On the panel
panel.penguhost.com → click your name (top right) → Account → Two-Factor Authentication → Enable. Scan the QR code with an authenticator app (Aegis, Google Authenticator, Authy, 1Password, Bitwarden), enter the code, save the recovery codes somewhere safe. They are the only way back in without the phone.
From then on the panel asks for a code after your password. SFTP is unaffected (it uses the password only).
On the website
Logging in to penguhost.com sends a code to your e-mail when we see a new browser or device. Keep your mailbox itself protected with 2FA, because it is the master key to every account you own.
Lost the phone
Use a recovery code. None left? Open a ticket from the e-mail address of the account; we verify it is you and reset 2FA on the panel account.