MFA for admin panels: why SMS is a weak second factor
A site is more often opened with someone else's password than with a rare bug. An SMS code creates a feeling of protection that is easy to walk around.
The CMS panel, the store admin, hosting and mail are keys to the same business. They end up in a shared sheet, get forwarded in a messenger and stay with someone who no longer works there. A second factor breaks that only if it is not weaker than the first.
Why an SMS code loses
SMS is intercepted through SIM swap and through the same social engineering that steals the password. An authenticator app or a hardware key raises the price of an attack more. For a director's mailbox and for hosting the difference is practical: the code arrives in the mailbox that is being taken over.
A minimal set
- A second factor on mail, hosting, the CMS, ad accounts and the domain registrar.
- Separate roles instead of one admin account for everyone.
- Revoke access on the day a person leaves, including tokens and keys.
- A short habit of looking at odd logins, not only "the site opens".
If there are many panels and nobody remembers the full list, start with an access inventory, not with yet another product. Lexora does a short review of the admin panels and says what to harden first. That is calmer than a defacement review the next day.
Related Lexora services
Not sure who else can still sign in?
We will collect the access list and suggest hardening in priority order.