Setting Up and Using Two-Factor Authentication (2FA) - Step-by-Step Guide Print

Two-Factor Authentication (2FA) is now required on your Adaptive Web Hosting client area. This guide walks you through every step — setup, daily use, backup codes, and what to do if you get locked out. Please read it fully before contacting support; the most common "I'm locked out" tickets are answered below.

What is 2FA and why is it required?

Two-Factor Authentication adds a second step to login. After your password, you enter a 6-digit code that changes every 30 seconds. Even if someone steals your password, they cannot log in without your phone. Because hosting accounts can be used to send spam, host phishing pages, or steal your domains and email, we now require all customers to enable 2FA on their next login.

What you need before you start

• A smartphone (iPhone or Android).
• A free authenticator app installed on that phone. We recommend any of:
  • Microsoft Authenticator (recommended for most users)
  • Google Authenticator
  • Authy (good if you want cloud backup of your codes)
  • 1Password or Bitwarden (if you already use a password manager)
• A safe place to store your backup codes (a password manager, or a printed copy in a drawer). Do not store them only on the same phone you are using for 2FA — if the phone breaks, you lose both at once.

Step 1 — Install the authenticator app

1. On your phone, open the App Store (iPhone) or Google Play Store (Android).
2. Search for Microsoft Authenticator (or whichever app you chose).
3. Install it. Open it once and accept any permissions it asks for. Microsoft Authenticator may ask you to sign in with a Microsoft account — you can skip that and choose "Add account manually" later.

Step 2 — Log in to your client area

1. Go to https://cp.adaptivewebhosting.com and log in with your normal email and password.
2. The first time you log in after 2FA was enabled, you will be redirected to a setup page titled "Two-Factor Authentication Setup". You cannot skip this page — 2FA is mandatory.
3. Choose Time Based Tokens when asked to pick a method, then click Get Started.

Step 3 — Scan the QR code

1. You will see a black-and-white QR code on the screen along with a long "Manual Entry" key underneath it. Leave this page open.
2. Open your authenticator app on your phone.
3. Tap + (or Add account) inside the app. Choose Other account or Scan QR code.
4. Allow the camera permission. Point your phone's camera at the QR code on your computer screen until the app captures it.
5. The app will add a new entry called Adaptive Web Hosting (or similar) and immediately start showing a 6-digit code that changes every 30 seconds.

Cannot scan the QR code? Tap Or enter code manually in your authenticator app and type the long key shown under the QR code on your screen. The result is identical.

Step 4 — Confirm the code

1. On the setup page, type the current 6-digit code from your authenticator app into the "Verification Code" box.
2. Click Submit. If the code is correct, the page will move on. If it says "invalid code", wait until the code in your app rotates to a new one and try again — you may have caught it in the last second of its life.

Step 5 — SAVE your backup codes

After confirming the code, the system will display a list of one-time backup codes. This screen will only appear ONCE. If you close it without saving the codes, we cannot show them to you again — we would have to reset your 2FA from scratch.

Do all three of these:

1. Print them using your browser's print function (Ctrl+P / Cmd+P) and put the paper somewhere safe. A drawer at home is fine; your wallet is also fine.
2. Save them in a password manager if you use one (1Password, Bitwarden, LastPass, Apple Passwords, etc.). Add them as a secure note attached to your Adaptive Web Hosting login.
3. Do not save them only on the same phone that runs the authenticator app. If that phone is lost, stolen, or wiped, you will need a backup code stored somewhere else to get back in.

Each backup code can be used exactly once. After you use one, cross it off your list. When all of them have been used you must generate new ones from inside your client area (Security Settings → Two-Factor Authentication → Manage).

Logging in from now on

1. Go to https://cp.adaptivewebhosting.com and enter your email and password as usual.
2. You will then see a screen asking for your 6-digit code.
3. Open the authenticator app on your phone, find the Adaptive Web Hosting entry, and type the 6 digits it currently shows.
4. Click Login. You are in.

The whole process takes about 10 seconds once you are used to it. You do not need to scan the QR code again — that was only for the initial setup.

Using a backup code instead of the app

If you do not have your phone with you, click Use Backup Code on the 2FA prompt and enter one of the codes you saved during setup. Important:

• Each backup code works only once. The next time you log in, you must use a different one (or your authenticator app).
• If you keep getting "invalid backup code" on a code that worked before, you have already used it. Try the next one on your list.
• Never share a backup code with anyone, including support staff. If a support agent needs to verify you, they will use other means.

Common problems and fixes

"Invalid verification code" even though I just typed it

The 6-digit code rotates every 30 seconds. If you typed slowly, it may have already changed. Wait for the next code to appear in your app and try again. Also check that your phone's clock is set to automatic — if your phone's time is more than ~30 seconds off, the codes will never validate. On iPhone: Settings → General → Date & Time → Set Automatically. On Android: Settings → System → Date & Time → Use network-provided time.

"Your IP has been banned" or you cannot reach the login page at all

Our system temporarily blocks an IP address after several failed login attempts to protect your account. The block lifts automatically after 15 minutes — simply wait 15 minutes and try again. Do not keep retrying during the ban; that does not extend the ban, but it also does not help. If you are absolutely sure you typed the right password and code and are still seeing this, open a support ticket from a different device or network (your phone on cellular data works) and include your real IP address (search "what is my ip" on Google).

I lost my phone / replaced my phone / wiped my phone

Use a backup code from the list you saved during setup to log in. Once inside, go to Hello, [Your Name] → Security Settings → Two-Factor Authentication, click Disable, then re-enable it on your new phone. New backup codes will be generated — save them.

I lost my phone AND I never saved my backup codes

You will need to contact support to manually reset your 2FA. Open a ticket at https://cp.adaptivewebhosting.com/submitticket.php from any email address that we can verify against your account, and we will reset 2FA after confirming your identity. Please save your backup codes next time — resets are slow because we must verify ownership of the account, and you cannot do anything in the meantime.

I have multiple Adaptive Web Hosting accounts under different emails

Each account needs its own 2FA setup. Add a separate entry in your authenticator app for each one. Most apps will name them with the email address so you can tell them apart.

I want to switch authenticator apps

Log in, go to Security Settings → Two-Factor Authentication, click Disable, then click Enable again and scan the new QR code with your new app. You will get a fresh set of backup codes — save them and discard the old ones.

The QR code will not scan

Make sure your screen brightness is up, the QR code is fully visible, and you are holding the phone 6–12 inches from the screen. If it still will not scan, use the manual entry key shown under the QR code instead.

Security best practices

• Treat backup codes the same way you treat your password — do not paste them into emails, chat messages, or screenshots you share.
• If you suspect anyone else has seen your backup codes, log in and regenerate a new set immediately.
• Use a different password for your client area than for your email account.
• If your email account is compromised, an attacker could potentially request a password reset. 2FA stops that attack from succeeding.

Still stuck?

Open a support ticket from https://cp.adaptivewebhosting.com/submitticket.php. Tell us:

• Which step in this guide you are on.
• The exact error message you see (a screenshot is best).
• Whether you still have your backup codes.

The more detail you give us up front, the faster we can help. Thank you for taking the time to set up 2FA — it protects your account, your domains, and your data.