Two Factor Authentication | What is Two Factor Authentication?

TL;DR Two Factor Authentication

Two factor authentication, often abbreviated as 2FA, is a security method that requires you to verify your identity using two separate pieces of evidence before you are granted access to an account. The first factor is typically something you know, like your password. The second factor is something you have, such as a code generated by an authenticator app on your phone, a hardware security key, or a code sent via SMS. Even if an attacker obtains your password through a brute force attack, a data breach, or phishing, they still cannot access your account without the second factor. For hosting accounts in particular, two factor authentication is one of the most impactful security steps you can take because your hosting account controls everything underneath your website. CloudSonic recommends enabling two factor authentication on your account and on your WordPress admin login, and it pairs well with SSH key authentication at the server level for a fully hardened access setup.

Note Store your 2FA backup codes somewhere secure and offline the moment you enable it, losing your authenticator app without them can lock you out permanently.

How Two Factor Authentication Works

Two factor authentication adds a second verification step to the login process that requires something you have in addition to something you know. The most common implementation uses a time-based one-time password, or TOTP, generated by an authenticator app like Google Authenticator or Authy. When you enable TOTP-based 2FA on an account, you scan a QR code with your authenticator app which encodes a shared secret. From that point on, your authenticator app uses that secret combined with the current time to generate a six digit code that changes every 30 seconds. When you log in you enter your password as normal and then enter the current code from your app. The server performs the same calculation using the shared secret and the current time and verifies that your code matches. Because the code changes every 30 seconds and is based on a secret that never leaves your device, it cannot be reused or predicted even if someone intercepts it.

Frequently Asked Questions on Two Factor Authentication

Is SMS-based two factor authentication secure?

SMS-based 2FA is significantly less secure than authenticator app-based TOTP. SMS messages can be intercepted through SIM swapping attacks where an attacker convinces a mobile carrier to transfer your phone number to their SIM card. For hosting account access and WordPress admin login, an authenticator app like Google Authenticator or Authy is strongly preferred over SMS codes.

What happens if I lose access to my authenticator app?

Most 2FA implementations provide backup codes at setup time that can be used for account recovery if you lose access to your authenticator app. Store these codes securely offline. If you lose both your authenticator app and your backup codes, account recovery typically requires identity verification with the service provider, which is a slow process. Having backup codes stored securely prevents this scenario entirely.

Should I enable two factor authentication on WordPress specifically?

Yes. The WordPress admin login is one of the most targeted entry points for brute force attacks. Enabling 2FA on WordPress admin accounts, particularly administrator accounts, means that even if an attacker obtains a password through a breach or successful brute force attempt, they still cannot access the admin without the second factor. Plugins like WP 2FA make this straightforward to implement.