# Setting up two-factor authentication for cPanel

> Turn on two-factor authentication for your cPanel login using an authenticator app on your phone.

Source: https://helpcenter.ruachost.com/cpanel/security/setting-up-two-factor-authentication-for-cpanel/

**Two‑Factor Authentication (2FA)** adds an extra layer of security to your cPanel account. In addition to your password, you’ll need a unique security code generated by an app on your smartphone. This makes it much harder for unauthorized users to gain access.

## Why Enable 2FA?

- Protects against stolen or guessed passwords.
- Ensures only authorized users can log in.
- Strengthens overall account security.

## Steps to Enable 2FA in cPanel

1. **Log in to cPanel.**
2. On the **Tools page → Security section**, click **Two‑Factor Authentication**.
3. Click **Set Up Two‑Factor Authentication**.
4. Under **Step 1**:

   - Open your preferred authentication app (e.g., **Google Authenticator**, **Duo Mobile**, or **Authenticator**).
   - Scan the QR code displayed in cPanel.
   - If you don’t have a QR code reader, manually enter the key provided.
5. Under **Step 2**:

   - Enter the **6‑digit security code** generated by your app.
   - You must enter the code within 30 seconds before it refreshes.
6. Click **Configure Two‑Factor Authentication**.
7. 2FA is now enabled for your account.

## Reconfiguring 2FA

- If you change devices or apps, you’ll need to reconfigure 2FA:

  1. Log in to cPanel.
  2. Go to **Security → Two‑Factor Authentication**.
  3. Click **Reconfigure Two‑Factor Authentication**.
  4. Repeat the setup steps above.

 When reconfigured, old codes will no longer work. Update all devices with the new QR code.

## Removing 2FA

1. Log in to cPanel.
2. Go to **Security → Two‑Factor Authentication**.
3. Click **Remove Two‑Factor Authentication**.
4. Confirm removal.
5. 2FA is disabled for your account.

> **Note:**
- Supported apps:

  - **Google Authenticator** (Android, iOS, Blackberry)
  - **Duo Mobile** (Android, iOS)
  - **Authenticator** (Windows Phone)
- Without the security code, login is impossible, keep your device accessible.
- Always back up your authentication app when switching phones.