finally putting proper 2fa on the admin panel of my site, which i should have done ages ago. the thing that stopped me this whole time is the fear of locking myself out of my own backend at a bad moment, phone lost or the app reset and now i cannot get in to fix anything.
for people who run their own panel, how do you set up 2fa so its actually secure but you have a sane way back in if your main factor dies. what do you enroll, what do you keep as backup, and where do you keep that backup so its not just sitting next to the thing it unlocks. not asking which app is best, asking how you avoid the self lockout.
the rule that keeps you out of trouble is never have a single factor you can lose. enroll at least two independent second factors, print the backup codes on actual paper, and store them somewhere physical and separate from the device. then the part everyone skips, actually test the recovery path once before you rely on it, do a dry run of losing your phone so you know the way back in works.
the backup codes on paper stored away from the device is the obvious thing i was somehow not doing, i had them in a note on the same phone that holds the authenticator, which is useless the moment i lose the phone. printing them and doing a dry run this week.
Hardware key as the primary, with an authenticator app enrolled as the fallback, and never SMS, a sim swap walks straight past SMS 2fa. Enroll two hardware keys, not one, and keep the second off site. One key on your keyring, one in a drawer somewhere else, backup codes on paper. Lose any single thing and you are still in. That is the whole trick, redundancy, not one perfect factor.