SiteHost

Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is an additional layer of protection to secure your account against unauthorized logins even in the event that someone knows your password. SiteHost recommends 2FA be enabled for all accounts.

How Does It Work?

With 2FA enabled, you are required to provide something you know (your password) and something you have (your mobile phone) in order to log in.

When you login to the SiteHost Control Panel, you will enter your username and password as usual. You will then be prompted to enter a 6 digit code that is generated from an app like Google Authenticator from your iOS or Android phone. Alternative TOTP compatible apps such as Authy are also supported.

How Do I Enable 2FA?

  1. Install your preferred 2FA app.
  2. Log in to the SiteHost Control Panel.
  3. Click Account from the left menu.
  4. Select Two Factor Auth from the navigation tab.
  5. Click the Add 2FA Method button in the top right.
  6. Open your 2FA app and follow the steps.
  7. Enter the 2FA code generated by your app.
  8. Click Activate 2FA.

How Do I Disable 2FA?

  1. Install your preferred 2FA app.
  2. Login to the SiteHost Control Panel.
  3. Click Account from the left menu.
  4. Select Two Factor Auth from the navigation tab.
  5. Find the 2FA method you want to disable and click the remove icon.
  6. You may be prompted to enter your 2FA code if it is activated as a security precaution.

How Can I Ensure All Users Have 2FA?

If you are an account administrator you can enforce 2FA for all contacts with logins on your account.

  1. Login in to the SiteHost Control Panel.
  2. Select Account from menu on the left, then Preferences from the sub-menu.
  3. Select Yes for the Enforce Two Factor Authentication option and update your preferences.

Once enabled, all contacts that have a login for your account will receive an email notification, and will then have 48 Hours to activate 2FA. If they do not activate 2FA within this grace period they will lose access to the account and will need to have 2FA reset for them by an administrator. While this setting is in effect, users lose the ability to disable 2FA for themselves.

Users who have activated 2FA will be displayed with a green lock icon next to their username on the contacts page, so its easy to see 2FA coverage for your account at a glance.

How Do I Reset 2FA for a User?

Admin users are unable to reset their own 2FA. If you are an admin and lose access to your account, please contact the support team.

Account administrators have the ability to reset 2FA for users who lost access to their 2FA device, or have failed to activate 2FA within the grace period.

  1. Login to the SiteHost Control Panel
  2. Select Account from the menu on the left, then Contacts from the sub-menu
  3. Select the contact you need to reset, then select the Two Factor Auth tab
  4. Select Reset 2FA Method from the row menu on the right of the 2FA method you want to reset

Once reset the contact will receive an email notification, and will have another 48 Hours to activate 2FA.

Frequently Asked Questions

I Lost My Phone or My Code Doesn't Work

You have two recovery options if you lose access to your account:

  1. Have an administrator for your account reset 2FA for you.
  2. Contact us over phone or email. Be prepared to provide proof of account ownership.
My 2FA Method Says "PENDING ACTIVATION"?

You have added a 2FA method but have not finished the enrollment process. Click on the method and follow the instructions to activate the method.

An Expired Token Still Works?

Tokens are valid for 30 seconds each, aligned to epoch time. The standard implementation allows the code before and after the current code to account for time drift between your device and our systems.