Skip to content
OrbixPanel OrbixPanel Tutorials

Users, passwords & 2FA

Your OrbixPanel login controls your websites, files, email, and databases. If someone gets into it, they get all of that. The good news: two simple habits — a strong password and two-factor authentication — stop almost every attack.

Logging in needs something you know (password) plus something you have (a code from your phone) Password something you know + 6-digit code something you have (your phone) You're in a stolen password alone isn't enough

Why two factors

A password alone can be guessed, reused, phished, or leaked in someone else’s data breach. Two-factor authentication (2FA) adds a second step: a 6-digit code from an app on your phone that changes every 30 seconds. Even if an attacker has your password, they can’t log in without your phone. It’s the single highest-impact thing you can do.

Turn on 2FA (do this now)

  1. Install an authenticator app on your phone — Google Authenticator, Authy, 1Password, Microsoft Authenticator, any of them.
  2. In OrbixPanel, open your account/security settings and enable 2FA — scan the QR code with the app.
  3. Enter the 6-digit code to confirm.
  4. Save your backup/recovery codes somewhere safe (a password manager). They let you back in if you lose your phone.

Good password habits

  • Long and unique. A passphrase of a few random words beats a short “complex” password. Never reuse it on another site.
  • Use a password manager (Bitwarden, 1Password, the one in your browser) so every account has its own strong password you don’t have to remember.
  • Never share it over email or chat, and change it if you ever suspect it leaked.

For the server itself (admins)

  • Prefer SSH keys over password login, and disable password SSH once keys work (SSH keys).
  • Require 2FA for every admin account on the panel.
  • Remove logins for people who no longer need access; give each person only the access they need.

If you think an account is compromised: change the password, check for unfamiliar logins/sessions, rotate any API keys or secrets it could reach, and turn on 2FA if it wasn’t already.

Next: Glossary → · see also Security