If two-factor authentication is available on your Tremhost client area, you'll find it in the account menu under Security Settings: click Enable, scan the QR code with an authenticator app, enter the code and keep the backup code safe. If you can't see the option, ask us on WhatsApp or in a ticket.
Your client area controls your domains, invoices and the one-click cPanel login for every service, so it’s worth protecting with more than a password. Two-factor authentication asks for a six-digit code from your phone as well as your password.
Turn it on
- Install an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator.
- Sign in to the client area.
- Open Account (or the menu with your name) and look for Security Settings.
- Under Two-Factor Authentication, click the option to enable it. If you’re offered a choice of method, choose the time-based tokens (authenticator app) option.
- Scan the QR code with your authenticator app, type the six-digit code it shows and confirm.
- Write down the backup code you’re shown and keep it somewhere other than your phone. It gets you in if the phone is lost.
From then on, the client area asks for a code from the app each time you sign in.
Can’t see the option?
If there’s no Security Settings page, or no two-factor section on it, it isn’t available on your account yet. Ask us on WhatsApp or open a ticket and we’ll tell you what applies. In the meantime, use a long password you use nowhere else, and switch on two-factor authentication in cPanel under Security → Two-Factor Authentication, which is a separate login.
Tip: If you change phones, move the authenticator to the new phone before you reset the old one. Some apps can transfer or back up their accounts; otherwise turn two-factor off and on again with the new phone.
- I lost my phone and my backup code.
- Contact us. We’ll confirm you’re the account holder before we remove two-factor from the account.
- Do my staff need their own login?
- Yes, ideally. Shared logins make it impossible to tell who did what, and everyone needs the same phone for the code.
Updated 6 November 2026. Something here out of date? Tell us.