Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

Security

What is two-factor authentication?

Two-factor authentication adds a second proof of identity to a password. How SMS, authenticator apps, passkeys and security keys compare, and what to offer.

Two-factor authentication, 2FA, requires a second proof of identity in addition to a password, such as a code from an authenticator app, a passkey or a hardware security key. A stolen password alone is then not enough to sign in. Phishing-resistant methods such as passkeys and security keys are strongest, and SMS codes are the weakest option.

Published · Last updated

By Michal Měřínský. Audit methodology.

What 2FA is

Authentication factors fall into three groups: something you know, such as a password, something you have, such as a phone or security key, and something you are, such as a fingerprint. Two-factor authentication combines two different groups. The term multi-factor authentication, MFA, covers two or more.

The methods compared

  • SMS codes: better than nothing, but vulnerable to SIM swapping and interception, and easy to phish.
  • Authenticator app codes, TOTP: codes generated on the device, not sent over the network. Much better than SMS, but a fake login page can still trick someone into typing the code.
  • Push approvals: convenient, but vulnerable to approval fatigue when attackers trigger many prompts. Number matching reduces this.
  • Passkeys: cryptographic credentials tied to the real site's domain, unlocked by fingerprint, face or device PIN. A phishing site cannot use them, because the domain does not match.
  • Hardware security keys: the same phishing resistance in a physical device. Common for administrators and high-risk accounts.

For your own accounts

Turn on 2FA for email, domain registrar, hosting, code repository, payment and database accounts first. Those are the accounts that can take your whole site down. Use passkeys or an authenticator app, and store recovery codes somewhere safe and separate.

For your users

  • Offer authenticator apps and passkeys, and treat SMS as a fallback.
  • Require 2FA for admin and staff accounts.
  • Rate limit code entry, so codes cannot be guessed.
  • Make recovery secure. A weak account recovery flow undoes the protection of a strong second factor.
  • Let password managers fill passwords, and publish /.well-known/change-password so they can help users change them. Most authentication services, including Supabase Auth, Firebase, Auth0 and Clerk, provide MFA and passkeys you can switch on rather than build.

2FA does not protect a session that is already stolen. Short sessions, secure cookies and re-authentication for sensitive actions still matter.

What a scan can and cannot tell you

WebAuditOS checks the public side of your login surface: admin interfaces linked from public pages, password-form autocomplete hints, password fields on pages without HTTPS, and whether a change-password URL is discoverable.

It cannot log in, so it cannot tell whether you offer or require 2FA, how recovery works, or whether codes are rate limited.

The highest-value 2FA is on your own accounts at the registrar, host and repository. No scan of your website can check those.

Short answers

Is SMS 2FA safe? It is much better than a password alone, but the weakest form of 2FA.

What is the most secure 2FA? Passkeys or hardware security keys, which resist phishing.

Is 2FA the same as MFA? 2FA is MFA with exactly two factors.

Should my app require 2FA? For admins, yes. For users, offer it and encourage it.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

Security

What is rate limiting, and how do you add it to your app?

Rate limiting caps how many requests a client can make in a period. Why login, signup and AI endpoints need it, the common algorithms, and where to enforce it.

Security

How do you secure a website?

The security basics every website needs, in order: HTTPS, updates, authentication, secrets, headers, backups and monitoring.