Two-factor sign-in: an authenticator code after every sign-in

Why an account that publishes sites needs a second factor

A website builder account isn't just your own data. It holds what visitors typed into your contact and booking forms, and it can change or take down a site other people rely on. Passwords get reused and phished, and an email inbox that receives magic links can be taken over. Website builder two factor authentication means a stolen password or inbox alone isn't enough: whoever signs in also needs the code that only your authenticator app can make, and that code changes every 30 seconds.

Turning it on

It lives in Settings, under Security. Changing it needs a sign-in from the last ten minutes; if yours is older, Anticode asks you to sign in again and brings you straight back.

1. Press Turn on. Anticode shows a setup key, grouped in fours, with buttons to copy it or open it directly in an authenticator app.
2. Add it to the app you use, such as 1Password, Google Authenticator or Authy.
3. Type the six-digit code the app shows and press Turn on. Nothing changes until a working code proves the app has the key.
4. Save the ten recovery codes that appear. Each works once, and they're shown only this one time. You can copy them, then confirm you've saved them.

What signing in looks like afterwards

You sign in as you always do, with a password, a magic link, GitHub or Google, and then Anticode asks for a code. Type the current code from your app, or one of your recovery codes if you don't have the phone. A recovery code is used up the moment it works.

• Ten minutes, five tries. The code step expires after ten minutes, and five wrong codes end it; you start the sign-in again.
• No replays. Each code is accepted once, so a code someone watched you type can't be used a second time.
• A little clock drift is fine. The code from the step just before or after now is accepted, in case your phone's clock is slightly off.
• Sign-in itself is rate-limited. Repeated wrong passwords are slowed per account and per IP address before the second factor is ever reached.

When publishing requires it

Before a site goes live, Anticode checks a security baseline against the exact pages that would ship. One item applies only to sites that collect data: a contact, booking or newsletter form, or an app that sends what visitors enter. For those sites, the account that holds the submissions must have two-factor sign-in on, and so must whoever presses publish. In a Team workspace that's the workspace owner and, if it's someone else, the teammate publishing. The publish step names whose account is missing it and points to Settings.

A site with no forms collects nothing, so this item doesn't apply to it, and you can publish without a second factor.

Recovery codes and turning it off

New recovery codes

With the current code from your app, you can make a fresh set of ten. The old set stops working at once.

Turning it off

Needs a recent sign-in and a current code or a recovery code.

While sites are live

Two-factor sign-in stays on while you have published sites, because the baseline they were published against relies on it. Take them down first if you really want it off.

Limits

• Authenticator apps only. Codes come from a time-based authenticator app; there are no text-message codes.
• Keep the recovery codes somewhere else. They can't be shown again. If the phone and the codes are both lost, you can't finish a sign-in yourself.
• It protects your Anticode account, not visitors' accounts. Published design-engine sites have no visitor accounts. The Next.js export has its own admin area with two-factor sign-in, which you run yourself.

Questions people ask

Does two-factor sign-in work if I sign in with Google or GitHub?

Yes. It's asked for after the first step of any sign-in, including GitHub and Google, as well as passwords and magic links.

Which authenticator apps work?

Any app that makes standard six-digit time-based codes, such as 1Password, Google Authenticator or Authy.

Do I need it to publish a site?

Only if the site collects data through a form, booking or app that sends. A site without any forms can be published without it.

What if I've used most of my recovery codes?

Make a new set in Settings with a current code from your app. The remaining old codes stop working.