Turn on two-step login

With two-step login, a stolen password isn't enough: anyone signing in also needs a code from your phone. It takes five minutes per account and stops most break-ins.

The accounts that matter most

  1. Your email. Whoever has it can reset every other password.
  2. Where you bought your domain. Lose it and you lose your website and your email together.
  3. Your website's log-in (WordPress, Wix, Squarespace, Shopify).
  4. Your web host, if you have one.

How to turn it on

Every service puts it in its account or security settings, usually called two-step verification, two-factor authentication or 2FA.

  1. Gmail and Google: your Google Account › Security › 2-Step Verification.
  2. Outlook and Microsoft: account.microsoft.com/security › Manage how I sign in › Two-step verification › Turn on.
  3. Your domain, host and website builder: log in, open account or security settings, and look for two-step or 2FA.
  4. When it offers a choice, pick an authenticator app or a passkey over text messages: they're harder to steal.
  5. Save the backup codes it gives you somewhere safe and offline. They get you in if you lose your phone.