Confessions of a Marketing Agency #02: The Password That Didn't Exist

So this one’s a bit daft, and it’s exactly the kind of thing that catches you out when you’re not looking for it.

We’d just fixed a proper list of security warnings on our own site — Cloudflare flags them up automatically, and one said “no two-factor authentication on this account.” Fair enough, I thought, five minutes, sort it now.

Except every time I tried, it asked me for a password. And I don’t have a password for Cloudflare. Never have. I log in with Google, same as I do for half of everything these days, and just — never needed one.

So I tried my Google password. Denied. Tried again, thinking I’d mistyped it. Denied again. Started to properly worry I’d been locked out of my own account, which — after a fortnight that also included fixing a redirect rule that was hiding our own blog posts — was not a feeling I fancied having twice in one month.

Turns out the answer was simple, once it was explained properly: if you log in with Google, there often isn’t a separate password sitting underneath it at all. Cloudflare’s own security page was asking for something that had never existed on my account, because it assumes everyone’s got one. I didn’t. So no password was ever going to work — I wasn’t missing it, it genuinely wasn’t there.

The actual fix wasn’t inside Cloudflare at all. It was in Google. Two-step verification on the Google account itself does the same job, because that’s the real front door — Cloudflare’s just the room behind it. Switch that on, and you’re covered, no matter what Cloudflare’s own settings page thinks is missing.

Small thing. Five minutes once you know. But it’s a good reminder that half of “fixing security” is just understanding which system is actually doing the locking — not clicking the first button that looks like it might help. It’s the same instinct behind how we approach hosting and ongoing site support more generally: check what’s actually true before assuming a setting means what it says.

If you use Google, Microsoft, or any other “sign in with” option for a business tool, it’s worth checking today: is your actual protection sitting on that account, not the one you assumed?