Account Security

Your SitePack account gives access to everything on your website, so it is worth an extra layer of protection beyond your password. The Security page is where you manage that second step at sign-in and keep an eye on the devices that are allowed to stay signed in.

You reach it from My account → Security in the top-right of your Admin Portal.

Two-factor authentication

Two-factor authentication (often shortened to 2FA) means that signing in takes two things: something you know (your password) and something you have (a code). Even if someone learns your password, they still cannot get in without that second step.

Every SitePack account already has two-factor authentication switched on. You do not need to turn it on; you only choose how you receive the second step.

Verification by email (the default)

By default, when you sign in on a device SitePack does not recognise, you receive a 6-digit code by email. You type that code on the sign-in screen to finish logging in.

• The code is sent to the email address on your account.
• Each code is valid for a short time. If it expires before you use it, or it does not arrive, you can ask for a new one after a short wait.
• You never have to set anything up for this; it works out of the box.

This is a great option if you simply want a little extra safety without installing anything.

Verification by authenticator app

For stronger protection, you can switch to an authenticator app. This is a free app on your phone (such as Google Authenticator, Microsoft Authenticator, or 1Password) that generates a fresh 6-digit code every 30 seconds, without needing an internet connection or waiting for an email.

Setting up an authenticator app

1. Go to My account → Security.
2. In the Two-factor authentication panel, click Set up authenticator app.
3. A QR code appears. Open your authenticator app on your phone and use its "add account" or "scan" option to scan the QR code.
   • Can't scan it? Type the key shown under the QR code into your app by hand instead.
4. Your app now shows a 6-digit code for SitePack. Type that code in the confirmation field and click Confirm.
5. SitePack then shows you a set of backup codes. Save these somewhere safe (see below) and click I saved my backup codes.

From now on, when SitePack asks for a second step, you read the current code from your authenticator app instead of waiting for an email.

Scan on the phone that has your app

Keep the phone with your authenticator app handy whenever you sign in. The code changes every 30 seconds, so you always read the one showing at that moment.

Your backup codes

Backup codes are one-time codes that let you sign in when you do not have your phone, for example if it is lost, broken, or out of battery.

• They are shown only once, right after you set up the app (or regenerate them). Write them down or store them in a password manager straight away.
• Each code works once. After you use one, it is spent.
• You can see how many unused codes you have left on the Security page at any time.

Keep your backup codes safe and private

Anyone with a backup code and your password could sign in as you. Store them somewhere only you can reach, and never share them.

Regenerating backup codes

If you run low on codes, or you think your list may have been seen by someone else, you can create a fresh set:

1. Go to My account → Security.
2. Click Regenerate backup codes.
3. Confirm it is you by entering a current code (from your authenticator app, or one of your remaining backup codes).
4. A brand-new set of codes is shown. Save them. Your old codes stop working immediately.

Turning off the authenticator app

If you prefer to go back to receiving codes by email:

1. Go to My account → Security.
2. Click Disable authenticator app.
3. Confirm it is you by entering a current code (from your authenticator app, or one of your remaining backup codes).

Your account then returns to email verification. You can set up an authenticator app again later whenever you like.

note

Some accounts are required to use an authenticator app for security reasons. If that applies to you, the Disable authenticator app option is not shown, and you will be guided to set the app up.

Trusted devices

Being asked for a code every single time you sign in would quickly get tiring. So once you have verified yourself on a device, SitePack trusts that device for a while and does not ask again on it for your next sign-ins.

• Trust is tied to the browser on that device, not to your internet connection. Switching between Wi-Fi and mobile data, or working from a different location, does not make SitePack ask again.
• A device you keep using stays trusted for a while, up to about a week before it asks you to verify again.
• Whenever a new device is verified for the first time, SitePack emails you so you always know about a new sign-in.

Managing your trusted devices

The Trusted devices panel on the Security page lists the devices that are currently trusted, with the last time and place each was seen. The device you are using now is marked clearly.

• To stop trusting a single device (for example an old laptop or a shared computer), click Revoke next to it. The next time anyone signs in on that device, they will have to verify again.
• To clear every device except the one you are on, click Sign out other devices. This is the quickest way to lock things down if you are unsure about a device you no longer have.

Revoke a device you no longer use

Signing in on a friend's computer, a hotel machine, or a device you are selling? Revoke it afterwards so it can never skip the verification step again.

Frequently asked questions

Do I have to set up an authenticator app?

No. Every account already has two-factor authentication by email switched on, which needs no setup. An authenticator app is an optional upgrade for people who want stronger protection or do not want to wait for emails.

I did not receive my email code. What now?

First check your spam or junk folder. On the sign-in screen you can request a new code after a short wait. If codes keep not arriving, make sure the email address on your account is correct and able to receive mail.

I lost my phone with the authenticator app. How do I get in?

Use one of your backup codes on the sign-in screen instead of a code from the app. Once you are back in, go to My account → Security to set up the app again on your new phone and regenerate a fresh set of backup codes.

I ran out of backup codes.

As long as you can still sign in (with your app or a trusted device), go to My account → Security and click Regenerate backup codes to create a new set.

Why am I suddenly being asked for a code again on my own computer?

A trusted device is only remembered for a limited time, up to about a week, and then asks you to verify again. You may also see this if the device was revoked, or if you cleared your browser's cookies.

Someone might have used my computer. What should I do?

Go to My account → Security and click Sign out other devices to drop every trusted device except the one you are on. If you use an authenticator app, you can also regenerate your backup codes for extra peace of mind.