Two-factor authentication (2FA) adds an extra layer of security to your Plesk account. After entering your password, you will also need to enter a verification code from an authenticator app on your phone. This makes it much harder for unauthorized users to access your account, even if they know your password.

### Prerequisites

- The **Multi-Factor Authentication (MFA)** extension must be installed. Contact your hosting provider if it is not available.
- An authenticator app installed on your phone (e.g., **Google Authenticator**, **Authy**, or **Microsoft Authenticator**).

### Enabling 2FA

1. Log in to **Plesk**.
2. Go to **Extensions** → **Multi-Factor Authentication**.
3. Select **Enable Multi-factor Authentication**.
4. A QR code will appear on the screen.
5. Open your authenticator app on your phone.
6. Tap **Add account** → **Scan barcode**.
7. Point your phone camera at the QR code on the screen.
8. The app will add your Plesk account and begin generating 6-digit verification codes.
9. Enter the current verification code from the app into the **Verification code** field in Plesk.
10. Optionally enable **"Remember Device"** to skip 2FA on trusted devices for 30 days.
11. Click **OK**.

### Logging In With 2FA

After enabling 2FA, the login process becomes:

1. Enter your **username and password** as usual.
2. Plesk will ask for a **verification code**.
3. Open your authenticator app and enter the current 6-digit code.
4. If you enabled "Remember Device", check the box to skip 2FA on this device for 30 days.

### Reconfiguring 2FA

If you lose access to your authenticator app or get a new phone:

1. Go to **Extensions** → **Multi-Factor Authentication**.
2. Disable 2FA by clearing the **Enable Multi-factor Authentication** checkbox and clicking **OK**.
3. Re-enable 2FA and scan the new QR code with your new device.

### Important Notes

- **Save your backup codes** when setting up 2FA. These can be used to log in if you lose access to your authenticator app.
- Verification codes expire every **30 seconds**. If your code is rejected, wait for a new one.
- Your hosting provider may enforce 2FA for all users. In that case, you cannot disable it.

### Troubleshooting

**Cannot scan the QR code:**

- Use the manual setup option — enter the secret key displayed below the QR code into your authenticator app.

**"Invalid verification code" error:**

- Make sure the time on your phone is set to **automatic**. 2FA codes are time-based.
- Wait for a new code to generate (codes refresh every 30 seconds).

**Locked out of Plesk:**

- Contact your hosting provider to disable 2FA on your account.

### Related Guides

- [Restrict login by IP](/hc/help/en/articles/how-to-protect-your-plesk-login-with-ip-access-restrictions)
- [Secure the site with SSL](/hc/help/en/articles/how-to-install-a-free-let-s-encrypt-ssl-in-plesk)
- [Force HTTPS](/hc/help/en/articles/how-to-force-https-and-redirect-http-to-https-in-plesk)