrives as a surprise and a rule. They accept it when it is explained, done together and made easy. A short, orderly rollout beats an email saying it is mandatory from Monday.
- Week one: you and anyone with Administrator rights switch on 2FA for email, the website and the password manager. This tests the process on the people who can fix problems.
- Week two: hold a 20 minute session where each person sets up an authenticator app on their own phone. Do it together so nobody is stuck at home with an error.
- Week three: add editors, Analytics, Search Console, Business Profile and ad accounts.
- Week four: collect everyone's backup codes location in a simple list, without writing the codes in it. Check that no account relies on one person's phone.
- Afterward: make a phone change part of your normal checklist. Moving to a new phone means moving the authenticator first.
- For shared accounts, create individual logins instead. A shared 2FA phone is a single point of failure.
Example: Locked out the day before a campaign
Priya manages a small online shop. She gets a new phone and wipes the old one without moving her authenticator app. The next morning she cannot sign in to her store admin, the day before a sale. Because she saved her backup codes in a folder at the office, she uses one to sign in, then adds the authenticator on the new phone and generates a fresh set of codes. The lock-out lasts five minutes. Priya's colleague Sam, who skipped backup codes and used text messages only, would have needed the account recovery process. The difference is one printed sheet.
When to ask us
Ask us when you are locked out of a WordPress login, when you want two-step sign-in set up on your site but are not sure how, or when you are planning a rollout for your team and want help choosing a method that suits your site.
Send a request through the support form with: the site address, which accounts are affected, what method you used before, and what you have already tried. Please do not send backup codes, one-time codes or passwords. We can restore or set up access without seeing any of them. For accounts that sit with Google, Shopify or your email provider, the recovery process is theirs, but we can walk you through it. See also who owns your accounts to check you have not left a key with someone who no longer works with you.
