> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/account/security.md).

# Security & Access

Password, 2FA, SSH keys, API tokens, and active sessions.

## Password

1. Go to **Profile** in hPanel.
2. Click **Change Password**.
3. Enter your current and new password.
4. Confirm.

> **Tip:** Use a password manager and pick something long and unique.

## Two-factor authentication (2FA)

Requires both your password and a one-time code. Two methods:

* **Authenticator app** — scan a QR code with Google Authenticator or a compatible app; enter codes from the app at login.
* **Email code** — receive a one-time code by email at login.

### Enable

1. Go to **Profile** → **Security**.
2. Enable two-factor authentication and pick the method.
3. Confirm with a code, then save the **backup codes** generated during setup.

### Backup codes

One-time codes for when you lose access to your authenticator or email.

> **Warning:** Lose both your 2FA method and backup codes and account recovery requires manual intervention. Store backup codes somewhere safe (password manager, offline vault).

### New device protection

A separate toggle under **Profile** → **Security** that asks for extra verification when a sign-in looks risky (e.g., a new device). Changing it requires confirming your password.

### Disable

1. **Profile** → **Security**.
2. Disable two-factor authentication.
3. Confirm with your current 2FA code.

## SSH keys

See [FTP & SSH Access](/websites/ftp-ssh.md).

## API tokens

API tokens give programmatic access via the [Public API](https://developers.hostinger.com/).

### Create

1. Open the **API** page in hPanel ([hpanel.hostinger.com/api](https://hpanel.hostinger.com/api)).
2. Click **Generate new token**.
3. Name it.
4. Copy the token — it's shown only once.

The same page includes MCP configuration for connecting AI assistants and code editors — see [Hostinger Connector](/hostinger-connector/overview.md).

> **Warning:** Treat API tokens like passwords. Never commit them to Git.

### Revoke

Delete the token from the same **API** page. Revoked tokens stop working immediately.

## Account activity

1. Go to **Profile** → **Account activity**.
2. Review recent sign-ins and the devices used.
3. If anything looks unfamiliar, change your password — that logs you out of all devices except the current one. You can also log out of any device from the list.

## Troubleshooting

**Unfamiliar login or unexpected changes** Change your password (this logs out all other devices), enable 2FA and New device protection, and rotate any API tokens you've issued.

**Password-reset email you didn't request** Change your password immediately — someone may be probing your account.

***

*Last updated: July 22, 2026*