Bluehost's Two-factor Authentication, also known as 2FA, is an optional feature to prevent anyone but yourself from accessing your hosting account by requiring two identity verification forms: your password and an authentication code. 2FA is ideal for anyone looking to increase their account security because stealing your password isn't enough for hackers to access your account. Depending on your setup, they also need access to your mobile device or email account.   

This article covers everything you need about two-factor authentication and how to use it on your account. 

---

• How Does It Work?
• Enable Two-Factor Authentication
• How to Disable Two-Factor Authentication
• Frequently Asked Questions

---

How Does It Work?

Once two-factor authentication is enabled, logging in to your account will work differently for Rock customers, and those customers already migrated to the new Bluehost Account Manager interface. You'll enter your Bluehost username and password as usual. Then you'll be prompted to enter a 2FA authentication code that you'll get from an app on your mobile device, your email, or your phone number. Enter the 6-digit single-use code to complete the login and access your account. Google Authenticator refreshes the code every 30 seconds, but the refresh rate varies per app. Regardless of the refresh rate, each code is valid for 5 minutes. 

You'll be prompted to provide an authentication code in three situations: 

• When a login attempt is made 
• Upon an attempt to enable or disable two-factor authentication 
• To validate you're an authorized user on an account when you contact one of our support teams for assistance (In this situation, the authentication code is referred to as a validation token)

Enable Two-Factor Authentication

Two-factor authentication can be enabled separately for the main account, billing, and hosting passwords. However, you can only enable it for your password to log in to the account. You can enable the two-factor authentication by following these steps:

Bluerock

Mobile Device Setup

Most users prefer to use an authenticator app (like Google Authenticator) on their mobile devices to retrieve the code for 2FA. An authenticator app allows you to access the code anytime, even without internet access. After you've installed an authenticator app, follow the steps below to set up 2FA and link your Bluehost account to your device:

1. Log in to your Bluehost control panel.
2. Click the Accounts menu at the top of the page.
   
3. Click Security in the submenu.
   
4. Scroll down to Two-Factor Authentication.
5. Use the authenticator app to scan the QR code or manually enter the Secret Key to add your Bluehost account to your device.
6. Enter the 6-digit code displayed in the app and click Verify Token.

Email Setup

Suppose you'd prefer to receive authentication codes by email. In that case, you can set up the 2FA to send authentication codes to the email address of your choice. To make your account more secure, we recommend using an email address different from the one listed in the Account Profile. 

1. Log in to your Bluehost control panel.
2. Click the Accounts menu at the top of the page.
   
3. Click Security in the submenu.
   
4. Scroll down to Two-Factor Authentication.
   
5. Next to "Don't have a smartphone?" Click the Click Here to be taken to email setup.
6. Enter your email address and click the Update button to have a code emailed to you.
7. Check your email for the authentication code.
8. Enter the 6-digit code found in the email and click Verify Token.

Account Manager

You can enable the two-factor authentication in Account Manager by following these steps:

1. Log in to your account. 
2. Locate the name of the user in the user in the upper right corner and do the following steps below: 
   1. Click the Name of the User (your name). 
   2. Please hover your mouse and click My Profile.
      
3. In the Security section, click the ACTIVATE button under the 2 Step Verification section. 
   
4. Tick the Box to agree to activate 2-Step Verification for the account, then click the ACTIVATE button.
   
5. Remember to take note of the Recovery Key, where you will always be able to locate it, then click the FINISH button.
   

How to Disable Two-factor Authentication

You can disable two-factor authentication by following these steps:

 Bluerock

1. Log in to your Bluehost control panel.
2. Click the Accounts menu at the top of the page.
   
3. Click Security in the submenu.
   
4. Scroll down to Two-Factor Authentication.
5. Click Disable Two-Factor Authentication.
6. Enter the current authentication code and click Disable Two-Factor Auth.

Account Manager

You can disable the two-factor authentication in Account Manager by following these steps:

1. Log in to your account. 
2. Locate the name of the user in the upper right corner and do the following: 
   • Click the Name of the User (your name). 
   • Hover your mouse and click My Profile.
     
3. Click the DISABLE button under the 2 Step Verification section in the Security section. 
   
4. Tick the Box to acknowledge that the 2-Step Verification will be disabled for the account, then click the DISABLE button.
   

Frequently Asked Questions

Why do I need to enable two-factor authentication?  Can I use a different two-factor smartphone application to do this?  I entered the code but was then redirected to the login screen. What's going on?  I'm locked out of my account and can't get a new code. What do I do? Will this prevent my websites from being hacked? What else can I do to strengthen my account security?