Two-factor authentication for WordPress and cPanel
Add two-factor authentication to WordPress admin and cPanel to protect against password theft. Plugin and native options for 2FA on your hosting accounts.
UnderHost NOC
Network Operations
Two-factor authentication requires a second form of verification (usually a one-time code from your phone) in addition to your password. Even if someone steals your password, they cannot log in without the second factor. Enable 2FA on every account that controls your hosting.
Why 2FA for hosting
Hosting accounts are high-value targets. A compromised cPanel, WordPress admin, or CustomerPanel account gives an attacker full control of your website, email, and data. Password reuse, phishing, and data breaches are common ways credentials are stolen-2FA stops these attacks even when the password is known.
2FA for WordPress admin
Use a 2FA plugin to protect the WordPress login. Popular options:
| Plugin | Notes |
|---|---|
| WP 2FA | Free, easy setup, supports TOTP apps and email codes |
| Two Factor Authentication (by David Anderson) | Lightweight, free, widely trusted |
| Google Authenticator for WordPress | Simple TOTP integration |
| Wordfence Security | Full security suite including 2FA |
Install WP 2FA:
- WordPress Admin → Plugins → Add New → search "WP 2FA"
- Install and activate
- Follow the setup wizard to configure TOTP authentication
- Scan the QR code with your authenticator app
- Optionally enforce 2FA for all admin users
2FA for cPanel
- Log in to cPanel
- Go to Security → Two-Factor Authentication
- Click Set Up Two-Factor Authentication
- Scan the QR code with your authenticator app
- Enter the 6-digit code to verify
- Click Configure Two-Factor Authentication
After setup, every cPanel login requires your password plus the current 6-digit code from your authenticator app.
2FA for CustomerPanel
See the dedicated guide: How to enable two-factor authentication in CustomerPanel
Strengthen your security
Enable 2FA on your CustomerPanel account for additional protection of your hosting account.
