How do I turn on two-factor login?

Which accounts should I protect first?

1. Business email. Whoever controls your email can reset almost every other password you have.
2. Your domain registrar. Losing the domain takes your website and email with it.
3. Your website’s admin login.
4. Your Google account, which runs your Google Business Profile.
5. Banking, payroll and payment accounts.

The short version

• Two-factor login means a stolen password alone can’t get someone in.
• Protect business email, domain, website and Google first, with an authenticator app and saved backup codes.

Which second step should I choose?

Method	How strong	Notes
Authenticator app	Strong	Microsoft Authenticator, Google Authenticator or similar. Works without phone signal.
Passkey or security key	Very strong	Supported by a growing number of services.
Text message code	Weaker	Better than nothing. WordPress’s multi-factor guide notes text messages aren’t a secure channel.

How do I set it up for Microsoft 365 email?

These follow Microsoft’s guide to setting up the Authenticator app:

1. Install Microsoft Authenticator on your phone.
2. On your computer, go to mysignins.microsoft.com/security-info and sign in.
3. Select Add sign-in method, choose Microsoft Authenticator, then Add, and Next until a QR code appears.
4. In the app, tap the plus sign, choose Add account, then Work or school account, then Scan a QR code.
5. Point your phone at the screen and follow the prompts.
   • Expected result: the account shows in the app, and Security info lists Microsoft Authenticator.

If the camera won’t scan, select Can’t scan the image and type the code into the app.

Adding the app doesn’t by itself make a second step required at every sign-in. That’s set by whoever administers your Microsoft 365: security defaults, Conditional Access or per-user MFA, as Microsoft’s MFA guidance explains. If you’re the administrator, turn one of those on for every user; if not, ask whoever is.

How do I set it up for Google?

These follow Google’s guide to 2-Step Verification:

1. Go to myaccount.google.com and select Security & sign-in.
2. Under “How you sign in to Google,” choose Turn on 2-Step Verification.
3. Follow the steps on screen.
4. Add an authenticator app as a second method, and get your backup codes.

On a Google Workspace account, your administrator may need to allow it first.

How do I set it up for WordPress?

WordPress doesn’t include two-factor login on its own; it’s added with a plugin, such as the Two-Factor plugin from WordPress community contributors. Many security plugins include it too. Once a plugin is in place:

1. Go to Users, then Profile, and scroll to the two-factor section.
2. Turn on the authenticator app method, scan the QR code and enter the code it shows.
3. Turn on backup codes and save them.
4. Select Update Profile.

On a site someone else manages, ask before installing a security plugin, so it doesn’t clash with protection already there.

What about my registrar and other accounts?

Registrars, hosts, banks and payment services usually keep the setting under Security, Login and security or Account settings. Look for “two-step,” “2FA” or “authenticator.” The pattern is the same: scan a QR code, enter the code, save the backup codes. If a service doesn’t offer it, use a long, unique password kept in a password manager.

Why does this matter?

Many break-ins start with a password that was guessed, reused or phished. A second step stops that password from being enough on its own. Our answer on two-factor authentication explains the risk in more detail.

What are the common mistakes and edge cases?

• No backup codes saved. Keep them in a password manager, or printed somewhere safe.
• Only one method. Add a second, such as a backup phone number.
• Wiping an old phone first. Move the authenticator app to the new phone before you reset the old one.
• Shared accounts. Two-factor is tied to one person’s phone. Give each person their own login. See share access safely.
• A code or prompt you didn’t ask for. Someone may have your password. Don’t approve it. Change that password from a device you trust. Our answer on spotting a phishing email shows the tricks used to steal codes.

What if this didn’t work?

• The QR code won’t scan: use the manual code option.
• Codes are always rejected: set your phone’s time to update automatically. App codes depend on the clock.
• You lost your phone and backup codes: contact the account’s support or your administrator. Expect an identity check, which can take time.
• Your WordPress login fails after setup: see log in and reset a forgotten password.

How does E-3 handle this?

E-3’s own mail server (SmarterMail) doesn’t currently offer two-factor login, so use a long, unique password there. If you’d like help turning on two-factor login for your website, or for email on Microsoft 365 or Google Workspace, call 814-399-4655 or email support@e3help.me. Please ask us before installing a security plugin on a site we look after. Never send a login code, a backup code or a password by email.

Related questions

• How do I reset my email password?
• How do I add or remove a person’s access to edit our website?
• Business password basics