Turn on two-factor authentication and passkeys
Protect your admin sign-in with an authenticator app, a passkey, and a two-factor rule for your team or members.
Two-factor lives in Account & Security; passkeys, signed-in devices and the two-factor rule for everyone else live in Security.
To turn on two-factor authentication:
- Open Account & Security and select Enable Two-Factor Authentication.
- Scan the QR code with your authenticator app, or type the key shown under "Or enter this key manually".
- Enter the 6-digit code from the app and select Verify & Enable.
- Copy your recovery codes somewhere only you can reach, then select I've saved my recovery codes. Each code works once.
To add a passkey or sign out other devices:
- Open Security.
- Under Passkeys, give it an optional label and select Add a passkey, then follow your browser's prompt.
- Under Active sessions, select Sign out other devices if you see one you don't recognize.
To require a second factor for others, tick Require for admins and team members or Require for site members under Require two-factor authentication. People without one are asked to set it up before they can continue.
If this didn't work
- The 6-digit code is rejected: check that your phone's clock is set automatically, then try the newest code.
- You lost your authenticator: at the sign-in prompt choose Use a recovery code and enter one of the codes you saved when you turned two-factor on. Once you're in, use Regenerate Recovery Codes or Disable 2FA and set it up again.
The recovery codes on the Security page are a separate set from your two-factor recovery codes.