# #NoHacked: Using two-factor authentication to protect your site

Monday, August 10, 2015


Today in our #nohacked campaign, we'll be talking about two-factor authentication. Follow along
with discussions on [Twitter](https://twitter.com/googlesearchc) and
[Google+](https://plus.google.com/+GoogleWebmasters)
using the #NoHacked tag.
([Part 1](https://developers.google.com/search/blog/2015/07/nohacked-how-to-avoid-being-target-of),
[Part 2](https://developers.google.com/search/blog/2015/08/nohacked-how-to-recognise-and-protect))
![](https://developers.google.com/static/search/blog/images/import/94c8fdab68ca245ac9200294fb3b7882.png)


There was once a time when having a relatively strong password or answering a security question
was a reasonable way to protect your online accounts. However, according to
[a study from Stop Badware](https://www.stopbadware.org/files/compromised-websites-an-owners-perspective.pdf),
stolen credentials is a common way for hackers to compromise websites. Additionally, even
reputable sites can fall victim to hacking, potentially exposing your personal data like passwords
to attackers.


Fortunately, two-factor authentication can help you keep your accounts safer. Two-factor
authentication relies on an additional source of verification, in conjunction with your password,
to access your account. You might have used two-factor authentication before if you have ever been
prompted for a code from your phone when logging into a social media site or from a chip card
reader when logging into a bank account. Two-factor authentication makes it more difficult for
someone to log into your account even if they have stolen your password.


As a website owner, you should enable two-factor authentication on your accounts where possible.
A compromised account can cause you to lose important personal data and valuable reputation for
your site. Two-factor authentication can give you the ease of mind that your accounts and data are
safer.


Google currently offers
[2-Step Verification](https://www.google.com/landing/2step/) for all
of its accounts, including accounts from Google Apps domains. You can use your phone, a hardware
token like a
[Security Key](https://support.google.com/accounts/answer/6103523),
or the
[Google Authenticator app](https://support.google.com/accounts/answer/1066447)
to verify your account. These options give you flexibility when traveling or when you don't have
access to the mobile network.


If your hosting provider,
[Content Management System](https://en.wikipedia.org/wiki/List_of_content_management_systems)
(CMS), or any type of platform you use for managing your site doesn't offer two-factor
authentication, ask their customer support for an option to use two-factor authentication in the
future.They can build two-factor authentication into their own platforms using
[Google's open source code](https://github.com/google/google-authenticator).
If your platform or hoster doesn't provide strong protection against unauthorized access consider
hosting your content elsewhere. You can see a list of websites that support two-factor
authentication, including what types of authentication options they offer, at the
[TwoFactorAuth site](https://twofactorauth.org/).


If you have any additional questions, you can post in the
[Webmaster Help Forums](https://support.google.com/webmasters/go/community)
where a community of webmasters can help answer your questions. You can also join our
[Hangout on Air about Security](https://plus.google.com/events/csqjnqe8vl28qbn526makjecobc)
on August 26.


Posted by: Eric Kuan, Webmaster Relations Specialist and Yuan Niu, Webspam Analyst