{"id":2430,"date":"2026-09-14T12:30:00","date_gmt":"2026-09-14T12:30:00","guid":{"rendered":"https:\/\/narhost.com\/blog\/?p=2430"},"modified":"2026-09-12T17:27:00","modified_gmt":"2026-09-12T17:27:00","slug":"2fa-neden-gerekli","status":"publish","type":"post","link":"https:\/\/narhost.com\/blog\/2fa-neden-gerekli\/","title":{"rendered":"\u0130ki Fakt\u00f6rl\u00fc Do\u011frulama (2FA) Neden \u00d6nemli"},"content":{"rendered":"<div id=\"ai-ozet\" class=\"ai-box\">\n<p class=\"ai-box-title\">K\u0131saca \u00f6zet<\/p>\n<ul>\n<li>2FA neden gerekli sorusunun k\u0131sa cevab\u0131: yaln\u0131zca \u015fifreyle korunan bir hesapta parola ele ge\u00e7irilirse giri\u015f an\u0131nda ger\u00e7ekle\u015fir, ikinci bir do\u011frulama ad\u0131m\u0131 bu tek noktadan \u00e7\u00f6kmeyi \u00f6nler.<\/li>\n<li>En az iki farkl\u0131 do\u011frulama unsuru (\u015fifre + telefon, \u015fifre + uygulama kodu) bir arada kullan\u0131ld\u0131\u011f\u0131nda sald\u0131rgan\u0131n yaln\u0131zca parolay\u0131 bilmesi yetmez.<\/li>\n<li>cPanel ve Narhost m\u00fc\u015fteri paneli iki ad\u0131ml\u0131 do\u011frulamay\u0131 destekler; \u00f6zellik panelde haz\u0131r bulunur, kurulum tek seferliktir.<\/li>\n<li>E-posta, FTP ve veritaban\u0131 gibi y\u00f6netici eri\u015fimi olan her hesapta 2FA \u00f6ncelik s\u0131ras\u0131nda en \u00fcstte olmal\u0131d\u0131r.<\/li>\n<li>2FA a\u00e7\u0131k bir hesap da tamamen risksiz de\u011fildir; oturum \u00e7erezi \u00e7al\u0131nmas\u0131 ya da cihaz kayb\u0131 gibi ayr\u0131 senaryolar i\u00e7in ek \u00f6nlem gerekir.<\/li>\n<li>Kurulum genelde be\u015f dakikadan k\u0131sa s\u00fcrer ve tek ba\u015f\u0131na parola h\u0131rs\u0131zl\u0131\u011f\u0131yla hesap ele ge\u00e7irilme riskini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde azalt\u0131r.<\/li>\n<\/ul>\n<\/div>\n<p>Bir m\u00fc\u015fteri temsilcisi hesab\u0131n\u0131z\u0131n \u015fifresini de\u011fi\u015ftirmenizi istedi\u011finde ya da bilmedi\u011finiz bir cihazdan giri\u015f bildirimi geldi\u011finde i\u015f i\u015ften ge\u00e7mi\u015f olabilir. 2FA neden gerekli sorusunun cevab\u0131 tam da bu andad\u0131r: parola tek ba\u015f\u0131na ele ge\u00e7irildi\u011finde giri\u015fi durduracak ikinci bir engel yoksa hesap saniyeler i\u00e7inde ba\u015fkas\u0131n\u0131n eline ge\u00e7er. Bu yaz\u0131da iki ad\u0131ml\u0131 do\u011frulaman\u0131n nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, hangi y\u00f6ntemlerin i\u015fe yarad\u0131\u011f\u0131n\u0131 ve panelinizde nas\u0131l a\u00e7aca\u011f\u0131n\u0131z\u0131 anlat\u0131yoruz.<\/p>\n<h2>\u015eifre Yeterli De\u011filken 2FA Neden Gerekli Olur<\/h2>\n<p>Tek katmanl\u0131 korumada g\u00fcvenlik tamamen parolan\u0131n gizlili\u011fine ba\u011fl\u0131d\u0131r. Parola ba\u015fka bir sitede s\u0131zd\u0131r\u0131lm\u0131\u015fsa, kaydedildi\u011fi taray\u0131c\u0131dan \u00e7al\u0131nm\u0131\u015fsa ya da kaba kuvvet denemesiyle bulunmu\u015fsa sald\u0131rgan do\u011frudan i\u00e7eri girer. 2FA neden gerekli sorusunun teknik cevab\u0131 budur: sisteme ikinci, farkl\u0131 t\u00fcrde bir kan\u0131t eklendi\u011finde parolan\u0131n tek ba\u015f\u0131na yeterli olmad\u0131\u011f\u0131 bir mimari kurulur.<\/p>\n<div class=\"highlight-box\">\n<p class=\"label\">Bilgi<\/p>\n<p>\u0130ki fakt\u00f6rl\u00fc do\u011frulama \u00fc\u00e7 kan\u0131t t\u00fcr\u00fcnden en az ikisini birle\u015ftirir: bildi\u011finiz bir \u015fey (\u015fifre), sahip oldu\u011funuz bir \u015fey (telefon, donan\u0131m anahtar\u0131) ve bazen oldu\u011funuz bir \u015fey (parmak izi). Hosting panellerinde yayg\u0131n uygulama \u015fifre art\u0131 telefon tabanl\u0131 bir koddur.<\/p>\n<\/div>\n<h2>\u0130ki Fakt\u00f6rl\u00fc Do\u011frulama Nas\u0131l \u00c7al\u0131\u015f\u0131r<\/h2>\n<p>Giri\u015f ekran\u0131na do\u011fru kullan\u0131c\u0131 ad\u0131 ve \u015fifre girildikten sonra sistem ikinci bir kan\u0131t ister: kimlik do\u011frulama uygulamas\u0131nda \u00fcretilen k\u0131sa \u00f6m\u00fcrl\u00fc bir kod ya da kay\u0131tl\u0131 bir cihaza gelen tek kullan\u0131ml\u0131k \u015fifre. Kod do\u011fru girilmeden oturum a\u00e7\u0131lmaz; sald\u0131rgan parolay\u0131 bilse bile bu ikinci ad\u0131mda tak\u0131l\u0131r.<\/p>\n<figure class=\"nh-sema\"><img loading=\"lazy\" src=\"https:\/\/narhost.com\/destek\/wp-content\/uploads\/2026\/09\/2fa-neden-gerekli-sema-narhost.webp\" alt=\"2fa neden gerekli sorusunun cevab\u0131n\u0131 g\u00f6steren do\u011frulama ak\u0131\u015f \u015femas\u0131\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>\u015eifre giri\u015finden sonra istenen ikinci kan\u0131t, hesab\u0131 tek ba\u015f\u0131na parola \u00e7al\u0131nmas\u0131na kar\u015f\u0131 korur.<\/figcaption><\/figure>\n<h2>Hangi Do\u011frulama Y\u00f6ntemleri Kullan\u0131labilir<\/h2>\n<p>Y\u00f6ntemler g\u00fcvenlik seviyesi ve kullan\u0131m kolayl\u0131\u011f\u0131na g\u00f6re farkl\u0131la\u015f\u0131r. Kimlik do\u011frulama (authenticator) uygulamas\u0131 yayg\u0131n ve \u00fccretsiz bir tercihtir; kodu telefon \u00e7evrimd\u0131\u015f\u0131yken bile \u00fcretir. SMS kodu daha kolay kurulur ama operat\u00f6r taraf\u0131nda ele ge\u00e7irilme (SIM takas) riskine a\u00e7\u0131kt\u0131r. Donan\u0131m anahtar\u0131 en y\u00fcksek g\u00fcvenli\u011fi sunar, kurulumu biraz daha teknik bilgi ister.<\/p>\n<table>\n<thead>\n<tr>\n<th>Y\u00f6ntem<\/th>\n<th>G\u00fcvenlik seviyesi<\/th>\n<th>Kurulum<\/th>\n<th>Kime uygun<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Kimlik do\u011frulama uygulamas\u0131<\/td>\n<td>Y\u00fcksek<\/td>\n<td>Tek seferlik QR okutma<\/td>\n<td>\u00c7o\u011fu y\u00f6netici hesab\u0131<\/td>\n<\/tr>\n<tr>\n<td>SMS kodu<\/td>\n<td>Orta<\/td>\n<td>Telefon numaras\u0131 kayd\u0131<\/td>\n<td>Teknik bilgisi s\u0131n\u0131rl\u0131 kullan\u0131c\u0131<\/td>\n<\/tr>\n<tr>\n<td>Donan\u0131m anahtar\u0131<\/td>\n<td>En y\u00fcksek<\/td>\n<td>Fiziksel anahtar temini<\/td>\n<td>Y\u00fcksek riskli kurumsal hesap<\/td>\n<\/tr>\n<tr>\n<td>E-posta kodu<\/td>\n<td>D\u00fc\u015f\u00fck-orta<\/td>\n<td>Yok, mevcut e-postay\u0131 kullan\u0131r<\/td>\n<td>Yedek do\u011frulama kanal\u0131<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Uluslararas\u0131 kimlik do\u011frulama standartlar\u0131n\u0131 belirleyen <a href=\"https:\/\/pages.nist.gov\/800-63-3\/sp800-63b.html\" title=\"NIST SP 800-63B \u2014 dijital kimlik do\u011frulama standard\u0131\" target=\"_blank\" rel=\"noopener\">NIST SP 800-63B rehberi<\/a> \u00e7ok fakt\u00f6rl\u00fc do\u011frulamay\u0131 tek fakt\u00f6rl\u00fc parola korumas\u0131na kar\u015f\u0131 \u00f6nerilen y\u00f6ntem olarak tan\u0131mlar. <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Multifactor_Authentication_Cheat_Sheet.html\" title=\"OWASP Multifactor Authentication Cheat Sheet \u2014 uygulama \u00f6nerileri\" target=\"_blank\" rel=\"noopener\">OWASP&#8217;\u0131n \u00e7ok fakt\u00f6rl\u00fc do\u011frulama rehberi<\/a> ise SMS tabanl\u0131 do\u011frulaman\u0131n uygulama tabanl\u0131 y\u00f6nteme g\u00f6re daha zay\u0131f kald\u0131\u011f\u0131n\u0131 belirtir.<\/p>\n<h2>cPanel ve M\u00fc\u015fteri Panelinde 2FA<\/h2>\n<p>Narhost&#8217;un sundu\u011fu cPanel iki ad\u0131ml\u0131 do\u011frulamay\u0131 panel i\u00e7inden destekler; \u00f6zellik g\u00fcvenlik ayarlar\u0131 b\u00f6l\u00fcm\u00fcnden a\u00e7\u0131l\u0131r ve bir kimlik do\u011frulama uygulamas\u0131yla e\u015fle\u015ftirilir. Ayn\u0131 se\u00e7enek m\u00fc\u015fteri panelinde de bulunur. Kurulum tek seferliktir; sonraki her giri\u015fte panel ikinci kodu ister.<\/p>\n<div class=\"senaryo-block\">\n<p class=\"label\">\u00d6rnek senaryo<\/p>\n<p>Bir ajans, on farkl\u0131 m\u00fc\u015fteri sitesini tek bir cPanel hesab\u0131ndan y\u00f6netiyordu. Ekipteki bir ki\u015finin \u015fifresi ba\u015fka bir platformdaki s\u0131z\u0131nt\u0131da ele ge\u00e7ti. Ayn\u0131 \u015fifre panelde de kullan\u0131ld\u0131\u011f\u0131 i\u00e7in giri\u015f denemesi yap\u0131ld\u0131 ama 2FA a\u00e7\u0131k oldu\u011fundan sald\u0131rgan ikinci ad\u0131mda durduruldu; ajans olay\u0131 yaln\u0131zca panel giri\u015f kayd\u0131ndan fark etti.<\/p>\n<\/div>\n<h2>2FA A\u00e7\u0131kken H\u00e2l\u00e2 S\u00fcrebilecek Riskler<\/h2>\n<p>\u0130ki ad\u0131ml\u0131 do\u011frulama parola h\u0131rs\u0131zl\u0131\u011f\u0131na kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir bariyerdir ama tek ba\u015f\u0131na her senaryoyu kapatmaz. \u00c7al\u0131\u015fan bir oturum \u00e7erezi ele ge\u00e7irilirse do\u011frulama ad\u0131m\u0131 ikinci kez sorulmaz; kay\u0131tl\u0131 cihaz kaybolur ya da \u00e7al\u0131n\u0131rsa yedek kodlar g\u00fcvenli saklanmad\u0131\u011f\u0131 s\u00fcrece risk s\u00fcrer. Bu y\u00fczden 2FA tek ba\u015f\u0131na bir \u00e7\u00f6z\u00fcm de\u011fil, katmanl\u0131 g\u00fcvenli\u011fin bir par\u00e7as\u0131 olarak kurulmal\u0131d\u0131r.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Dikkat<\/p>\n<p>Yedek kodlar\u0131 ekran g\u00f6r\u00fcnt\u00fcs\u00fc olarak ayn\u0131 hesaba ba\u011fl\u0131 bir e-postada tutmak, 2FA&#8217;n\u0131n sa\u011flad\u0131\u011f\u0131 korumay\u0131 b\u00fcy\u00fck \u00f6l\u00e7\u00fcde etkisizle\u015ftirir. Kodlar ayr\u0131 ve fiziksel olarak eri\u015filebilir bir yerde saklanmal\u0131d\u0131r.<\/p>\n<\/div>\n<h2>Kurumsal Hesaplarda \u00d6ncelik S\u0131ras\u0131<\/h2>\n<p>Bir i\u015fletmede t\u00fcm hesaplara ayn\u0131 anda 2FA kurmak zaman alabilir; \u00f6ncelik y\u00f6netici yetkisi olan hesaplara verilmelidir. Panel giri\u015fi, e-posta y\u00f6netim paneli, FTP\/SFTP eri\u015fimi ve veritaban\u0131 y\u00f6netim aray\u00fcz\u00fc bu s\u0131rada ilk d\u00f6rtt\u00fcr. Ziyaret\u00e7i hesab\u0131 ya da yaln\u0131zca okuma yetkisi olan hesaplarda aciliyet daha d\u00fc\u015f\u00fckt\u00fcr.<\/p>\n<p>\u015eifre taraf\u0131ndaki temel \u00f6nlemleri (uzunluk, tekrar kullanmama, deneme s\u0131n\u0131r\u0131) <a href=\"https:\/\/narhost.com\/blog\/brute-force-nedir\/\" title=\"Brute force nedir ve sunucunuzu nas\u0131l korursunuz \u2014 Narhost Blog\">brute force nedir<\/a> yaz\u0131m\u0131zda ayr\u0131nt\u0131l\u0131 i\u015fledik; 2FA bu \u00f6nlemlerin \u00fczerine eklenen ikinci katmand\u0131r.<\/p>\n<h2>2FA Kurulduktan Sonra Ne Yap\u0131lmal\u0131<\/h2>\n<p>Do\u011frulama a\u00e7\u0131ld\u0131ktan sonra yedek kodlar\u0131n bir kopyas\u0131 panelden indirilip ayr\u0131 bir yerde saklanmal\u0131, ikinci bir y\u00f6netici de s\u00fcrece dahil edilerek tek ki\u015fiye ba\u011fl\u0131 kilitlenme engellenmelidir. 2FA olsa da hesab\u0131n g\u00fcncel bir yede\u011fi ayr\u0131 bir g\u00fcvencedir; bu konuyu <a href=\"https:\/\/narhost.com\/blog\/hosting-yedeklemesi-neden-onemli\/\" title=\"Hosting yedeklemesi neden \u00f6nemli \u2014 Narhost Blog\">hosting yedeklemesi neden \u00f6nemli<\/a> yaz\u0131m\u0131zda ele ald\u0131k. Hesap yine de ele ge\u00e7irilirse 2FA&#8217;n\u0131n devrede olmas\u0131 m\u00fcdahaleyi kolayla\u015ft\u0131r\u0131r ama tamamen ortadan kald\u0131rmaz; <a href=\"https:\/\/narhost.com\/blog\/site-hacklenirse-ne-yapmali\/\" title=\"Web siteniz hacklenirse ne olur, ilk yap\u0131lmas\u0131 gerekenler \u2014 Narhost Blog\">site hacklenirse ne yapmal\u0131<\/a> rehberinde ilk saatteki ad\u0131mlar\u0131 anlatt\u0131k.<\/p>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>2FA neden gerekli sorusunun pratik cevab\u0131 basittir: parola tek ba\u015f\u0131na yeterli bir kilit de\u011fildir, ikinci bir do\u011frulama katman\u0131 eklemek \u00e7al\u0131nan bir \u015fifrenin do\u011frudan hesap ele ge\u00e7irmeye d\u00f6n\u00fc\u015fmesini engeller. Kurulumu k\u0131sa s\u00fcrer, korudu\u011fu risk b\u00fcy\u00fckt\u00fcr.<\/p>\n<\/div>\n<h2>Kontrol Listesi<\/h2>\n<ul class=\"kontrol-listesi\">\n<li>Panel, e-posta ve FTP hesaplar\u0131n\u0131zda 2FA&#8217;n\u0131n a\u00e7\u0131k olup olmad\u0131\u011f\u0131n\u0131 kontrol edin.<\/li>\n<li>Y\u00f6netici yetkisi olan t\u00fcm hesaplara \u00f6ncelik s\u0131ras\u0131na g\u00f6re 2FA a\u00e7\u0131n.<\/li>\n<li>Yedek kodlar\u0131 panelden indirip hesab\u0131n d\u0131\u015f\u0131nda, ayr\u0131 bir yerde saklay\u0131n.<\/li>\n<li>Kimlik do\u011frulama uygulamas\u0131n\u0131 yeni bir telefona ge\u00e7erken \u00f6nceden aktar\u0131n.<\/li>\n<li>SMS kodunu yaln\u0131zca uygulama se\u00e7ene\u011fi olmayan hesaplarda yedek y\u00f6ntem yap\u0131n.<\/li>\n<li>Ekipte en az iki ki\u015finin 2FA kurulumuna ve yedek kodlara eri\u015fimi olsun.<\/li>\n<li>\u015eifre politikan\u0131z\u0131 2FA&#8217;dan ba\u011f\u0131ms\u0131z olarak da g\u00fc\u00e7l\u00fc tutun.<\/li>\n<\/ul>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>2FA neden gerekli, tek ba\u015f\u0131na \u015fifre yeterli de\u011fil mi?<\/h3>\n<p>\u015eifre s\u0131z\u0131nt\u0131lar\u0131 ve kaba kuvvet denemeleri parolay\u0131 tek ba\u015f\u0131na g\u00fcvenilmez k\u0131lar. 2FA, parola ele ge\u00e7irilse bile ikinci bir kan\u0131t istedi\u011fi i\u00e7in giri\u015fin tek noktadan \u00e7\u00f6kmesini \u00f6nler.<\/p>\n<h3>Kimlik do\u011frulama uygulamas\u0131 ile SMS kodu aras\u0131ndaki fark nedir?<\/h3>\n<p>Uygulama kodu \u00e7evrimd\u0131\u015f\u0131 \u00fcretir ve operat\u00f6r taraf\u0131ndaki bir zafiyetten etkilenmez; SMS kodu ise telefon hatt\u0131n\u0131n ele ge\u00e7irilmesi (SIM takas) riskine kar\u015f\u0131 daha zay\u0131ft\u0131r.<\/p>\n<h3>Telefonumu kaybedersem hesab\u0131ma nas\u0131l girerim?<\/h3>\n<p>Kurulum s\u0131ras\u0131nda verilen yedek kodlar tam bu senaryo i\u00e7in ayr\u0131lm\u0131\u015ft\u0131r. Kodlar t\u00fckenirse ya da hi\u00e7 saklanmad\u0131ysa destek talebiyle kimlik do\u011frulanarak eri\u015fim yeniden sa\u011flan\u0131r.<\/p>\n<h3>2FA sitenin h\u0131z\u0131n\u0131 ya da ziyaret\u00e7i deneyimini etkiler mi?<\/h3>\n<p>Hay\u0131r; 2FA yaln\u0131zca y\u00f6netim paneline giri\u015f s\u0131ras\u0131nda devreye girer, sitenin ziyaret\u00e7ilere sunulma h\u0131z\u0131yla ilgisi yoktur.<\/p>\n<h3>T\u00fcm ekip \u00fcyeleri i\u00e7in 2FA zorunlu tutulmal\u0131 m\u0131?<\/h3>\n<p>Y\u00f6netici yetkisi olan her hesap i\u00e7in evet; salt okunur ya da s\u0131n\u0131rl\u0131 yetkili hesaplarda \u00f6ncelik daha d\u00fc\u015f\u00fck olsa da uzun vadede t\u00fcm hesaplara yay\u0131lmas\u0131 \u00f6nerilir.<\/p>\n<\/div>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost&#8217;ta<\/p>\n<p>Web Hosting paketlerinde hem cPanel hem m\u00fc\u015fteri panelinde iki ad\u0131ml\u0131 do\u011frulamay\u0131 a\u00e7arak y\u00f6netici hesab\u0131n\u0131z\u0131 ek bir katmanla koruyabilirsiniz.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/web-hosting\" title=\"Narhost web hosting paketleri\">Web Hosting paketlerini incele<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>2FA neden gerekli sorusunun cevab\u0131 basittir: parola tek ba\u015f\u0131na yeterli bir kilit de\u011fildir. \u0130kinci bir do\u011frulama katman\u0131, \u00e7al\u0131nan bir \u015fifrenin do\u011frudan hesap ele ge\u00e7irmeye d\u00f6n\u00fc\u015fmesini engeller.<\/p>\n","protected":false},"author":1,"featured_media":2431,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-2430","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/comments?post=2430"}],"version-history":[{"count":1,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2430\/revisions"}],"predecessor-version":[{"id":2432,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2430\/revisions\/2432"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media\/2431"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media?parent=2430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/categories?post=2430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/tags?post=2430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}