Enable two-factor authentication on all admin accounts

Two-factor authentication on every admin account means a stolen or guessed password alone is not enough to gain access, a second factor, typically a code from an app or a hardware key, is required as well.

Passwords alone are consistently the weakest link in account security, reused, guessed, or leaked in some unrelated breach, 2FA closes this gap even when a password is compromised.

How to do it

1. 1
   List every admin account across your systems

   CMS, hosting panel, domain registrar, email, and any other administrative access point.
2. 2
   Enable 2FA on each

   Most modern platforms support this natively in account security settings.
3. 3
   Prefer an authenticator app or hardware key over SMS

   SMS-based 2FA is vulnerable to SIM-swapping, an app or hardware key is meaningfully stronger.
4. 4
   Store backup codes securely for each account

   Needed if you lose access to your primary 2FA device.