Hardening Reference
Two factor authentication — Second factors, ranked by what they actually resist
You have 2FA switched on somewhere, and no clear idea what happens if that phone goes in a river.
The short answer
Two-factor authentication requires a second, independent proof alongside the password, so a leaked or guessed password stops being enough on its own.
The factors are not interchangeable. A code generated on your device beats a code sent by text, because a phone number can be ported away from you. A hardware security key beats both, because it verifies the site's origin and will not hand anything to a convincing forgery. Choose by the attack you are trying to survive, not by what the signup screen offers first.
By the HostingFast team · Reviewed 24 August 2026
0
Hand-waving in this entry
100+
Entries wired to each other
Real
Numbers you can reproduce
Free
To read, no gate
The ranking is short. SMS is better than nothing and vulnerable to SIM porting. A time-based code from an app never leaves the handset, which removes the interception problem but not the phishing one — a fake login page will happily collect a six-digit code and use it within its window. A security key is the only common factor that resists that, because the browser will not sign a challenge for the wrong origin.
Then there is order. Enable it first where the blast radius is largest: the domain registrar, the mailbox that receives every password reset, the client area, and the control panel. Securing the application while leaving the mailbox that can reset it unprotected is a common and expensive sequencing mistake.
Rank the factors by the attack, not the convenience
Against a leaked password dump, any second factor works — the attacker has credentials and nothing else. Against SIM porting, app codes hold and SMS does not. Against a convincing phishing page, only origin-bound keys hold, because a code typed into a forgery is a code the forgery can replay while it is still valid.
That gives a clean buying rule. Use an app as the baseline everywhere, add a hardware key on the two or three accounts that could cost you the business, and treat SMS as the fallback you accept only when a provider offers nothing better.
Enable in order of blast radius
Registrar first, because whoever controls the name controls where the site and the mail point. Then the mailbox that receives password resets, because it is the master key to everything else. Then the client area and billing. Then the control panel and the application itself.
Working in that order means each account you protect is already covered by the one above it. Working in the reverse order — starting with WordPress, as most people do — leaves the recovery path wide open the whole time.
Recovery is the real design decision
The moment you enable it, you are shown recovery codes, and the temptation is to promise yourself you will save them later. Put them in your password manager, or on paper somewhere physical, before you leave the screen. That single minute is the entire difference between a lost phone costing you five seconds and costing you a day of identity verification.
For a team, add a second enrolled device or a second key rather than sharing one set of codes. Shared codes drift into a group chat within about a month, which recreates the single-factor problem you were solving.
What it covers on a hosting account, and what it does not
It protects interactive sign-in: the client area, the control panel, WordPress. It does nothing for the non-interactive routes, and those are the ones people forget. SSH and SFTP should be on keys with password authentication disabled; API tokens should be scoped and rotated; FTP should be off entirely.
Entries that finish this picture: Brute-Force Attack, Phishing, SSH and Encryption. SSH with Git and Composer is available on the developer-focused plans here, so key-based access is not something you have to upgrade for.
Security entries with the trade-offs left in
Every control costs something — a tap, a delay, a recovery path to design. These entries name the cost as well as the benefit, because a control you abandon in month two protected nothing.
SSH access with Git and Composer comes with the developer-focused plans, so key-based authentication is available without moving to a bigger machine.
- Costs named alongside benefits
- Factors ranked by attack resisted
- Recovery paths designed, not assumed
- Written by people who run the desk
Why HostingFast
Standard on every plan
Factors ranked properly
SMS, app codes and security keys stop different attacks. The ranking is short and worth knowing.
Blast radius ordering
Registrar, then reset mailbox, then billing, then application. Most people do it backwards.
Phishing resistance, explained
Why a typed code can be replayed by a forgery and an origin-bound key cannot.
Recovery designed in advance
Where to put the codes before you leave the setup screen, and what teams should do instead.
The routes it misses
SSH keys, API tokens and FTP sit outside interactive sign-in and need their own answer.
Next reads mapped
Brute-Force Attack, Phishing and SSH are the three that complete this entry.
Quick Start
From order to online
- 1
Start at the registrar
Whoever controls the domain controls the mail and the site. Protecting the application while the name is unprotected secures the wrong thing.
- 2
Save the recovery codes now
Into the password manager before you close the screen. Every painful account recovery starts with someone meaning to do this later.
- 3
Close the non-interactive doors
Move SSH to keys, disable password authentication, scope your API tokens and turn plain FTP off. A second factor never sees any of those.
Built In
Loaded onto every plan
- Spam and virus screening on every mailbox as standard
- WordPress Toolkit, with updates handled for you
- LiteSpeed caching built into the server rather than patched in by plugin
- NVMe SSD storage on every tier, not just the expensive ones
- Your existing site moved over by our engineers, free of charge
- WordPress and 400+ other applications installed in one click
- Browser webmail plus IMAP, POP and SMTP for any mail app
- Email addresses that run on your own domain name
- Zero setup charges — there is no joining fee, ever
- Year one of your domain free when you order annually
Frequently Asked
What people ask us most often
Is an app-generated code phishing-resistant?
No, and this is the most useful thing to know about it. A convincing fake login page will collect your six-digit code and use it inside its validity window. What the app removes is interception and SIM porting, which is a real gain over SMS. If you need resistance to phishing itself, that requires an origin-bound security key, because the browser refuses to sign a challenge for the wrong domain.
Where should recovery codes actually live?
In your password manager, and ideally on paper in a physical place as well. Not in the notes app on the phone holding the authenticator, which fails at exactly the moment you need them. For a team, enrol a second device or a second key rather than circulating one set of codes, because shared codes end up in a group chat and you are back to one factor.
Does this cover SSH and API access as well?
No. A second factor guards interactive sign-in only. SSH should be on keys with password authentication disabled, API tokens should be scoped to what they need and rotated on a schedule, and plain FTP should be switched off in favour of SFTP. Those are separate jobs and they are the ones most often left undone.
If I lose both the phone and the codes, who can get me back in?
Our support desk can, after identity verification against the account record, and it is deliberately slower than the self-service route. Staffed around the clock with a two-hour first-reply target, or one hour when a site is down. Bring the account details and the original registration information and it goes considerably faster.
Keep reading
SSH (Secure Shell)
Key-based access to the command line, and why password authentication should be off.
Encryption
TLS handshakes, password hashing and storage — three jobs sharing one word.
How to Enable Two-Factor Authentication
Enabling it in the right order, with the recovery path set up before you need it.
Website Builder
Drag, drop and publish on hosting that is quick underneath the builder.
Web Hosting
cPanel hosting on NVMe with SSL, migration and a first-year domain included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Harden the account, not just the site.
cPanel with SSH, Git and Composer on the developer plans, free SSL on all of them, and engineers on the desk at any hour.
View Website Builder plans