Microsoft's own security team reports that more than 99.9% of the accounts it sees compromised never had multi-factor authentication turned on. That statistic gets quoted constantly about email and social logins; it applies just as directly to the handful of accounts that actually control a website — and most businesses have never enabled it on any of them.
A stolen or guessed password is the easy part of an account takeover. Two-factor authentication — a second proof beyond the password, usually a code or a prompt on a device the account owner already has — is what turns a leaked password from "the attacker is in" into "the attacker has half of what they need."
The four accounts that actually run a website
Not every login carries equal weight. Four accounts sit above the rest because losing control of any one of them affects everything downstream, not just itself:
- The domain registrar — controls where the domain's DNS records point. Whoever holds this account can redirect the entire website, and any email routed through the same domain, without ever touching the site's code.
- The hosting control panel — where the site's files, database, and server settings actually live. This is the account a malicious actor needs to plant a backdoor or pull a full copy of the database.
- The CMS or admin login — WordPress, Shopify, or whatever platform the site runs on. Lower blast radius than the two above, but still enough to deface the site or add content that damages trust.
- DNS and email administration — often the same account as the registrar, sometimes separate. Our guide on keeping email off the hosting account covers why this one should be its own login in the first place; two-factor authentication is what protects it once it is.
Not every second factor holds up the same way
A code sent by text message is the most common form of two-factor authentication, and the weakest of the widely available options. It depends on the mobile network, which makes it vulnerable to SIM-swap fraud — an attacker persuading a carrier to move a phone number onto a SIM they control, so the "second factor" arrives in their pocket instead of yours. An authenticator app generating a rotating code, or a physical security key plugged into a USB port, doesn't route through the phone network at all, so neither is exposed to that specific attack. For the registrar and hosting accounts named above — the two with the widest blast radius — an authenticator app is the practical minimum, and a hardware key is worth the small extra setup if the provider supports one.
None of this replaces a strong, unique password on each account. A second factor is exactly that — second. It's the layer that still holds when the first one, the password, has already failed.
Frequently asked questions
If I can only turn on two-factor authentication for one account, which one matters most?
The domain registrar. Whoever controls it can repoint DNS — which means redirecting the entire website, and any email that depends on the same domain's records, without touching the site's code or its hosting account at all. It's the single account with the widest blast radius if it's ever taken over.
Is a code sent by SMS good enough for two-factor authentication?
It's better than a password alone, but it's the weakest common option. SMS codes can be intercepted through SIM-swap fraud, where an attacker convinces a mobile carrier to move your number to a SIM they control. An authenticator app or a hardware security key doesn't depend on the phone network at all, so neither is exposed to that specific attack.
Does two-factor authentication mean I don't need a strong password anymore?
No — it's a second layer, not a replacement for the first. A weak or reused password is still the easiest way in if it's guessed or leaked from an unrelated breach; two-factor authentication is what stops that guessed or leaked password from being enough on its own.
Where does this fit into ongoing website maintenance?
With the access review already on the maintenance clock. Our secure website checklist lists reviewing who still has access as a quarterly minimum — checking that two-factor authentication is actually turned on for every account still on that list belongs in the same pass, not a separate one.
Will two-factor authentication slow down day-to-day work on the site?
It adds a few seconds to signing in, and most providers let a trusted device skip the prompt for weeks at a time once it's verified once. That small friction is the entire point — it's the same few seconds an attacker with a stolen password doesn't have.