Two-step authentication adds a second step when you log in to DirectAdmin: as well as your password, you enter a 6-digit code from an authenticator app on your phone. Even if someone learns your password, they can't log in without your phone.

You'll need an authenticator app, such as Google Authenticator or Microsoft Authenticator.

Turning it on

1. Log in to DirectAdmin.
2. Click your username at the top right, click Profile and go to Two-Step Authentication. You can also type "two-step" in the menu's search box.
3. Enter a description, such as "PaduHost DirectAdmin", so you can recognise it in your app.
4. Click Generate Secret. A QR code appears.
5. Scan the QR code with your authenticator app.
6. Enter the 6-digit code from the app to confirm it works.
7. Enable two-step authentication and save. You can also choose to be notified when a login fails.

Backup (scratch) codes

Scratch codes let you log in if you don't have your phone. Each code works once.

1. On the same page, click Add Codes.
2. Choose when the codes should expire and generate them.
3. Print them or store them somewhere safe, away from your phone.

Logging in

After you enter your password, DirectAdmin asks for the current code from your app.

Lost your phone?

Log in with one of your scratch codes, then set up two-step authentication again on your new phone. If you don't have a scratch code, open a Technical Support ticket. We'll verify your identity before turning it off for you.

This protects your DirectAdmin login only. Your Client Area has its own two-factor authentication. See Turning on two-factor authentication for your Client Area.