Secure your DirectAdmin login: password, 2FA and login keys

Your DirectAdmin login controls your websites, email and databases, so it deserves strong protection. DirectAdmin offers password management, two-step authentication (2FA) with apps like Google Authenticator or Authy, and login keys that give scripts limited access without sharing your password.

Before you start

• An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, Authy or a password manager with TOTP.
• Your current DirectAdmin password.

Change your password

1. Log in and click your user name in the top bar, then Change Password (or go to Account Manager → Password).
2. Enter the current password and a new one of at least 12 characters. Use the generator for a random password.
3. Choose whether the change applies to DirectAdmin only, or also to the main FTP and database user (options vary by version).
4. Click Save.

Enable two-step authentication

1. Go to Account Manager → Two-Step Authentication (in some versions under your user menu → Security).
2. Click Generate Secret (or Enable). A QR code appears.
3. Scan the QR code with your authenticator app.
4. Enter the 6-digit code from the app to confirm.
5. Download or write down the backup (scratch) codes and keep them safe.
6. Tick Require Two-Step Authentication and save.

From now on DirectAdmin asks for the code after your password. If you lose your phone, use a scratch code, or ask your reseller or host to disable 2FA after verifying your identity.

Review login history

Check Account Manager → Login History (or the security area) for logins from unknown IPs or countries. If you see something suspicious, change your password immediately and enable 2FA.

Create a login key

Login keys are random tokens that work like a password but can be limited to certain commands, IP addresses and an expiry date. Use them for billing systems, backup scripts or API integrations.

1. Go to Advanced Features → Login Keys.
2. Click Create Key.
3. Enter a Key Name, the key value (or generate one) and an expiry date.
4. Under Allowed commands, select only what the integration needs, for example CMD_API_SHOW_USERS.
5. Under Allowed IPs, enter the server IP of the integration.
6. Enter your password to confirm and click Create.

Delete keys you no longer use. Unlike your password, a key can be revoked without affecting anything else.

Troubleshooting

• Code rejected: the phone's clock is out of sync. Enable automatic time on the phone.
• Blocked after failed logins: DirectAdmin's Brute Force Monitor blocked your IP. Wait for the block to expire or ask your host.
• Login key does not work: the request comes from a different IP, uses a command not allowed, or the key expired.

Next steps

• How DirectAdmin's Brute Force Monitor works.
• Back up your account.
• DirectAdmin access levels.