Turn on two-step login for your GuavaHost account
Two-step login adds a six-digit code from your phone to every GuavaHost sign-in, so a leaked password on its own is no longer enough to open your panel, your files or your backups.
6 min read · Updated Oct 21, 2026 · By GuavaHost Team
Account security beats server security
Most people spend their security effort inside the game: whitelists, claim plugins, anti-cheat. All of that is worth doing, but it guards the wrong door. Every one of those protections lives in files and settings that your GuavaHost account can change. Someone signed in as you can empty the Files tab, delete every backup, change your startup settings or reinstall the server, and no in-game rule can stop them, because they are not playing the game at all.
That is why two-step login is the highest-value thing you can switch on today. It takes about two minutes, and it turns a stolen password from a disaster into an annoyance.
Two-step login is also called two-factor authentication, or 2FA. The two factors are something you know (your password) and something you hold (your phone). An attacker needs both.
Know which login you are protecting
People get tangled here, so it is worth being precise. You have up to three separate logins, and they do different jobs.
| Login | What it opens | Two-step login? |
|---|---|---|
| Your GuavaHost account | customer.guavahost.com, checkout, and the classic panel at panel.guavahost.com | Yes, this is the one in this guide |
| Your game account (Mojang, Microsoft, Steam, Epic) | your copy of the game | Set up with that company, not with us |
| Your SFTP password | file transfer apps connecting to that one server | No codes, it is a password only |
Your GuavaHost account and the classic game panel are the same sign-in, which is covered in Using the classic game panel. So the code you add protects both at once. Your SFTP password is set per server on the Settings tab and is separate on purpose, as explained in Uploading files with SFTP. Give it its own strong value and do not reuse your account password there.
Pick an authenticator app first
An authenticator app generates a new six-digit code every 30 seconds from a secret stored on your device. It works offline and nothing is sent by SMS, which is what makes it better than a text message.
Any standard app works, because they all use the same open standard (TOTP, time-based one-time password). Common choices are Google Authenticator, Microsoft Authenticator, Authy, Aegis on Android and 2FAS or Raivo on iOS. If you already use a password manager such as Bitwarden or 1Password, it probably has an authenticator built in, which is convenient but does mean one compromised vault holds both factors. Many people prefer a separate app for that reason.
Pick one that can be backed up or exported. People lose access far more often by changing phones than by being attacked.
Switch it on
The steps live in your control panel and are written out in Protecting your panel account with a strong password:
- Sign in at customer.guavahost.com and open Account settings.
- In the Two-factor authentication card, click Set up authenticator.
- Scan the QR code with your app. If the camera will not cooperate, use Can't scan it? Enter a setup key and type the key in by hand.
- Enter the six-digit code your app shows and click Enable authenticator.
- Save the recovery code it gives you. Do not skip this step.
If the code is rejected on the first try, the usual cause is a phone clock that has drifted. Turn on automatic date and time on the device, wait for a fresh code and try again.
Treat the recovery code like a spare key
The recovery code is how you get back in when your phone is lost, wiped, stolen or sitting in a drawer with a dead battery. It is shown once.
Good places to keep it:
- In your password manager, saved on the GuavaHost entry.
- Written on paper somewhere you would keep a passport or a spare house key.
- In an encrypted note on a second device you control.
Bad places: a Discord message to yourself, a screenshot in your camera roll that syncs to cloud storage, or a text file on the desktop called codes.txt. Anything an attacker who already has your password could read is not a second factor.
What changes next time you sign in
After that, the sign-in page asks for the code after your password. The same applies if you use Google, Discord or GitHub to sign in: those buttons ask for your GuavaHost code too, so connecting a provider does not quietly bypass the second step. Details of how those work are in Sign in with Google, Discord or GitHub.
Worth knowing: the providers you connect are their own doors into your account. If your Discord account has no two-step login of its own, then your GuavaHost security is only as good as your Discord security. Turn it on there as well, and review Connected accounts in Account settings so nothing you do not recognise is linked.
Finish the job around it
Two-step login closes the password hole. Three small habits close the rest:
- Secure the email on your account. Reset links arrive there, so an attacker with your inbox can often work around everything else. Give it a strong unique password and its own two-step login.
- Do not share the account. Hand access to helpers as sub-users instead, which is covered in Giving a friend access with sub-users and in Give staff the least access they need. A sub-user protects their own login with their own code.
- Keep a backup you did not make yesterday. The Backups page is your undo button for everything security cannot prevent. See Backups.
If you ever suspect someone else has been in your account, change the password first (that ends every other session), then work through What to do if your server was griefed or hacked. Our team is online 24/7 in Discord if you want a second pair of eyes.
Common questions
Does two-step login slow down every sign-in?
Only slightly, and only when you actually sign in. Your browser stays signed in between visits as normal, so in practice most people type a code a handful of times a month rather than every day.
What if I lose my phone and the recovery code?
Change your account password first so the password alone cannot be used, then contact the team through guavahost.com/support or Discord and explain the situation. Expect to answer some questions that prove the account is yours, because the whole point of the second factor is that it is not easy to talk your way past.
Do my sub-users get protected by my two-step login?
No. Each sub-user signs in with their own GuavaHost account, so they each turn two-step login on for themselves. Ask anyone you trust with files or backups to do it, since their account is a way into your server too.
Is SMS two-factor good enough instead of an app?
An authenticator app is the better choice. Phone numbers can be moved to a new SIM by someone impersonating you, and the code arrives over a network you do not control, whereas an app generates the code on your device with no network involved at all.
Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.
- account
- two-factor
- 2fa
- login
- security
Still need help? Our team is online 24/7 to answer questions.