Managing Two‑Factor Authentication (2FA) in DirectAdmin
Summary
This guide explains how to enable, configure, and manage Two‑Factor Authentication (2FA) in DirectAdmin. 2FA adds an extra layer of security by requiring a time‑based one‑time password (TOTP) from an authentication app.
Overview
With 2FA enabled, logging into DirectAdmin requires:
1. Your normal account password
2. A 6‑digit code generated by an authenticator app
This prevents unauthorized access even if someone obtains your password.
Requirements
- DirectAdmin user-level access
- A smartphone or device with a TOTP app
- One of the following apps:
• Google Authenticator
• Authy
• Microsoft Authenticator
• 1Password / Bitwarden TOTP
Step-by-Step Instructions
1. Access Two‑Factor Authentication
- Log in to DirectAdmin
- Go to Advanced Features → Two‑Factor Authentication
- Select the user account you want to secure
2. Enable 2FA
- Click “Enable Two‑Factor Authentication”
- A QR code and secret key will appear
3. Scan the QR Code
Open your authenticator app and:
- Choose “Add Account”
- Scan the QR code
OR
- Enter the secret key manually
Your app will now generate a 6‑digit code every 30 seconds.
4. Verify the Code
- Enter the current 6‑digit code from your app
- Click “Enable”
2FA is now active for your DirectAdmin login.
5. Recovery Codes (Important)
DirectAdmin may provide recovery codes.
- Save them in a secure location
- Use them if you lose access to your authenticator app
6. Disable 2FA (If Needed)
- Go to Two‑Factor Authentication
- Click “Disable”
- Confirm the action
This removes the 2FA requirement.
Troubleshooting
Code Not Accepted
- Ensure your phone’s time is correct (enable automatic time sync)
- Try a new 6‑digit code
- Re-scan the QR code if needed
Lost Access to Authenticator App
- Use a recovery code (if saved)
- Contact your hosting provider for manual reset
2FA Prompt Not Appearing
- Ensure 2FA is enabled for the correct user
- Clear browser cache
- Log out and log back in
Multiple Users on the Same Account
- Each user must enable 2FA individually
- 2FA is not shared between users
Security Notes
- Always enable 2FA on admin-level accounts
- Store recovery codes offline
- Avoid using SMS-based 2FA (not supported and less secure)
Related Articles
- [SSH Keys](ca://s?q=SSH_Keys)
- [SSL Certificates](ca://s?q=SSL_Certificates)
- [PHP Settings](ca://s?q=PHP_Settings)
- [Directory Password Protection](ca://s?q=Directory_Password_Protection)
- [Cron Jobs](ca://s?q=Cron_Jobs)