Google Authenticator Setup Guide
Two-factor authentication requires a smartphone with a supported time-based one-time password (TOTP) app. We recommend Google Authenticator, which is free and available for all major platforms. This is one of the most effective measures for protecting your website's admin panel as part of a comprehensive advanced web protection strategy.
Download the App for Your DeviceInstall Google Authenticator on your smartphone or desktop
Download and install Google Authenticator on your smartphone or desktop device. The app is available for Android, iOS, and Blackberry platforms.
Tip: You can also use other TOTP-compatible authenticator apps such as Authy, Microsoft Authenticator, or 1Password. Any app that supports time-based one-time passwords will work with our two-factor authentication system.
ConfigurationScan the QR code or enter the secret key manually
After enabling two-factor authentication in your website's security settings, you will see a QR code to scan with your mobile phone using the Google Authenticator app. Alternatively, you can enter the secret code manually if scanning is not possible.
Open Google Authenticator, tap the "+" button, and select "Scan a QR code". Point your phone's camera at the QR code displayed on screen. The app will automatically add your website and begin generating 6-digit codes.
Important: Save a backup of your secret key or QR code in a secure location. If you lose access to your phone, you will need this backup to recover your two-factor authentication. Without it, you may be locked out of your admin panel.
Activate Two-Factor AuthenticationVerify setup and start using 2FA
Now your site access is protected by two-factor authentication. Log out from your backend — you will see that instead of asking for the username and password only, you will also need to enter a secret key. The secret key is the six-digit code displayed on your Google Authenticator screen. This code changes every 30 seconds, ensuring maximum security for every login attempt.
Once activated, every admin login requires both your password and the real-time authenticator code. This means that even if a hacker obtains your password through brute force attacks, phishing, or malware, they still cannot access your admin panel without physical access to your smartphone — a fundamental layer of enterprise website security.
Congratulations! Your admin panel is now protected with two-factor authentication. We recommend enabling 2FA for all administrator and editor accounts on your website to ensure comprehensive access security.
