hosting.com 2FA: how to set up an authenticator app for the Hosting Panel
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your hosting.com account lives in the Hosting Panel at my.hosting.com, with your products, billing and support tickets. It also opens cPanel, WHM or Plesk through Login to Control Panel without another password (hosting.com). Former A2 Hosting customers are in the right place: that brand and World Host Group now operate as hosting.com (hosting.com).
Two-factor authentication (2FA) on the Hosting Panel is optional and works with an authenticator app only. There are no text-message codes, so a text claiming to carry one isn't from hosting.com (hosting.com, hosting.com). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the hosting.com steps come from hosting.com's own knowledge base, including the screenshots in its articles, linked below, which we read on October 20, 2026. We haven't tested them on a hosting.com account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Check your account email first
After a lost phone, the lighter 2FA Removal request only works if you still receive mail at the account's address. Everyone else needs full account recovery (hosting.com). The most common lockout, says the knowledge base, is an account email on a domain hosted with hosting.com that has gone offline (hosting.com).
If yours depends on your own hosting, add an outside address in Profile and choose Set as default for it before turning on 2FA (hosting.com).
Turn on 2FA with an authenticator app
The profile article gives these steps (hosting.com):
- Log in to the Hosting Panel at my.hosting.com.
- Click your initials in the top-right corner, then Profile.
- In the left sidebar, click Security.
- In the Two-factor authentication section, click the slider.
- A dialog named Enable two-factor authentication shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
- Type the six-digit code from Novaz into the dialog. In the article's screenshot, the button is Enable.
From then on, every Hosting Panel login asks for a six-digit code from your app as well as your username and password.
Neither the article nor its screenshot shows a text key. The dialog has a link for mobile devices, but the article doesn't say what it opens. If the Hosting Panel is open on the iPhone that has Novaz, take a screenshot of the QR code, then in Novaz tap + and Choose a photo. See scanning a QR code on the same iPhone.
What this 2FA protects
It guards the Hosting Panel sign-in. cPanel has its own separate 2FA (hosting.com), as do WHM, SSH and Professional Email. Since the Hosting Panel opens your control panel with no second password, its 2FA matters most.
The pages we read don't mention remembering a device, so expect a code at each login.
No backup codes
None of the hosting.com pages we read mention backup or recovery codes. If your iPhone is lost and you have no Novaz backup (iCloud backup or a backup file) to restore, the recovery request below is your way back in. Keep a current photo ID handy.
If hosting.com rejects your code
The knowledge base has no advice on rejected authenticator codes. The codes are time-based, so check the iPhone's clock first: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones or turning 2FA off
The help doesn't describe turning 2FA off yourself or moving it to a new phone. It lists a replaced phone as a reason for a 2FA Removal request (hosting.com). Before you wipe the old iPhone, check Profile > Security for a way to switch 2FA off and set it up again. The docs don't confirm one.
On the Novaz side, iCloud backup or a backup file lets you restore your accounts on the new iPhone, so the codes keep working without a removal request. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Go to my.hosting.com/recovery and pick the request type carefully, because "the wrong route can cost you several days" (hosting.com):
- 2FA Removal if you can't make codes but still get email at the account's address.
- Lost Access to Hosting Account if that inbox is out of reach too. These requests are reviewed by the Trust and Safety team.
Both need an identity check (hosting.com). You answer a few questions, give an alternative email address you can reach, and verify yourself through Persona, a third-party service, with:
- a government-issued photo ID, and
- a selfie.
Stay in the Persona flow until its completed screen appears, or the request stalls. Instead of photo ID, the company can take a utility bill matching the account's address or a bank statement showing its last payment, but that route is slower.
Expect a first reply within 1 to 3 business days, often sooner, but slower at weekends. Replies go to the alternative address.
A successful request switches 2FA off rather than resetting it. Turn it back on in Security and scan the new QR code with Novaz. More help in Lost the phone with your authenticator app?
