“I’m too small to be a target” is the single most common reason people give for skipping two-factor authentication, and it’s backwards. Small, unremarkable websites aren’t ignored by attackers — they’re specifically what automated attacks are built for.
Here’s why, and here’s exactly how to turn 2FA on everywhere it matters.
Nobody Is Personally Targeting Your Blog
This is the part that gets misunderstood. Almost nobody attacking WordPress sites, cPanel accounts, or WHMCS logins is a human sitting at a keyboard specifically interested in your business. It’s automated. Bots scan enormous ranges of the internet continuously, trying common username/password combinations against every login form they find, at massive scale, with essentially zero marginal cost per attempt.
Your site isn’t targeted because it’s important. It’s targeted because it exists and has a login form. The bot doesn’t know or care whether you’re a Fortune 500 company or a local bakery’s WordPress blog — it tries the same thing against both.
This is exactly why “I’m too small to matter” is the wrong frame. Small, undefended accounts are the ideal target for automated attacks precisely because they’re undefended. A compromised small business site gets used to host phishing pages, send spam, mine cryptocurrency, or serve as a launching point for attacks on other sites — the attacker doesn’t need your business to be valuable. They need your server resources and your domain’s reputation, which every website has regardless of size.
What 2FA Actually Protects Against
Two-factor authentication means logging in requires two things: your password, and a second factor — typically a time-based code generated by an app on your phone. Even if an attacker has your password (from a data breach, a phishing attempt, or a brute-force guess), they can’t log in without also having your phone.
This single change eliminates the entire category of automated password-guessing attacks. A bot trying thousands of password combinations against your login will never succeed with 2FA enabled, because getting the password right isn’t enough anymore.
Password only vs password + 2FA
Setting Up 2FA in WordPress
WordPress doesn’t include 2FA by default, but adding it takes a few minutes with a free plugin.
- Install Two-Factor (built and maintained by the WordPress core contributor team) or Wordfence, which includes 2FA as part of its security suite
- Activate the plugin
- Go to Users → Your Profile in the WordPress admin
- Scroll to the Two-Factor Authentication section
- Choose your method — an authenticator app (Google Authenticator, Authy, or similar) is the most common and reliable option
- Scan the QR code with your authenticator app
- Enter the generated code to confirm setup
Do this for every admin-level user on your site, not just yourself. An admin account without 2FA is a weak link regardless of how secure your own login is.
Setting Up 2FA in WHMCS (Your HostDango Client Account)
- Log into your client account
- Go to your profile/security settings
- Look for Two-Factor Authentication or Security Questions
- Enable 2FA and scan the QR code with your authenticator app
- Save a set of backup codes somewhere secure — these let you back into your account if you lose access to your authenticator app
Your client account controls billing, domain management, and support access — worth protecting with the same seriousness as your website’s admin login.
Setting Up 2FA in cPanel
- Log into cPanel
- Under Security, find Two-Factor Authentication
- Click Set Up Two-Factor Authentication
- Scan the QR code with your authenticator app
- Enter the generated code to confirm
Once enabled, logging into cPanel requires both your password and a code from your app — the same protection extended to the control panel that manages your entire hosting account.
What About Losing Your Phone?
This is the practical concern that stops people from enabling 2FA, and it’s a legitimate one to plan for. Every properly implemented 2FA system gives you backup codes at setup time — a set of one-time-use codes that work exactly like your authenticator app would, in case you lose access to your phone. Save these somewhere secure and separate from your phone — a password manager, a printed copy in a safe place, anywhere except a note on the same device.
If you set up 2FA and didn’t save backup codes, or you’ve lost both your phone and your backup codes, open a support ticket — we can verify your identity and help restore access to your account through an alternate method.
The short version: Automated attacks target every website with a login form, regardless of size, because scale makes it cheap to try. 2FA takes ten minutes to set up on WordPress, WHMCS, and cPanel, and it eliminates the entire category of password-guessing attacks in one step. “It’s just my website” isn’t a reason to skip it — it’s exactly why it’s worth doing.