Two-factor authentication (2FA) with an authenticator app means that signing in needs your password and a six-digit code from an app on your phone, such as Google Authenticator, Microsoft Authenticator or a password manager with a built-in authenticator. Even if someone steals or guesses your password, they cannot get in without that code. Setting it up takes about two minutes per account, and it is one of the most effective things you can do to protect your hosting, email and business accounts.
Here is how it works, why an app is better than SMS codes, and how to set it up without locking yourself out.
Why passwords alone are not enough
Passwords get exposed in many ways that have nothing to do with how careful you are:
- Data breaches at other websites, where a reused password is then tried everywhere.
- Phishing pages that look like a real login screen.
- Malware that records keystrokes or steals saved passwords.
- Guessing of short or common passwords.
2FA adds a second, separate proof: something you have (your phone) in addition to something you know (your password). A stolen password on its own is no longer enough.
How authenticator app codes work
Authenticator apps use a standard called TOTP (time-based one-time password):
- When you turn on 2FA, the website shows a QR code. It contains a secret key shared between the website and your app.
- Your app stores the secret and, every 30 seconds, combines it with the current time to produce a new six-digit code.
- When you sign in, the website does the same calculation. If your code matches, you are in.
Because the code is generated on your phone, it works without mobile signal or data, and nothing is sent over the network until you type it in. Each code expires within seconds, so a code seen over your shoulder is useless shortly afterwards.
Authenticator app vs SMS codes
| Authenticator app | SMS code | |
|---|---|---|
| Works without signal | Yes | No |
| Vulnerable to SIM swap | No | Yes |
| Delays in delivery | None | Possible, especially when networks are busy |
| Works when travelling abroad | Yes | Depends on roaming |
| Setup | Scan a QR code once | Enter phone number |
SMS is better than no second factor, but it depends on your mobile number. In a SIM swap fraud, a criminal convinces or bribes someone to move your number to their SIM, then receives your codes. Authenticator apps are not tied to your phone number, so a SIM swap does not give an attacker your codes.
Choosing an authenticator app
Any standard TOTP app works with any website that supports authenticator apps. Common choices:
- Google Authenticator - simple, and can sync codes to your Google account.
- Microsoft Authenticator - supports cloud backup of codes.
- Password managers with built-in authenticators - convenient, as passwords and codes live together.
Whichever you choose, consider how you would recover your codes if you lost your phone. Apps with encrypted backup or sync make replacing a phone much easier.
How to set up 2FA (general steps)
The exact menu names differ between services, but the process is nearly always the same:
- Sign in and open your account's Security settings.
- Choose Two-factor authentication or Authenticator app and select Enable.
- Scan the QR code with your authenticator app. If you cannot scan, most sites show a setup key you can type in manually.
- Enter the six-digit code from the app to confirm it works.
- Save your backup codes (see below).
- Sign out and back in to check everything works before you rely on it.
Backup codes - do not skip this step
When you enable 2FA, most services give you a set of one-time backup codes. Each can be used once instead of an app code. They are your way back in if your phone is lost, stolen or broken.
- Store them in your password manager, or print them and keep them somewhere safe.
- Do not store them only on the same phone as your authenticator app.
- If you use one, mark it as used; generate a new set when you are running low.
If you lose your phone
- Sign in with a backup code on each important account.
- Disable 2FA and enable it again with your new phone, which gives you a new QR code.
- Generate new backup codes and store them safely.
- If you have no backup codes, contact the service's support. Expect them to verify your identity carefully; that is the point of 2FA.
Which accounts to protect first
Prioritise accounts that would let an attacker take over everything else:
- Your email - it receives password reset links for all your other accounts.
- Your domain registrar and DNS - control of your domain means control of your website and email.
- Your hosting dashboard - access to your sites, databases and customer data.
- Banking and payment providers.
- Your website admin logins, such as WordPress. See WordPress security basics.
- Source code hosting like GitHub or GitLab, especially if pushes deploy automatically.
For businesses, make 2FA mandatory for every staff member with access to these systems. If your site processes personal information, strong access controls are part of the security safeguards POPIA section 19 expects. Our website security checklist covers the other essentials, and a solid backup strategy protects you if something does go wrong.
2FA on your NewHost account
NewHost supports optional two-factor sign-in with an authenticator app such as Google Authenticator, together with backup codes for when you do not have your phone. We also send an email alert whenever your password changes, so an unexpected change does not go unnoticed. Turn it on in the security settings of the dashboard at app.newhost.co.za. On Business and Agency plans, team seats with roles let each person sign in with their own account and their own 2FA, instead of sharing one login.
Frequently asked questions
What happens if my phone's clock is wrong?
TOTP codes depend on the current time, so a phone clock that is several minutes off can produce codes that are rejected. Set your phone to update the time automatically from the network.
Can I use the same authenticator app for many accounts?
Yes. One app can hold codes for as many accounts as you like, each labelled with the service and your username.
Is 2FA with an authenticator app completely safe?
It greatly reduces risk but is not perfect. A convincing phishing page can still trick someone into typing a current code, so always check you are on the real website before entering your password and code.
Can two people share one 2FA-protected account?
It is possible by scanning the same QR code on two phones, but it is better practice to give each person their own account. Shared logins make it hard to remove access when someone leaves.
Should I use SMS 2FA if an authenticator app is not offered?
Yes. SMS codes are still much better than a password alone. Switch to an authenticator app when the service supports it.
Ready to lock down your hosting? Create your NewHost account, turn on two-factor sign-in and give each team member their own seat. See plans and pricing.