Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security & Access

Secure your Hostinger account with password changes, two-factor authentication, backup codes, API token management, and account activity review in hPanel.

Password, 2FA, SSH keys, API tokens, and active sessions.

Password

  1. Go to Profile in hPanel.

  2. Click Change Password.

  3. Enter your current and new password.

  4. Confirm.

Tip: Use a password manager and pick something long and unique.

Two-factor authentication (2FA)

Requires both your password and a one-time code. Two methods:

  • Authenticator app — scan a QR code with Google Authenticator or a compatible app; enter codes from the app at login.

  • Email code — receive a one-time code by email at login.

Enable

  1. Go to Profile → Security.

  2. Enable two-factor authentication and pick the method.

  3. Confirm with a code, then save the backup codes generated during setup.

Backup codes

One-time codes for when you lose access to your authenticator or email.

Warning: Lose both your 2FA method and backup codes and account recovery requires manual intervention. Store backup codes somewhere safe (password manager, offline vault).

New device protection

A separate toggle under Profile → Security that asks for extra verification when a sign-in looks risky (e.g., a new device). Changing it requires confirming your password.

Disable

  1. Profile → Security.

  2. Disable two-factor authentication.

  3. Confirm with your current 2FA code.

SSH keys

See FTP & SSH Access.

API tokens

API tokens give programmatic access via the Public API.

Create

  1. Open the API page in hPanel (hpanel.hostinger.com/api).

  2. Click Generate new token.

  3. Name it.

  4. Copy the token — it's shown only once.

The same page includes MCP configuration for connecting AI assistants and code editors — see Hostinger Connector.

Warning: Treat API tokens like passwords. Never commit them to Git.

Revoke

Delete the token from the same API page. Revoked tokens stop working immediately.

Account activity

  1. Go to Profile → Account activity.

  2. Review recent sign-ins and the devices used.

  3. If anything looks unfamiliar, change your password — that logs you out of all devices except the current one. You can also log out of any device from the list.

Troubleshooting

Unfamiliar login or unexpected changes Change your password (this logs out all other devices), enable 2FA and New device protection, and rotate any API tokens you've issued.

Password-reset email you didn't request Change your password immediately — someone may be probing your account.

Last updated: July 22, 2026

PreviousAccount Overview
NextOverview

Last updated

Was this helpful?