Two-step verification
Asking for a code as well as your password when you sign in, and what to do if you lose your phone.
On this page
Two-step verification asks for a code as well as your password when you sign in. Someone who learns or guesses your password still can't get into your site without that code. It's off until you turn it on, and we strongly recommend it for every Admin account.
Turning it on
- Click the shield icon in the top bar of your admin panel.
- Enter your current password, then choose Use an authenticator app or Email me a code.
- For an app, scan the QR code with it (or type in the key shown under the code), then enter the 6-digit code the app shows. For email, enter the code we send you.
- Save your recovery codes. They're shown once, right after you turn it on.
Each person sets this up for their own account. Turning it on doesn't change anyone else's login.
App or email?
An authenticator app, such as Google Authenticator, Microsoft Authenticator, or 1Password, is the stronger choice. It works without a signal, and someone who gets into your email still can't get your codes. Email codes are simpler if you'd rather not install anything, and they still stop someone who only has your password.
Signing in
After your password, you'll be asked for a code. An app shows a new one every 30 seconds, and each code works once. An emailed code lasts 10 minutes. If it doesn't arrive, check your spam folder, then use Send a new code.
If you tick Remember me, that device skips the code for 30 days. Turning two-step verification on or off signs out every remembered device, so each one asks for a code the next time.
Recovery codes
You get ten recovery codes, and each one gets you in once if you don't have your phone or can't reach your email. Choose Use a recovery code on the sign-in screen. Keep them somewhere safe, such as a password manager. To replace them, go back to the shield icon and choose Make new codes. Your old codes stop working.
Lost your phone?
Sign in with a recovery code, then turn two-step verification off and set it up again on your new phone. If you have no recovery codes left:
- Another Admin on your site can turn it off for you under Users, with the shield button next to your account. You'll get an email when they do.
- If you're the only Admin, contact us. We'll confirm it's you before we turn it off.
Your account dashboard
Your account dashboard, where billing and your domain live, has its own two-step verification, separate from your admin panel. Turn it on from the Sign-in security card on the dashboard. You'll need a dashboard password first, because every change asks for it.
The one-click links between your dashboard and your admin panel respect both. If you passed two-step verification on one side, the other doesn't ask again. If you didn't, it asks for a code before letting you in.
When SignalPage support signs in
If you ask us to fix something on your site, our support staff can open a support session without your code. They have to pass their own two-step verification and re-enter their password to do it, you get an email every time one starts, and it ends after an hour. Support staff can't change your two-step verification settings.