# Admin Account Security Best Practices?

**URL:** <https://meta.discourse.org/t/admin-account-security-best-practices/181339>\
**Category:** Product Support\
**Created:** [February 27, 2021, 8:34pm UTC](https://meta.discourse.org/t/admin-account-security-best-practices/181339 "2021-02-27T20:34:56Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
**Post date:** [March 1, 2021, 7:58am UTC](https://meta.discourse.org/t/admin-account-security-best-practices/181339/4 "2021-03-01T07:58:03Z")

</div>

> [@JimPas](#):
>
> If anyone was going to try to log in as you, they would have to know the email address you used when you set up your account.

That’s not correct, you can log in by username.

2FA will stop anyone that steals your password from reuse but DIDN’T get malware into your computer.

Even in the worst case, you still have SSH access to the server and can restore your access from there.

---

_[View the full topic](https://meta.discourse.org/t/admin-account-security-best-practices/181339)._