In this article · 10 sections
- What is 2FA?
- Accounts to protect first
- Strong, unique passwords
- Access control for staff and agencies
- Protecting your website admin
- Spotting phishing
- Save recovery codes
- A 30-minute security session
- Frequently Asked Questions
- Is SMS 2FA safe enough?
- What if I lose my phone?
- Can my agency still manage accounts with 2FA on?
- What should I do if an account is hacked?
- Secure your business online
A business can lose its Facebook page, Google Business Profile, domain or website in minutes if one password is stolen. Attackers use phishing messages ("Your page will be disabled — verify here"), leaked passwords from other websites, or simple guessing. Once inside, they can change recovery details, run ads on your card, or redirect your domain.
The single most effective protection is two-factor authentication (2FA), combined with good password habits and sensible access control.
What is 2FA?
2FA requires a second proof of identity in addition to your password — usually a code from an app, a security key, or a prompt on your phone. Even if someone steals your password, they can't log in without the second factor.
| Method | Security | Notes |
|---|---|---|
| SMS code | Better than nothing | Vulnerable to SIM swap and phishing |
| Authenticator app (Google Authenticator, Microsoft Authenticator, etc.) | Good | Works offline; back up recovery codes |
| Phone prompt (e.g., Google prompt) | Good | Convenient; check details before approving |
| Passkeys / security keys | Strongest | Resistant to phishing |
Accounts to protect first
- Email — the master key. Whoever controls your email can reset everything else.
- Domain registrar — losing the domain means losing website and email.
- Hosting control panel.
- Google account — Business Profile, Ads, Analytics, Search Console.
- Meta Business account — Facebook and Instagram pages and ads.
- Payment gateway and bank dashboards.
- Website admin panel and CRM.
- WhatsApp — enable two-step verification PIN.
Strong, unique passwords
- Never reuse passwords across accounts — one breach exposes all.
- Use long passphrases or randomly generated passwords.
- Use a password manager (for example Bitwarden, 1Password or the built-in managers in Google and Apple devices) to store and share credentials securely within your team.
- Change default passwords on new systems immediately.
Access control for staff and agencies
- Give each person their own login rather than sharing one password.
- Use the lowest permission level needed — an ad manager doesn't need ownership of your page.
- Keep at least two trusted owners/admins on critical accounts so you're never locked out.
- Remove access immediately when someone leaves.
- Review who has access every few months.
See who should own your accounts.
Protecting your website admin
- Use strong, unique admin passwords and change any default ones.
- Add 2FA to the admin login where possible.
- Limit login attempts and add rate limiting.
- Consider restricting admin access by IP or adding an extra password layer.
- Never keep passwords in plain text inside website files that are publicly accessible.
- Keep software updated. See PHP security basics.
Spotting phishing
- Messages claiming your page will be deleted unless you "verify" via a link.
- Emails about domain expiry from unknown senders.
- Login pages with slightly misspelled domains.
- Requests to approve a login you didn't start.
When in doubt, open the official website or app directly rather than clicking links.
Save recovery codes
When enabling 2FA, platforms give backup codes. Store them securely (password manager or printed in a safe place). Without them, losing your phone can lock you out.
A 30-minute security session
Sit with your team for half an hour: turn on 2FA for email, domain, hosting, Google and Meta; save recovery codes; remove ex-employees and old agencies from every account; and move shared passwords into a password manager. This one session prevents most of the account takeovers we see small businesses suffer.
Frequently Asked Questions
Is SMS 2FA safe enough?
It's much better than no 2FA, but authenticator apps or passkeys are stronger.
What if I lose my phone?
Use your saved recovery codes or a second registered device. Set these up before you need them.
Can my agency still manage accounts with 2FA on?
Yes — add them as users with their own 2FA rather than sharing your login.
What should I do if an account is hacked?
Use the platform's official recovery process immediately, secure your email first, and change passwords elsewhere. See website hacked recovery.
Secure your business online
Joboo Web helps businesses lock down websites and accounts. See cybersecurity tips or contact us.