Two-factor authentication: the cheapest security upgrade for your panel
A stolen password is the most common way panels are taken over. Two-factor authentication makes a stolen password useless on its own.
Passwords leak. They're reused on other sites, typed into fake login pages and guessed by bots. Two-factor authentication (2FA) means a password alone is no longer enough to get in.
How it works
After entering your password, you're asked for a second proof — usually a six-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy. The code changes every 30 seconds and is generated on your phone, so an attacker who only has your password is stuck.
App codes vs. SMS vs. email
- Authenticator apps are the best balance of security and convenience. They work offline and can't be intercepted in transit.
- SMS codes can be stolen through SIM-swap fraud.
- Email codes are only as safe as your email account.
Recovery codes
When you enable 2FA you receive a set of one-time recovery codes. Store them offline. If you lose your phone, one of them gets you in — and each works only once.
On MediaPanal
Every admin account must use an authenticator app. Codes can't be reused, repeated wrong codes lock the account temporarily, and after a period of inactivity the admin area asks for a new code.
Turn it on everywhere
Your email, domain registrar, hosting and payment accounts deserve 2FA too. An attacker usually needs just one weak link.