DirectAdmin 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
DirectAdmin is the web hosting control panel some hosts give you for your websites, email and databases, usually at an address ending in :2222 (DirectAdmin). Your host or server administrator runs it, not DirectAdmin the company, so they decide which version you're on and whether the two-factor feature is available.
DirectAdmin calls two-factor authentication (2FA) Two-Step Authentication. Any DirectAdmin account can turn it on for itself. It uses time-based codes from an authenticator app, with one-time recovery codes as the backup. DirectAdmin's docs describe no text-message or email codes (DirectAdmin). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the DirectAdmin steps come from DirectAdmin's own documentation, release notes and Site-Helper user help, linked below, which we read on October 20, 2026. We haven't tested them on a DirectAdmin account. Hosts can customize the panel, and DirectAdmin has two skins, Evolution and Enhanced, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Where the setting is
Since version 1.686 (September 2025), it's in two places (DirectAdmin):
- Profile > Two-Step Authentication
- at user level, Advanced Features > Two-Step Authentication
Older versions put it behind the password page, under Change your Password (DirectAdmin). If it's missing, ask your host: the feature is on by default, but a server setting called twostep_auth can switch it off (DirectAdmin).
Turn on Two-Step Authentication
DirectAdmin's release notes describe the current page but not all its buttons (DirectAdmin):
- Open Two-Step Authentication.
- DirectAdmin creates a key, which it calls the secret, and shows it as a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. On the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If the page also shows the secret as text and you can't scan, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. DirectAdmin's docs don't give the secret's length, and Novaz needs at least 16 characters, so the QR code is the safer choice. See What is a 2FA setup key?
- Type the code Novaz shows. Since version 1.669, DirectAdmin won't switch Two-Step Authentication on without a correct code from your app.
- DirectAdmin then generates your recovery codes. Save them before you leave the page.
Once it's on, the page stops showing the secret, so you can't add it to another app later (DirectAdmin). In Novaz, the new entry carries the server's name, which is DirectAdmin unless your host changed it (DirectAdmin).
Older panels use the page in DirectAdmin's Site-Helper, where you generate a secret, test a code, enable it and press Save (DirectAdmin Site-Helper).
Keep your recovery codes
Older docs call them scratch codes. Each works once, typed in the same Code box as an app code (DirectAdmin). Since version 1.669 DirectAdmin creates them automatically (DirectAdmin). From version 1.670, making a new set replaces the old list (DirectAdmin).
Without that phone and without a Novaz backup (iCloud backup or a backup file), these codes are your only way in. Print them or store them in a password manager. See 2FA backup codes.
Signing in
DirectAdmin asks for the code on a second page, after your password (DirectAdmin). If you choose to trust the device, that browser skips the code for 30 days by default, though your host can change the number (DirectAdmin). Since version 1.665, one trusted device can cover several DirectAdmin accounts (DirectAdmin).
If DirectAdmin rejects your code
Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
If your phone is right, the server's clock may be off. DirectAdmin lets admins widen the range of codes it accepts when they can't fix the server time (DirectAdmin), so ask your host.
Don't keep trying codes. DirectAdmin counts each wrong one as a failed login, and too many put your IP address on the server's block list, which the server admin has to clear (DirectAdmin). More causes are in Authenticator code not working?
Changing phones
DirectAdmin's docs don't cover moving to a new phone. If you've backed up Novaz with iCloud backup or a backup file, restore your accounts on the new iPhone and DirectAdmin's codes keep working. Without a backup, the panel won't show the secret again, so you'll set Two-Step Authentication up again, while the old phone or a recovery code still gets you in. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with a recovery code, then set up Two-Step Authentication again with your new phone.
Without recovery codes, DirectAdmin's docs offer no self-service way back in. The setting and the secret are kept in your account's files on the server, out of your reach (DirectAdmin). DirectAdmin's user help says to "contact your hosting company for more assistance" (DirectAdmin Site-Helper), so ask your host to turn it off on your account. DirectAdmin doesn't say what proof hosts ask for or how long it takes. If you run the server yourself, the Securing DirectAdmin page lists the account setting and its files.
More in Lost the phone with your authenticator app?
