If you run a blog or build an audience on social media, your accounts are your business. Losing access to your Instagram, your YouTube channel or the admin area of your website isn’t just annoying. It can mean losing years of work, brand deals you’ve already agreed and the audience you rely on for income. And getting an account back once someone else has taken it over can be slow, stressful and sometimes impossible.
Two-factor authentication (often shortened to 2FA, or called two-step verification) is one of the simplest ways to stop that happening. But not all types of 2FA are equally good, and setting it up badly can lock you out just as effectively as a hacker would. Here’s what the main options are, how they compare, and how to set them up without creating a new problem.
What two-factor authentication actually does
Normally, logging in only needs one thing, your password. If someone gets hold of it through a data breach, a phishing email or a reused password, they’re in. Two-factor authentication adds a second check, usually something you have (like your phone) on top of something you know (your password). Even if your password leaks, the attacker still can’t log in without that second step.
The National Cyber Security Centre recommends turning it on for your most important accounts first, starting with your email, and explains why in its guide to activating 2-step verification. For creators that point about email is especially important, because your email is usually the “master key” used to reset every other account you own.
Why creators are a target
Accounts with an audience are valuable. Hacked social media accounts get sold on, used to push crypto scams to followers, or held for ransom. Blogs with decent traffic get hijacked to host spam or redirect visitors to dodgy sites, which can wreck your search rankings long after you’ve got control back.
Creators also get a lot of very convincing phishing. Fake “copyright violation” warnings, fake brand collaboration offers with a malicious attachment, and fake “verify your account to keep your blue tick” messages are all common. 2FA won’t stop you from falling for one of these, but the right kind can stop it from mattering.
Option 1: SMS codes
This is the one most people have come across. You log in, and a six-digit code gets texted to your phone.
The good: It’s easy to set up, works on any phone and is much better than having no 2FA at all.
The not so good: Text messages can be intercepted, and criminals can sometimes persuade a mobile network to move your number onto a new SIM card in their possession. This is called SIM swapping, and it has been used to take over plenty of high-profile social media accounts. SMS codes can also be phished, because there’s nothing stopping you from typing the code into a fake login page. And if you change your number, lose your phone or travel somewhere without signal, you can end up locked out.
Verdict: Fine as a starting point or a backup, but not what you want protecting your main accounts.
Option 2: Authenticator apps
Instead of a text, an app on your phone (such as Google Authenticator, Microsoft Authenticator, or the one built into many password managers) generates a fresh code every 30 seconds.
The good: The codes are created on your device, so there’s nothing to intercept and SIM swapping doesn’t help an attacker. They work without phone signal, and they’re supported by nearly every major platform, including Instagram, TikTok, YouTube, X, Facebook and most website hosting and blogging platforms.
The not so good: Like SMS, the codes can still be phished if you type them into a fake site. And if you lose or reset your phone without moving the app properly, you can lose access to all of your codes in one go. That’s one of the most common ways creators lock themselves out of thier own accounts.
Verdict: A big step up from SMS. For most people, this is the sensible minimum for any account that matters.
Option 3: Passkeys
Passkeys are the newest option and they work quite differently. Rather than a password plus a code, you log in using your phone or computer’s own unlock method, such as your fingerprint, face or device PIN. Behind the scenes, your device proves who you are using a cryptographic key that never leaves it.
The good: Passkeys can’t be phished in the usual way, because they only work on the genuine website they were created for. A fake login page simply won’t get a response. There’s no code to type and no password to steal. The FIDO Alliance, the group behind the standard, has a good explanation of how they work if you want the technical detail.
The not so good: Not every platform supports them yet, and the experience still varies a bit between devices. You also need to think about where your passkeys are stored. Most are synced through your Apple, Google or password manager account, so that account becomes very important to protect.
Verdict: The strongest option for most people. Use passkeys anywhere they’re offered, especially for your email and main social platforms.
Don’t forget your blog itself
It’s easy to secure your Instagram and forget the website you actually own. If you run a self-hosted blog, there are usually at least three seperate logins worth protecting:
- Your blog’s admin login. Most blogging platforms support 2FA, either built in or through a security plugin. Turn it on for every account with admin access, not just yours.
- Your hosting account. Whoever controls your hosting controls your website, files and backups. Most hosts offer 2FA in the account settings.
- Your domain registrar. This is the one people forget the most. If someone takes over your domain, they can point it anywhere they like. Lock the domain and turn on 2FA with the registrar.
If you have a virtual assistant or a freelancer helping with your blog or socials, give them their own login with only the access they need, rather than sharing yours. Shared passwords and shared 2FA codes are a common weak spot.
How to avoid locking yourself out
This is the part most guides skip, and it’s the part that matters most for creators. Strong 2FA is only useful if you can still get in when something goes wrong.
- Save your backup codes. Almost every platform gives you a set of one-time backup codes when you turn on 2FA. Store them somewhere safe and separate from your phone, such as a password manager or printed out at home.
- Add more than one method. Where a platform allows it, register a passkey and an authenticator app, or two devices. That way losing one doesn’t lock you out.
- Move your authenticator properly when you change phones. Most apps now have a transfer or backup option. Do it before you wipe or trade in the old phone, not after.
- Keep your recovery details up to date. Make sure the email address and phone number on each account are ones you still use and still control.
- Secure your email first. If your email is safe, you can usually recover everything else. If it isn’t, nothing else is.
Where to start
If you’ve never set any of this up, don’t try to do everything in one evening. Start with your main email account and add a passkey or authenticator app. Then do the platform that earns you the most money, whether that’s Instagram, YouTube, TikTok or your blog. Then your hosting and domain. Save your backup codes for each one as you go.
It takes maybe an hour in total, and it’s an hour you’ll be very glad you spent if someone ever does get hold of your password. Your audience took years to build. It’s worth five minutes per account to make sure it stays yours.
WordPress Theme: Lavoie
