Turn on two-factor authentication
Settings → Security → Enable two-factor authentication. Scan the QR code with any authenticator app, then enter the six-digit code it shows.
The first time, this takes two clicks: the initial attempt asks you to confirm your password, and you then click again. That is expected.
Save your recovery codes
Once 2FA is on you are given a set of recovery codes. Each works once, and they are the only way back in if you lose your phone. Store them somewhere that is not your phone.
What we will never do
We will never ask for your password, your 2FA codes or your recovery codes — not by email, not in a comment, not in a message. Anyone who does is not us. Report them.
Sign-in alerts
Settings → Security shows when and where your account was last signed in from. If you do not recognise it, change your password and turn on 2FA.
Was this helpful?