Passwords alone are no longer sufficient to protect your online accounts. Data breaches, phishing attacks, and brute-force attempts mean that even strong passwords can be compromised. Two-Factor Authentication (2FA) adds a critical second layer of security, requiring something you know (your password) and something you have (your phone or security key) to access your account. This guide explains how to enable and use 2FA on your SakuraHost client area, cPanel, and your hosted websites.
What Is Two-Factor Authentication?
Two-Factor Authentication (2FA), also called Multi-Factor Authentication (MFA), requires two different forms of identification before granting access to an account. The three standard authentication factors are:
- Something You Know: Password, PIN, or security question answer.
- Something You Have: A physical device like your smartphone (authenticator app), a hardware security key (YubiKey), or a one-time code sent to your phone.
- Something You Are: Biometric data like fingerprints, facial recognition, or iris scans.
Standard 2FA for web hosting typically combines factors one and two — your password plus a time-based one-time password (TOTP) generated by an authenticator app on your smartphone.
Why 2FA Is Essential for Hosting Accounts
Your hosting account is the gateway to your entire online presence. An attacker who gains access can:
- Deface or delete your websites
- Inject malware that infects your visitors
- Steal your database, including customer information
- Send spam emails from your domains, damaging your reputation
- Access email accounts associated with your domains
- Redirect your domains to malicious sites
With 2FA enabled, even if an attacker obtains your password through a data breach, phishing email, or brute-force attack, they cannot log in without the second factor from your physical device.
Setting Up 2FA on Your SakuraHost Client Area
Setting Up 2FA on cPanel
cPanel includes built-in 2FA support that works independently from the SakuraHost client area 2FA. We recommend enabling both for maximum security.
Going forward, every cPanel login will require both your password and a TOTP code from your authenticator app.
Enabling 2FA on Your WordPress Site
Protecting your WordPress admin area with 2FA prevents unauthorized access to your content management system. Several excellent plugins provide this functionality:
Using Wordfence (Recommended)
Using WP 2FA Plugin
The "WP 2FA" plugin by WP White Security provides a user-friendly setup wizard and supports enforcing 2FA for all users or specific roles. It also supports email-based codes as a backup method for users who do not have an authenticator app.
Best Practices for 2FA
Authenticator App vs. SMS
While SMS-based 2FA is better than no 2FA at all, it is vulnerable to SIM-swapping attacks where an attacker convinces your mobile carrier to transfer your number to their SIM card. The Google Security Blog has documented multiple cases of SMS interception. Always prefer TOTP authenticator apps over SMS codes.
Hardware Security Keys
For the highest level of security, consider a hardware security key such as a YubiKey. These physical devices use the FIDO2/WebAuthn protocol and are virtually phishing-proof because they verify the website's domain before responding. Both the SakuraHost client area and cPanel support WebAuthn where compatible.
Recovering Access If You Lose Your 2FA Device
- Use Your Backup Code: Enter your backup/recovery code at the 2FA prompt to bypass the authenticator requirement.
- Use a Backup Device: If you set up 2FA on multiple devices, use the alternate device.
- Contact Support: If you have no backup codes or devices, contact SakuraHost Support. You will need to verify your identity through account ownership verification (billing details, domain information, etc.).
Comprehensive Security Checklist
- Enable 2FA on your SakuraHost client area
- Enable 2FA on cPanel
- Enable 2FA on your WordPress/CMS admin
- Enable 2FA on your email accounts
- Enable 2FA on your domain registrar account
- Enable 2FA on any DNS management services (e.g., Cloudflare)
- Use unique, strong passwords for each account (use a password manager)
- Save backup codes securely for all 2FA-enabled accounts
- Review and follow the OWASP Authentication Guidelines
Two-factor authentication is one of the simplest yet most effective security measures you can implement. Taking a few minutes to enable 2FA across your SakuraHost account and hosted websites dramatically reduces the risk of unauthorized access and protects both your business and your customers.