Enabling Two-Factor Authentication (2FA) add a crucial extra security layer, ensuring that even if someone steals your password, they can't access your account because they'd also need your physical device (phone, etc.) to provide a second code for approval.
Prerequisites
Access to cPanel
Completion of the task: 5 minutes
Expertise: beginner
How to do it?
Log into your cPanel.
Under Security click on Two-Factor Authentication.
Click on the Set Up Two-Factor Authentication button.
Now scan the QR code in step 1 with an Authenticator App on your phone like Google Authenticator by clicking on the + and selecting Scan a QR code.
In step 2, enter the security code generated by your two-factor authentication app and click on the Configure Two-Factor Authentication button.
Two-Factor Authentication is now configured for your cPanel account.
You can also configure Two-Factor Authentication on your Webmail account.
Go to mail.yourdomain.tld:2096 (replace yourdomain.tld by your domain name).
Enter your email address and password to log in.
In the Webmail main page go to Two-Factor Authentication. If you logged in directly to Roundcube, in the left menu click on Webmail Home to go back in the main page.
Click on the Set Up Two-Factor Authentication button.
Now scan the QR code in step 1 with an Authenticator App on your phone like Google Authenticator by clicking on the + and selecting Scan a QR code.
In step 2, enter the security code generated by your two-factor authentication app and click on the Configure Two-Factor Authentication button.
Two-Factor Authentication is now configured for your Webmail account.
Key Benefits of Enabling 2FA:
Stops Password-Based Attacks: Neutralizes the threat of stolen passwords from data breaches by requiring a second verification step.
Protects Sensitive Data: Secures access to your account from cybercriminals.
Verifies Identity: Confirms you are the real user.
Prevents Unauthorized Access: Makes it significantly harder for hackers to get in, even if they know your password, blocking attempts like credential stuffing (using stolen passwords on other sites).