Two-factor authentication for your domain and email

Two-factor authentication (often shortened to 2FA, and also called two-step verification) means that signing in needs two things: your password, plus a code or a tap on a device you own. If a scammer learns your password, they still cannot get in without your phone. For a small business, turn it on first for your email, then your domain registrar, then your website account. It takes about ten minutes per account, and the only real risk is locking yourself out, which backup codes prevent.

Which accounts to start with

Do them in this order, because each one protects the next:

Your business email, and the personal email you use as a recovery address. Email is the master key: anyone who controls it can reset most other passwords.
Your domain registrar account. Control of the domain means control of where your website and email point.
Your website builder or hosting account.
Your Google account that manages your Google Business Profile, if it is different from the email above.
Payment and bank accounts connected to the business, if they are not already protected.

The kinds of second step, from weakest to strongest

Services offer different options. Any of them is far better than a password alone.

A text message code. The service texts a six-digit code to your phone. Easy to use, but texts can be intercepted if a criminal convinces your mobile carrier to move your number to their SIM card. Better than nothing; move to an app when you can.
A code from an authenticator app. An app on your phone, such as Google Authenticator or Microsoft Authenticator, shows a fresh six-digit code every 30 seconds. It works without signal, and nobody can redirect it through your phone company. This is a good default for most owners.
A prompt on your phone. Some services, including Google and Microsoft, send a "Is this you trying to sign in?" message to your phone, and you tap Yes. Very easy. Only tap Yes when you are the one signing in at that moment.
A passkey or security key. A passkey lets your phone or computer confirm it is you with your fingerprint, face or PIN, with no code to type. A security key is a small USB or tap-to-phone device that does the same job. These are the hardest to fool, because they will not work on a fake website.

Turning it on, account by account

The exact wording changes from time to time, but the place is nearly always the account's security settings.

Google (Gmail, Google Workspace, Business Profile)

Sign in at myaccount.google.com, open Security, and choose 2-Step Verification. Google walks you through adding your phone, then offers an authenticator app, passkeys and backup codes. If you run Google Workspace for staff, the administrator can also require 2-Step Verification for everyone from the admin console. Google's own instructions are at Google's help center.

Microsoft 365 and Outlook

Sign in to your Microsoft account, open Security, then the advanced security or additional security options, and turn on two-step verification. Microsoft will suggest its Authenticator app. For business plans, the administrator can turn on security defaults, which ask every user to set up the app.

Your domain registrar

Sign in, open your account or profile settings, and look for Security, Login & PIN, or Two-Step Verification. Most registrars offer text codes and authenticator apps. While you are there, check whether the registrar has an account PIN for phone support; set one, so nobody can talk a support agent into changing your domain.

Your website builder or host

Look in account settings under Security or Login. If the site runs on WordPress, two-factor sign-in for the WordPress admin usually comes from a plugin or from the host's dashboard; ask whoever maintains it.

Backup codes: the part people skip

When you turn on 2FA, most services offer a short list of one-time backup codes. Each code gets you in once if your phone is lost, broken or replaced. Without them, recovering an account can take days of identity checks, and some services cannot recover it at all.

Also add a second way in where the service allows it: a second phone number, a second security key, or the authenticator on a tablet as well as your phone.

Changing or losing your phone

Most lockouts happen at phone upgrade time. Before you trade in or reset an old phone:

Check that your authenticator app's codes have moved to the new phone. Google Authenticator and Microsoft Authenticator both offer a backup or transfer option; open the app on the new phone and confirm each account is there.
Sign in to your email and domain account once using the new phone, while the old one still works.
Only then wipe the old phone.

If the phone is lost or stolen, use a backup code to sign in, then remove the lost phone from your account and set up the new one.

Staff and helpers

Every person who signs in should have their own login with their own second step. Sharing one account and one phone for codes means work stops whenever that phone is out on a job. Give your office manager their own admin login, and your web designer their own access. Keeping website and domain logins safe covers how to invite helpers without handing over your password.

What 2FA does not protect against

Two-factor sign-in blocks someone who only has your password. It does not stop you from typing a code into a fake website that passes it straight on. Be suspicious of any email that hurries you to sign in to "keep your domain" or "restore your site", and reach your accounts by typing the address yourself. Phishing emails about your domain or website shows what those emails look like.

Your 2FA checklist

Email account: 2FA on, backup codes printed.
Recovery email account: 2FA on.
Domain registrar: 2FA on, support PIN set.
Website or hosting account: 2FA on.
Google account for your Business Profile: 2FA on.
A second way in added where offered.
A note on your calendar to check codes moved before your next phone upgrade.

With the accounts locked down, changes to your website get less nerve-racking. If yours is due for one, you can see your site rebuilt first before deciding anything.