Yes. Agency staff should use multifactor authentication on every client dashboard that supports it: hosting, registrar, DNS, code repository and CMS. One agency account often reaches dozens of client sites, so a single stolen password can become many incidents at once.
CISA's guidance defines MFA as providing a combination of two or more authenticators before a service grants access, so that a compromised password alone is not enough.
Why agencies are a bigger target than one site
An attacker who wants access to many small sites can try one phishing email at an agency instead of many at businesses. The agency account is the shortcut. The same logic applies to a freelancer's laptop. That makes agency staff logins more valuable than any single client login.
Where to turn it on, in priority order
| Priority | Account | Why |
|---|---|---|
| 1 | Email used for password resets | Control of email is control of most accounts |
| 2 | Domain registrar and DNS | Changes redirect the site and mail |
| 3 | Web host and control panel | Direct file and database access |
| 4 | Code repository and deployment | Can push code to production |
| 5 | CMS administrator accounts | Plugin install and code edit rights |
| 6 | Password manager | Holds everything else |
Which second factor
The WordPress handbook describes the options by type: something you are, something you have and something you know. It notes that SMS codes are not a secure channel and that apps and plugins were developed to create a better one. In practice, prefer an authenticator app or a hardware key to SMS where the service allows it, and keep recovery codes somewhere safe and separate.
Make it stick
- Write MFA into the staff onboarding checklist.
- Check enrolment as part of the quarterly access review.
- Do not share a single MFA device for a shared account. Use per person accounts instead.
- Plan what happens when a phone is lost: recovery codes, a second device, and a named owner who can reset.
- Include MFA in your client contracts as something you do, and ask clients to do the same on their accounts.
A short policy you can adopt
Write one paragraph and put it in the staff handbook: every account that touches client systems must use MFA; recovery codes are stored in the password manager, not on the same phone; a lost device is reported the same day; and access is removed on departure. Short rules get followed, long ones get filed.
What MFA does not fix
It does not stop a malicious plugin, an unpatched vulnerability or a leaked token. It protects the login, not the software. Combine it with updates, least privilege roles and monitoring.
Safeguard covers agent identity and guardrails for AI tooling; the free scan covers dependencies in a repository.
Quick check
Is SMS better than no MFA?
Yes, but the WordPress handbook says SMS is not a secure channel, so prefer an authenticator app or hardware key where available.
Do clients need MFA too?
Yes, on their own accounts such as registrar and email. Ask for it in the onboarding.
Sources
Last reviewed: 19 October 2026.
