Start with the accounts that control the site
A website administrator account can change pages, install software, manage users or alter settings. A password alone may not be enough to protect that access: passwords can be reused, guessed or entered into a convincing fake sign-in page. Multifactor authentication, or MFA, asks for another form of verification after the password. It makes a stolen password less useful, though it does not replace a strong password or careful account management.
Make a short inventory before changing settings. Include the website’s content management system, hosting account, domain registrar, DNS provider, business email and any service that can publish to the site. Email deserves particular attention because it often receives password-reset messages. Record who owns each account and which people actually need administrator access. Give each person their own login where the service allows it; a shared administrator account makes it harder to remove access or understand who made a change.
Choose a method people can use reliably
Look at the MFA options offered by each service. Security keys and passkeys can provide strong protection against fake sign-in pages when the service supports them. An authenticator app that generates one-time codes is another practical choice. SMS codes may be the only option on some services, but they can be less dependable if a phone number changes, messages are delayed or a number is taken over. Use the strongest workable option available rather than leaving MFA off while waiting for a perfect setup.
Think about the working conditions of the people who will sign in. Someone who travels or changes phones may need a second registered key or another supported backup method. Avoid setting up every administrator to depend on one person’s device. If a service offers a choice between verification methods, check whether a weaker method remains available as an easy fallback. The account is only as well protected as the routes that can still be used to enter it.
Enable MFA one account at a time
Begin with the accounts that can reset or take control of the others, often email, the domain registrar and hosting. Then secure the website’s administrator accounts and connected publishing tools. For each account, sign in through the service’s usual address, find its security settings and follow its enrollment steps. If you are asked to scan a setup code, do so from the intended administrator’s device rather than sending the code through a shared chat.
Before moving on, sign out and complete a fresh sign-in using the new method. Confirm that the right person can access the account and that MFA is requested when expected. If a small team depends on the site, consider scheduling these changes when someone else is available to help verify access. Do not remove an old, working method until its replacement and recovery route have been tested.
Prepare for a lost device
Many services issue recovery codes during MFA setup. Save them immediately in a secure place that authorized site owners can reach during an emergency, such as a team password manager with appropriate access controls. Do not leave codes in an ordinary document beside the account password or in an inbox that the same account protects. Each service may handle codes differently, so note whether using one consumes it and whether new codes can be generated later.
Write a brief recovery plan: who can act if an administrator loses a phone or key, where backup methods are held, and how the team will confirm a request is genuine. Where supported, registering a spare security key or a second administrator with their own MFA can reduce dependence on a single device. Keep this plan private, but make sure the right people know it exists. Recovery should be possible without making routine sign-in easier for an unauthorized person.
Make MFA part of routine maintenance
Revisit access whenever a contractor leaves, a staff member changes roles or the team replaces a device. Remove accounts that are no longer needed, update registered MFA methods and review recovery codes after they are used or exposed. Periodically check that administrators can still sign in and that important accounts have not been overlooked. An inventory with account owners and a date for the next review is often more useful than a complicated policy nobody follows.
Finally, remind administrators not to approve an unexpected sign-in prompt or share a one-time code with someone who asks for it. MFA is a useful barrier, but a person can still be tricked into authorizing access. Pair it with unique passwords, prompt software updates and limited administrator privileges. The goal is a setup the team can maintain: secure enough to protect the site, and clear enough that legitimate administrators do not have to bypass it to do their work.
