Two-factor authentication (2FA) adds a second layer of security to your Virtualizor account. When 2FA is enabled, logging in requires both your password and a one-time code generated by an authenticator app on your phone. This prevents unauthorised access even if someone obtains your password.

What you will need

• A smartphone with a TOTP authenticator app installed. Supported apps include:
  • Google Authenticator (iOS / Android)
  • Authy (iOS / Android / Desktop)
  • Microsoft Authenticator (iOS / Android)
• Access to the Virtualizor Enduser Panel

How to enable 2FA

1. Log in to the Virtualizor Enduser Panel.
2. Click your username or the user icon in the top-right corner of the page.
3. From the drop-down menu, select Two Factor Authentication (or navigate to Settings → Two Factor Authentication from the sidebar).
4. On the 2FA setup page, click Enable Two Factor Authentication.
5. A QR code will appear on screen.

Scan the QR code with your authenticator app

1. Open your authenticator app on your phone.
2. Tap the + (add) button or Scan a QR code.
3. Point your phone camera at the QR code displayed in Virtualizor.
4. The app will add a new entry labelled Virtualizor (or similar) and begin showing a 6-digit code that refreshes every 30 seconds.

Confirm the setup

1. In the Virtualizor 2FA setup page, enter the current 6-digit code shown in your authenticator app into the verification field.
2. Click Verify or Enable. Virtualizor will confirm that the code is correct and activate 2FA on your account.
3. If backup codes are provided, copy and store them in a secure location. Backup codes can be used to access your account if you lose your phone.

How to log in after enabling 2FA

1. Go to the Virtualizor login page.
2. Enter your username and password as usual, then click Login.
3. A second step will appear asking for your authentication code.
4. Open your authenticator app, find the Virtualizor entry, and type the current 6-digit code.
5. Click Verify. You will be logged in.

What to do if you are locked out

• If you have backup codes, enter one on the 2FA prompt screen to bypass the authenticator requirement for that login.
• If you have lost access to both your authenticator app and your backup codes, contact TPC Hosting support. Be prepared to verify your identity before the 2FA requirement can be removed from your account.

Troubleshooting

• The code is rejected even though it looks correct: TOTP codes are time-sensitive. Make sure your phone's clock is set to automatic time synchronisation. A clock that is more than 30 seconds out of sync will produce invalid codes.
• QR code does not scan: try entering the secret key manually. Most authenticator apps have a Enter key manually option. The secret key is displayed below or alongside the QR code in Virtualizor.