Every public login page on the internet is tried by automated password guessers around the clock, and Saturday's breach check showed how many old passwords are already circulating. Those two facts depend on the same gap: a password, by itself, is the only thing standing between a stranger and your organization's website, domain, or email. This week's twenty minutes closes that gap.
Two-factor authentication (2FA) means an account asks for a second proof after the password, usually a six-digit code from an app on a phone. Its value is simple: a stolen or guessed password stops being enough. In the book's security baseline, 2FA graduates from recommended to required for one category of account: every account that can change the website, the domain, or the email, which is to say every account whose compromise would be an incident. The check below lists those accounts in order of the damage each could do alone, then covers three setup decisions that decide whether the protection survives a lost phone or a departure.
The list, in order
Work down this list and turn on 2FA wherever it is missing.
Registrar. It holds the domain; losing it takes the website, the email, and the name.
Email. The organizational mailbox resets the password on nearly everything else.
Hosting account. It holds the site and, often, its backups.
DNS provider, if it is separate from the registrar or host (Cloudflare, for example).
Content management system (CMS) administrator accounts. Every admin, not just yours.
Social media accounts, for each named admin, per the access card in M12.1.
Donation, payment, and store accounts.
Wherever your backups live, such as the Google Drive or Dropbox account that holds the off-site copy.
Three setup choices that matter
Prefer an authenticator app over text messages where the account offers both. Text-message codes can be intercepted or redirected to a new phone by a determined attacker, while an app's codes stay on the device.
Keep custody with the organization. This is the step most people skip, and it is how organizations get locked out of their own accounts by their most helpful people. A second factor that lives only on one volunteer's personal phone is a single point of failure with good intentions; when that person is in class, on vacation, or gone, the account is unreachable. Set up the 2FA on an organizational device, or use a password manager that stores 2FA codes in a shared vault, so that at least two people can produce a code.
Save the backup codes. Nearly every service offers a set of one-time recovery codes during setup. Store them in the vault entry for that account. They are what you use when the phone is lost, and they are what your successor uses when you are on vacation.
Done looks like a dated list of the eight account types above with a checkmark beside each one now protected by 2FA, the backup codes saved in the vault, and no second factor living only on a personal phone.
If an account does not offer 2FA at all, write that down too. A domain registrar or host without 2FA in 2026 has told you something important about how it handles security, and it belongs on the list of reasons you might someday switch.
Get the checklist. The M8.1 Security Baseline Checklist scores your site on fifteen pass-or-fail items, 2FA coverage among them, with the fix for each failure. It is free with a Web Managers account at https://webmanagers.com/register, and it arrives with the weekly Web Managers letter.