What Multi-factor authentication (MFA) means
MFA blocks most account takeovers even when a password is stolen. Turn it on for email, hosting, domain registrar, CMS admin, payment and social accounts. App-based prompts, passkeys and security keys are stronger than text-message codes.
Why it matters for your website
Passwords get stolen through phishing and data breaches all the time. MFA means a stolen password alone usually isn't enough to get into your website, email or hosting account. That one step blocks many common account takeovers, which can lead to defaced sites, spam or stolen data.
Example
An agency employee's password is leaked in a breach, and an attacker tries to log in to the client's WordPress admin. The login fails because it also needs a code from the employee's phone.
Tips
- Turn on MFA for your domain registrar, hosting, email and CMS admin accounts first.
- Prefer an authenticator app, passkey or security key over text message codes when you can.
- Store backup codes somewhere safe so you don't get locked out.
Common mistakes
- Approving login prompts on your phone that you didn't start.
- Turning on MFA for yourself but not for every admin and contractor account.
Questions about Multi-factor authentication (MFA)
What is Multi-factor authentication (MFA)?
Requiring a second proof of identity, such as a code, app prompt or security key, in addition to a password.
Is SMS two-factor authentication safe enough?
It's much better than a password alone, but codes sent by text can be intercepted through SIM swapping. Authenticator apps, passkeys and security keys are stronger choices.
Is 2FA the same as MFA?
Two-factor authentication is a type of MFA that uses exactly two proofs of identity. MFA means two or more.
