Secure your Plesk login: password reset and two-factor authentication

Whoever can log in to your Plesk account controls your websites, email and databases. A strong password plus two-factor authentication (2FA) blocks almost all account takeovers. This guide is for Plesk customers; administrators should also see Security Advisor hardening.

Before you start

• An authenticator app on your phone: Google Authenticator, Microsoft Authenticator, Authy or a password manager with TOTP codes.
• Your current Plesk login, or access to the contact email for a reset.

Change your password

1. Log in to Plesk.
2. Click your name in the top-right corner and choose My Profile (or Account → Change Password).
3. Enter a new password of at least 14 characters; use the Generate button for a random one.
4. Click OK.

This changes the Plesk login password. The subscription's FTP/SSH system user and mailbox passwords are separate.

Reset a forgotten password

1. On the Plesk login page, click Forgot your password?
2. Enter your user name or contact email.
3. Open the email from Plesk and follow the link to set a new password. The link expires after a short time.

If no email arrives, your provider or reseller can set a new password for you after verifying your identity.

Enable two-factor authentication

1. Your administrator must have installed the Google Authenticator (or a similar 2FA) extension.
2. Click your name and open My Profile → Two-Factor Authentication (or find the 2FA extension in your dashboard).
3. Click Enable. A QR code appears.
4. Scan it with your authenticator app.
5. Enter the 6-digit code to confirm.
6. Save the backup codes if offered.

From now on, Plesk asks for a code after your password. Codes change every 30 seconds.

Other good habits

• Use a unique password not used on any other site.
• Do not share your login – ask your provider for an additional user with a limited role for developers; see users and roles.
• Log out on shared computers.
• Keep the contact email current so password resets reach you.

Lost your phone?

• Use a backup code if you saved one.
• Otherwise, contact your provider: an administrator can disable 2FA for your account after verifying your identity. For MdmHost, open a ticket from your client account.
• After regaining access, enable 2FA again with your new phone.

Troubleshooting

• Code always wrong: the phone's clock is off; enable automatic time.
• 2FA option missing: the extension is not installed on the server.
• Locked out after failed logins: Fail2Ban may have banned your IP; wait or ask support. See Fail2Ban.

Next steps

• SSH keys in Plesk.
• Password-protect directories.
• Enable HTTPS.