Two-Factor Authentication (2FA) adds a second step after your password when you sign in to SiteSkite. Even if someone learns your password, they still need a one-time code from your email or authenticator app.
Because SiteSkite is the door in front of every linked WordPress site (including one-click wp-admin), locking your portal login protects the whole portfolio—not just one dashboard.
Where to find it
Log in to the SiteSkite Portal.
Open your Profile area in the sidebar (account / profile settings).
Click Two-Factor Auth.
The page URL is /2fa-settings.
Authentication methods
Under Authentication method, choose one option:
None — password only. Two-factor is off.
Authenticator App (recommended) — scan a QR code with Google Authenticator, Authy, 1Password, or similar. At sign-in you enter a 6-digit code from the app.
Email — SiteSkite emails a 4-digit PIN code to the address on your account. At sign-in you enter that PIN. You can resend the code from the login screen if needed.
Important for Email 2FA: if mail to your account address bounces or you lose access to that inbox, you may not be able to sign in. Prefer Authenticator when you can.
What happens at login
Enter your email and password as usual (or use a passkey — see below).
-
If 2FA is on, SiteSkite asks for the second factor:
Authenticator — “Enter the 6-digit code from your authenticator app”
Email — “Enter the 4-digit code we sent to your email”
After a valid code, you are signed in to the portal.
Passkeys (optional extra)
On the same Two-Factor Auth page you can add Passkeys and security keys. Passkeys let you sign in with device biometrics or a hardware key (“Sign in with passkey” on the login screen). They work alongside—or as an alternative to—password + 2FA for faster, safer access on trusted devices.
Account activity
The same page shows Account activity: recent sign-ins and security changes (IP, location when available). Use it to spot unfamiliar logins.
Why enable it
Stops most stolen-password takeovers of your SiteSkite account
Protects one-click access to client WordPress admin
Authenticator is offline-friendly; email PIN is simple when you always have inbox access
Passkeys reduce friction on machines you already trust