Protect your account with two-factor authentication

A password alone can leak, be guessed or be reused somewhere it should not be. With two-factor authentication (2FA) you also need a code from an app on your phone to sign in. Someone who only has your password stays outside. Setting it up takes about two minutes.

What you need

• Your Headpat Space account and its password.
• An authenticator app on your phone. Any app that supports time-based codes (TOTP) works.
• A safe place to store your backup codes, such as a password manager or a sheet of paper in a drawer.

Turn on 2FA

1. Sign in to the panel.
2. Open Profile in the sidebar, or click your name and choose Account settings.
3. Find the card Two-factor authentication and click Enable 2FA.
4. Enter your Password and click Continue.
5. Open the authenticator app on your phone, add a new account and scan the QR code shown in the panel. There is only a QR code to scan, so open the panel on a computer or another screen.
6. Below the QR code you see your Backup codes. Click Copy all codes and store them somewhere safe. Do this now, because they are shown only this once.
7. Tick I've saved these codes and click Next.
8. Enter the 6-digit code your app shows under Code and click Verify and enable.

The card now shows 2FA is enabled. If the code is rejected, wait for the app to show a new one and try again. Also check that the time on your phone is set automatically, because the codes depend on the clock.

Sign in with a code

From now on signing in takes one extra step.

1. Sign in with your email address and password as usual.
2. The panel asks for your Authentication code. Open the authenticator app and type the 6-digit code of your panel entry. The app lists it as HP-Panel.
3. Click Verify.

A code is valid only for a short time. If it changes while you are typing, just use the new one.

Skip the code on your own device

Below the code field you can tick Trust this device for 30 days (skip 2FA next time). On that browser you then only need your password for the next 30 days. Use this on your own computer or phone only, never on a shared or public one.

What to do with your backup codes

Backup codes are your spare keys. Each one lets you sign in once when you cannot reach your authenticator app.

• Store them apart from your phone. A password manager, or a printout in a safe place, both work well. A note on the same phone as the authenticator app does not help when the phone is gone.
• Each code can only be used once. Cross it off after you used it.
• Do not share them with anyone, and enter them only on the sign-in page of the panel.

Sign in with a backup code

1. Sign in with your email address and password.
2. On the code screen, click Use a backup code instead.
3. Enter one of your codes under Backup code and click Verify.

Changed your mind? Use authenticator app instead brings you back to the normal code field.

Get new backup codes

Running low, or worried that someone saw your codes? Make a new set.

1. Open Profile and find the card Two-factor authentication.
2. Click Regenerate backup codes.
3. Enter your Password and click Continue.
4. Click Copy all codes, store the new codes and click Close.

Your old codes stop working immediately, so throw them away.

If you lose your phone

You still have a backup code

1. Sign in with a backup code, as described above.
2. Open Profile and click Disable 2FA in the card Two-factor authentication. Confirm with your Password.
3. Click Enable 2FA and go through the setup again with your new phone. You get a fresh QR code and fresh backup codes.

If your phone was stolen, also look at the card Active sessions on the same page. If other devices are signed in, click Sign out everywhere else to sign them all out.

You have no backup codes left

Then you cannot sign in by yourself, and that is exactly what 2FA is meant to do. Contact support through the contact page on our website.

You are getting a new phone

Planned is easier than lost. While you still have the old phone, sign in, click Disable 2FA and then Enable 2FA again, and scan the new QR code with the new phone. Some authenticator apps can also move your accounts to a new phone themselves. Only wipe the old phone after you have signed in once with the new one.

Turn 2FA off

1. Open Profile and find the card Two-factor authentication.
2. Click Disable 2FA.
3. Enter your Password and click Continue.

After that you only need your password to sign in. We recommend leaving 2FA on: your account controls your servers, your domains and your payment details.

More ways to stay safe

• Protect the email account behind your panel account with 2FA as well. Whoever can read your email can reset passwords.
• Running a VPS? Secure your VPS: the first ten minutes shows how to lock down the server itself.