How to Enable Two-Factor Authentication (2FA) in Plesk
Two-factor authentication (2FA) adds a six-digit code from an authenticator app, such as Google Authenticator or Microsoft Authenticator, to your Plesk password. Plesk calls this multi-factor authentication (MFA), and you turn it on under My Profile > Multi-Factor Authentication (MFA). This guide covers protecting your own Plesk login on Noiz hosting, how it interacts with the Noiz Client Area, and keeping a recovery route if you lose the device that generates your codes.
Last reviewed: 13 October 2026, against the current Plesk Obsidian release. This guide is written for Noiz hosting and is kept current against Plesk. It complements, and does not replace, the official Plesk documentation linked below.
Official Documentation Reference
Section titled “Official Documentation Reference”- Setting up Multi-Factor Authentication in Plesk: the full setup procedure.
- Multi-Factor Authentication (MFA) extension
- Plesk change log (search for “Multi-Factor Authentication 1.1.0” for the recovery changes)
Prerequisites
Section titled “Prerequisites”- A working Plesk login. See How to Log In to Plesk.
- An authenticator app that supports time-based codes, on a device with automatic time synchronisation turned on.
- If the Multi-Factor Authentication (MFA) section is missing from My Profile, ask us to check your access.
Prepare a Recovery Route
Section titled “Prepare a Recovery Route”Before enrolling, decide how you would regain access without this device. Use your authenticator’s protected backup or transfer feature, or keep an encrypted copy of the setup secret somewhere you can reach independently. Check the app’s own recovery instructions: a backup locked behind the same lost device is not useful.
Treat the QR code and setup secret like a password. Anyone holding either can generate the same codes. Do not put them in email, support tickets or an ordinary screenshot folder. Keeping the password and authenticator in one password manager is convenient, but if that password manager is compromised, both are exposed.
Turn On Two-Factor Authentication
Section titled “Turn On Two-Factor Authentication”- In Plesk, open My Profile and click the link in the Multi-Factor Authentication (MFA) section.
- Tick Enable Multi-factor Authentication.
- Scan the QR code with your authenticator app.
- Enter the six-digit code the app shows.
- Leave Remember Device off unless this is your own computer (see below).
- Click OK.
Test Before You Sign Out
Section titled “Test Before You Sign Out”- Keep your current Plesk session open.
- Open the Plesk login page in a separate private browser window.
- Enter your username, password and a fresh code from the app, and confirm you reach your account.
- Do not choose to remember this test browser.
If the test fails, stay signed in in the first window, open My Profile again and repeat the setup. If that does not work, contact us before you sign out.
This protects the Plesk login only. It does not add MFA to your website administrator accounts, mailboxes or other services.
Protect Your Client Area Login Too
Section titled “Protect Your Client Area Login Too”The Plesk code prompt appears when you sign in at the Plesk login page. Logging in to Plesk from the Noiz Client Area uses single sign-on, which skips the Plesk prompt: anyone who can sign in to your Client Area account can open Plesk without a code. Turn on two-factor authentication for your Client Area account as well, so that both routes into Plesk need a second factor. How to Log In to Plesk describes both routes.
Use Remember Device Deliberately
Section titled “Use Remember Device Deliberately”A remembered browser skips the code prompt for the number of days you choose. Leave this off on shared or public computers, and leave Preselect the “Remember Device” checkbox off so that trusting a browser remains a deliberate choice. Clearing browser data or reaching the end of the period ends the remembered state, so it is not a recovery method.
Sign in only through the Noiz Client Area or the Plesk login page you normally use. An authenticator code can still be stolen through a fake login page; MFA does not make an unfamiliar sign-in link trustworthy.
Replace a Device or Recover Access
Section titled “Replace a Device or Recover Access”You can still generate codes: use the authenticator’s supported transfer process and test the replacement before retiring the old device. If the old device was lost or may be compromised, copying its existing secret is not enough. Reset MFA for your login so that Plesk registers a new secret instead, from My Profile where your account allows it, or ask us to reset it. Plesk issues a new secret each time MFA is turned on again, so replace any backup copy and remove old entries from your app after testing.
You have no usable code source: restore the authenticator from the backup or encrypted copy you kept when you set it up (see Prepare a Recovery Route). If you have no backup, contact our support team and tell us which Plesk login is affected. We can switch MFA off for your login without affecting anyone else’s. Set it up again promptly after recovery, and change your Plesk password too if the lost device could expose it.
Troubleshooting
Section titled “Troubleshooting”Symptom: fresh codes are rejected. Check that you are using the correct account entry in the app, turn on automatic time on the device and wait for a new code. Old entries stop working after MFA is set up again. If the problem persists, report the exact error and when it started.
Need a Hand?
Section titled “Need a Hand?”If you are locked out or would like a hand, contact our support team. Never send us the code, QR image, setup secret or password.
[noiz] | disrupt the signal