Check the current login identity and accurate device time. Protect the setup key and confirm how the hosting provider verifies identity if the authenticator is lost.

1. Open Administration > Authentication in SiteWorx.
2. Choose Generate to display the setup key or QR code. Scan it with the approved authenticator application.
3. Enter the current authentication code in the displayed field and save. Keep the QR code and secret out of shared screenshots.
4. Test a fresh panel login using the password and generated code. Confirm the authenticator entry is clearly labelled for this service.
5. When replacing a device, migrate or reconfigure through a controlled process and test the new setup before losing access to the old recovery route.

The panel should require the additional code for the configured identity. Other staff should use their own authorised accounts and authenticator enrolments.

If a code fails, check clock synchronisation and the selected authenticator entry before repeated attempts. If access is lost, use the provider’s verified recovery process. Do not send the secret key or a live code to someone claiming to need it for routine support.

Two-factor authentication is most useful when you also have a dependable recovery process. Confirm that your account's contact details are current and follow the recovery options actually offered by the panel. Do not assume another product's recovery-code process exists in your SiteWorx installation.

During setup, scan the code privately and complete the verification step using your authenticator. Avoid including the setup QR code or secret in screenshots. Someone who obtains that secret may be able to generate the same one-time codes.

How should I move to a new phone?

Keep access to the old authenticator until you have confirmed the new one works. Follow your authenticator's protected transfer process or the panel's supported disable-and-re-enrol process while you still have authorised access. Test a fresh sign-in before retiring the old device.

If you lose access, contact our support team using your established account recovery route. We need to verify account authority before helping with an authentication reset. Do not repeatedly submit guessed codes or send passwords, current one-time codes or a photograph of your authenticator secret in a ticket. Provide the affected account and a clear description of the access problem instead.

This enrolment protects the SiteWorx authentication workflow. FTP, SSH and application logins have their own authentication controls and must be secured separately.

• Delegating SiteWorx access to a secondary user
• Deactivating a SiteWorx user while preserving the account
• Protecting a SiteWorx preview directory with a browser password
• Using SiteWorx advanced .htaccess controls carefully

• InterWorx: How To Enable Two Factor Authentication Siteworx