Web Hosting Canada 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Web Hosting Canada (WHC), based in Montreal, gives many customers three logins: the Client Area for billing, domains and services, the cPanel of each hosting plan, and WHM on a cloud or dedicated server. All three accept an authenticator app for two-factor authentication (2FA), but each is set up separately (WHC). Turning it on in the Client Area doesn't protect your cPanel.
2FA with an app is optional. Without it, WHC emails you a 5-digit code in some cases, such as a sign-in from a new location (WHC). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the WHC steps come from WHC's own help pages, linked below, which we read on October 21, 2026. WHC's main 2FA article is on its older knowledge base, which shows no date, so its labels may be out of date. We haven't tested the steps on a WHC account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA in the WHC Client Area
These are the steps for the new Client Area (WHC):
- Sign in to the Client Area at clients.whc.ca.
- Click your profile icon in the top-right corner, then Your Profile.
- Scroll down to the Security section. Under Two-Factor Authentication, turn the switch on.
- Click Get Started. WHC shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Type the code from Novaz into the box on the Two-Factor Authentication page and click Verify Code.
- WHC then shows a backup code. Save it before you leave the page (more below).
In the classic Client Area, go to My Profile > Security Settings and click click here to enable under Two-Factor Authentication, then follow the same steps from Get Started. Either way, the setting doesn't carry over to sub-accounts you've created.
WHC's Client Area steps only mention scanning, and don't say whether a text key is shown. If you find one, in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
Save your backup code
WHC gives you one backup code, not a list. It lets you sign in if you can't use your app, and WHC suggests keeping it in a password manager (WHC). WHC doesn't say whether it works more than once or how to get a new one, so keep it somewhere you can reach without your phone.
Without a Novaz backup (iCloud backup or a backup file), Novaz's keys exist only on your iPhone, so this code is your way in if the phone is lost. More in 2FA backup codes.
When WHC asks for a code
Once the app is set up, WHC asks for a code every time you sign in to the Client Area, and its email codes no longer appear at sign-in. You may still get a 5-digit email code when you change your account email or password, add a user, or check out without having been verified in that session (WHC). Check which code the page wants: the app's codes refresh every 30 seconds (WHC).
cPanel and WHM
To protect a hosting plan's cPanel (WHC):
- Sign in to cPanel. In the Security section, click Two-Factor Authentication.
- Click Set Up Two Factor Authentication.
- Scan the QR code with Novaz, or type the secret code cPanel shows as the Setup key.
- Type the code from Novaz, with no spaces, in the Security Code field, then click Configure Two-Factor Authentication.
On a cloud or dedicated server, sign in to WHM as root and open Two-Factor Authentication. Enter a name under Issuer and switch 2FA on for the server. Then open the Manage My Account tab, click Set Up Two-Factor Authentication, and finish with the same QR code, Security Code and Configure Two-Factor Authentication steps.
If WHC rejects your code
WHC's pages don't cover rejected codes. Check the iPhone's clock first: go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
For the Client Area, use your backup code. Without it, WHC says you'll be locked out and must contact its support team, which will check your identity and turn 2FA off for you (WHC). WHC doesn't list the proof it asks for or how long this takes. Support normally checks callers with a Support PIN shown under Account Settings in the Client Area (WHC); WHC doesn't say whether it's used for a 2FA reset.
For WHM, WHC notes that root can switch the server's 2FA off over SSH with whmapi1 twofactorauth_disable_policy if WHM itself is out of reach. More in Lost the phone with your authenticator app?
Changing phones or turning 2FA off
WHC doesn't describe moving 2FA to a new phone, only turning it off: on the Client Area 2FA screen, in cPanel with Remove Two Factor Authentication, or on the same WHM screen. While the old phone still works, turn 2FA off, then set it up again on the new iPhone. Repeat this for the Client Area, each cPanel and WHM. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead, and all of them come across at once. See How to transfer your authenticator app to a new iPhone.
