Your Account Has Been Hacked and You've Just Found Out
One morning you log into the ServerNet user panel and see that the SSH key for your main server has been changed. Or the DNS for a domain running on Linux hosting is pointing somewhere else. The first thought that crosses your mind is: "How did they get the password?"
The answer is almost always the same: the password leaked from somewhere, not from your server. An old website you registered with the same email, a browser extension, or an Excel file you sent to a colleague. When passwords are reused, a leak in one unrelated place opens up your ServerNet account.
Two-factor authentication (2FA) solves exactly this problem. Even if the password is leaked, the attacker doesn't have access to the one-time code on your phone. This article covers the activation method, common errors, and most importantly — what you should do if you lose access to your phone number or email.
Enabling 2FA on Your ServerNet Account
Log into the user panel. From the main menu, open "Account Settings." Find the "Security" section. Enable the "Two-Factor Authentication" option.
The system will ask you to install an authentication app. Google Authenticator, Authy, or Aegis on Android — open whichever you have and scan the displayed QR code. If your phone's scanner isn't working, click the "Show text code" option and enter the 16-digit key manually.
Example text key:
JBSWY3DPEHPK3PXPThe app displays a 6-digit code that changes every 30 seconds. Enter this code in the confirmation field. That's it. From this moment on, every login to the panel will require a fresh code in addition to your password.
Save Your Recovery Codes Right Now
After activation, ServerNet displays a list of recovery codes. These are typically 8 to 10 one-time-use codes, each of which works only once. Store them somewhere safe other than your phone — an encrypted file, or printed out in a desk drawer.
This is where people make mistakes: many take a screenshot and that same screenshot stays in their phone's gallery. If the phone is lost or broken, the recovery codes go with it. Write the codes on paper or keep them in a separate password manager.
What to Do If You Lose Your Phone or Your Number Changes
The worst-case scenario: your phone is stolen, the SIM card has been changed, and the authentication app is locked on the old device. Now how do you log into the panel?
The first option is recovery codes. If you've saved them, the login page will show a "Use recovery code" option. Enter one of the codes, and after logging in, disable 2FA and re-enable it to get fresh codes.
If you don't have the recovery codes either, you'll need to go through identity verification another way. Contact ServerNet support. They will ask you to send documents proving you own the account: typically a copy of your national ID and confirmation of the registration email. This process takes a few hours to one business day.
Here, speed matters. If your website runs on Linux hosting and generates revenue, one day without panel access means one day without control over DNS, email, and files. That's why you should take recovery codes seriously.
Set Up a Recovery Email Right Now
In the same security section, find the "Recovery Email" option. Enter a second email that isn't connected to your ServerNet account. If your primary email is hacked, this second address is your lifeline. Use a personal email, not a corporate one running on the same hosting — otherwise, if you lose the hosting, you lose both.
Common Errors and Their Real Causes
The "Invalid Code" error is the most common issue seen after activation. The cause is almost always one of these three things:
- Your phone's clock is not set correctly. Authentication apps work based on time. If your phone's clock is a few minutes ahead or behind, the generated code won't match the server's code. In your phone settings, enable "Automatic time setting."
- You entered the code too late. Each code is only valid for 30 seconds. If the code is about to expire, the system will reject it. Wait for the next code and enter it again.
- You opened the wrong app. If you have multiple accounts in the app, you might be entering a code for a different account. Check the username next to each code.
Another less common error, but one that causes more trouble: after resetting your phone, you install the app but your ServerNet account isn't in it. That's because authentication apps don't sync their data to the cloud except in specific cases (like Authy with backup enabled). If you reset your phone and didn't have a backup, only recovery codes can save you.
Which 2FA Method Should You Choose?
ServerNet supports standard authentication apps (TOTP). Another method is SMS codes, which some services offer. If you have a choice, choose TOTP. The reason is simple: SMS can be intercepted. An attacker who transfers your SIM card with a single call to the carrier and fake documents (SIM Swapping) will also get your SMS codes. An app on your phone doesn't have that weakness.
The only situation where SMS makes sense is when you don't have a smartphone or your team uses shared devices. In that case, SMS is better than nothing. But if you have an Android or iPhone, TOTP is the right choice.
What to Check After Activation
Enabling 2FA isn't the end of the process. There are three more things you should do:
- Close all active sessions. In the security section, click the "Log out of all devices" option. This will force anyone who previously logged in with your password out of the system, and they'll need a code to get back in.
- Change your password. Set a fresh, unique password for your ServerNet account. Avoid reusing passwords from other sites at all costs.
- Re-read the hosting welcome email. If you've just signed up for a service, the initial email contains information you should change right away. The guide on reading your hosting welcome email shows exactly which items you should change.
If you have multiple ServerNet services — for example, one hosting plan and one VPS — note that 2FA applies to your user account, not to each service individually. One activation covers all services under that account. If you're still undecided between hosting and a VPS, check the guide to choosing your service type.
When All Roads Are Blocked
Suppose your phone is lost, the recovery codes were on that phone, and you haven't set up a recovery email. In this case, manual identity verification through support is the only way. Prepare the following documents to speed up the process:
- A copy of your national ID or birth certificate
- The email address you registered with
- The order number or invoice from your latest purchase
- If possible, verification through the payment gateway you used for your purchase
After reviewing the documents, support will disable 2FA so you can log in again. After logging in, immediately re-enable 2FA and this time store the recovery codes somewhere safe.
Frequently Asked Questions
Does enabling 2FA affect all my services?
Yes. 2FA is enabled on your user account and covers all services under that account — hosting, VPS, domains. One activation is enough.
I entered a recovery code incorrectly. What should I do?
Each recovery code can only be used once. If you entered a code incorrectly, it hasn't been consumed and is still valid. But if you entered a code correctly and logged in, that code no longer works. Use the next code on the list.
Can I disable 2FA?
Yes. After logging in with a valid code, go to the security section and click the disable option. You'll need a one-time code again to confirm. Disabling only makes sense when you want to switch apps — in that case, disable it first, then re-enable it with the new app.
If my phone number changes, will 2FA stop working?
No. Because 2FA works through an app on your phone rather than SMS, changing your number has no effect on it. Only if you've changed your phone and haven't transferred the app will you need your recovery codes.