Skip to content
NoizNoizNoiz < Knowledgebase

How to Enable Two-Factor Authentication (2FA) in DirectAdmin

DirectAdmin’s two-factor authentication feature is called Two-Step Authentication: once it is on, signing in to the panel directly asks for a code from an authenticator app after your username and password. Set it up separately for each DirectAdmin login you use.

It protects the DirectAdmin login only. It does not add two-factor authentication to email, FTP, SSH or your website’s own login. If you reach the panel through a hosting provider’s client area single sign-on, the panel’s own two-step prompt is not shown, so enable two-factor authentication on that client-area account as well.

Last reviewed: 13 October 2026, against the current DirectAdmin release and its Evolution interface. This guide is kept current against DirectAdmin. It complements, and does not replace, the official DirectAdmin documentation linked below.

Official Documentation Reference

Section titled “Official Documentation Reference”

Prerequisites

Section titled “Prerequisites”
  • Your DirectAdmin username and password, and the direct panel address for your account. See How to Log In to DirectAdmin.
  • A time-based authenticator app on your phone or another device, with automatic date and time switched on.
  • A safe place, away from that device, to keep scratch codes (one-time backup codes).
  • If you or a developer run scripts or apps that sign in to DirectAdmin automatically, a note of which ones use your account password.

Keep your current panel session open until a fresh login with the code has succeeded.

Set Up Two-Step Authentication

Section titled “Set Up Two-Step Authentication”
  1. Log in to DirectAdmin and open the Two-Step Authentication page by typing Two-Step into the panel’s search box. If it does not appear, ask your server administrator or hosting provider to check access.
  2. Enter a recognisable Description. It is the label your authenticator app shows, which helps if you have several DirectAdmin logins.
  3. Click Generate Secret and scan the QR code with your authenticator app.
  4. Enter the code the app shows and click Test Code. Resolve any rejection before you continue.
  5. Enable two-step authentication. If you want an alert when someone fails the code, turn on the failed-login notification as well. Click Save. Generating a secret on its own does not switch on the login check.
  6. Click Add Codes to generate scratch codes, choose an expiry date, and store the codes securely, printed or in a password manager. Make a note to replace them before they expire.

Treat the QR code and the secret behind it as a password: anyone who has them can generate your codes. Do not put them in support tickets or shared screenshots.

Test a Fresh Login

Section titled “Test a Fresh Login”
  1. Open a private browser window and go to your DirectAdmin address directly.
  2. Sign in with your username and password. Confirm that DirectAdmin then asks for a code, and that the authenticator code is accepted.
  3. To test recovery, sign out and sign in again in a new private window, this time entering one scratch code in the same code field. Each scratch code works once and DirectAdmin removes it from the list afterwards, so cross it off your saved copy.

If either test fails, keep your original session open and fix the problem before relying on two-step authentication.

Scripts and API Access

Section titled “Scripts and API Access”

The Two-Step Authentication page also has an option to allow API logins with your normal account password. That option governs scripts and apps that sign in with the password. It does not apply to Login Keys or Session Keys, which are always allowed, so the browser code prompt does not protect every way into the account. See DirectAdmin’s note on API access.

For automation, give each script its own Login Key instead of your password:

  1. Open the Login Keys page by typing Login Keys into the panel’s search box. If it is not available, ask your server administrator or hosting provider for the supported approach.
  2. Create a key limited to the commands the script needs, the addresses it connects from where practical, and a sensible expiry date. Empty restriction fields allow everything, so fill them in.
  3. Do not allow the ALL_USER, CMD_LOGIN_KEYS or CMD_API_LOGIN_KEYS commands on a script’s key, because they let the key change other keys. See DirectAdmin’s guidance on creating a Login Key.
  4. Test the script with the key before you turn off password-based API access.

Trusted Browsers and Recovery

Section titled “Trusted Browsers and Recovery”

If the panel offers to trust a browser, only accept on a device you control. Trust is stored as a cookie, skips the code prompt, and lasts for a period set on the server. Remove trust for retired devices on the Two-Step Authentication page.

If your authenticator is unavailable, sign in with an unused, unexpired scratch code. A browser you already trusted may also still let you in. After losing a device, set up two-step authentication again with a new secret, generate new scratch codes, remove the old device’s trust, and test the replacement.

If no recovery route works, contact your server administrator or hosting provider. Expect them to confirm that you own the account before they reset two-step authentication.

Troubleshooting

Section titled “Troubleshooting”
  • App codes are rejected: check that you are reading the right account entry in the app and that the device’s date and time are set automatically, then try a fresh code. If Test Code reports a time difference, ask your server administrator or hosting provider to check the server’s clock.
  • A scratch code fails: check whether it has already been used or has expired. Do not work through the whole list.
  • No code is requested: check that the setting was saved, then test a password login in a new private window rather than an existing session.
  • Access stops after repeated failures: stop retrying. Wrong codes count as failed logins and can get your IP address blocked; it does not mean the panel is down. Ask your server administrator or hosting provider to clear the block.
Section titled “Related Guides”

Need a Hand?

Section titled “Need a Hand?”

If you are locked out of a panel someone else runs, contact your server administrator or hosting provider. Noiz supports customers who run their own DirectAdmin servers: if you need a hand with two-step authentication on yours, contact Noiz support with the account username, the time and the exact error message. Never send a password, an app code, a scratch code or the authenticator secret.

[noiz] | disrupt the signal