Two-factor authentication means a stolen password is not enough on its own. It is the single highest-value security change available to you, and it takes about two minutes.
Client area. Log in, go to your account security settings, and choose Enable Two-Factor Authentication. Scan the QR code with an authenticator app - Google Authenticator, Authy, 1Password and most password managers all work - then enter the six-digit code to confirm.
cPanel. Search for Two-Factor Authentication in the security section and follow the same pattern.
Save your backup codes somewhere that is not your phone. This is the step people skip, and it is the reason for most lockouts. If you lose the device and have no backup codes, recovery means proving your identity to us, which is deliberately slow.
Prefer an app over SMS where you have the choice. SIM swapping is a real attack and text messages are the weakest of the common second factors.
