How two-factor authentication works
A password is one factor: something you know. Two-factor authentication asks for a second factor of a different kind — something you have, such as a phone or a hardware key, or something you are, such as a fingerprint. The login only completes when both are presented. Using two different kinds is the whole point: a password leaked in a breach on some unrelated site is no longer enough on its own.
The second factor usually arrives in one of a few ways. An authenticator app generates a code that rotates on a timer from a secret shared once during setup, and it keeps working with no signal and no roaming. An SMS code is texted to your number, which is convenient but the weakest common method, because a number can be ported away or read on a device you no longer hold. A security key is a physical device you tap or plug in, and it is the hardest to phish, because it checks the site address before it answers.
Why two-factor authentication matters
Nearly every marketing asset a business owns sits behind a login: the website admin, the Google Ads account, the Meta Business account, the analytics property, the domain registrar, and the email inbox that can reset all of the others. One reused password is enough to lose the set. Ad accounts in particular are taken for their saved payment method, and a hijacked business account can spend against your card before the first invoice raises a question.
The recovery side matters just as much as the prevention side. Losing access to a Business Manager or a registrar is far slower to undo than losing a website, because you are dealing with a support queue rather than a backup.
Where two-factor authentication goes wrong
The commonest failure is not the technology, it is the recovery plan. A team switches it on for one shared account, the person holding that phone leaves, and nobody can sign in. Recovery codes are issued at setup for exactly this moment and are usually saved nowhere, or saved on the same phone that is now lost.
The second failure is expecting it to cover everything. It defeats password reuse and guessing. It does not defeat a convincing phishing page that asks for the code and relays it while it is still valid, and it does not defeat malware that lifts a browser session which is already signed in. A team sharing one login and passing the code around in a group chat has also quietly removed most of the benefit.
What to do about it
Work through accounts in order of damage: the email inbox first, then the domain and hosting, then the ad and analytics platforms, then the website admin. Choose an authenticator app or a security key wherever one is offered, and keep SMS as a fallback rather than the main method. Give every person their own login at the permission level they actually need, so a departure means removing one account instead of resetting everything.
On WordPress the second factor comes from a plugin rather than from core, so it belongs on the same checklist as updates and backups — the routine covered by ongoing website maintenance rather than a one-off job. Save the recovery codes somewhere separate the day you turn it on, and re-check who still has access whenever staff or agencies change. It also pairs sensibly with a working website backup, because access and restoration are different problems.