How to find your WordPress login page (wp-admin)

Your WordPress admin login page is your site's address with /wp-admin at the end, for example www.yourdomain.co.uk/wp-admin. You can also go straight to /wp-login.php. Log in with your WordPress username and password, and you're in the dashboard.

What is wp-admin?

wp-admin is the admin area of your WordPress site, the back end where you create posts and pages, add plugins and manage users. If you aren't logged in yet, WordPress asks for your username and password before it lets you in. When you log in, WordPress stores a cookie in your browser. That way it remembers you for a while and doesn't ask you to log in on every visit. If you're new to the admin area, our beginner's guide helps you find your way around the WordPress dashboard.

What is the login URL for my WordPress site?

Your WordPress login URL is your domain name followed by /wp-admin, and a few other addresses work as well:

• /wp-admin opens the admin area, after the login page if you're not logged in yet.
• /wp-login.php opens the login page itself, where you also find the "Lost your password?" link.
• /login and /admin usually work as shortcuts, as long as your permalink setting isn't Plain. WordPress sends /login to the login page and /admin to the admin area.

If you installed WordPress in a subfolder, the path goes after the folder name, as in www.yourdomain.co.uk/blog/wp-admin. On a subdomain, it goes after the subdomain's address, as in blog.yourdomain.co.uk/wp-admin. Once you've found the address that works, bookmark it so you don't have to look for it next time.

How do I log in to my WordPress dashboard?

You log in to your WordPress dashboard on your site's login page, in three steps. These steps work when you know your WordPress username and password, the details you chose when you installed WordPress.

1. Go to your site's login page by adding wp-admin after your domain name.
2. Log in to WordPress with the username and password you created.
3. You land on the Dashboard, the main screen of the admin area.

If your site is a 1-click WordPress installation with us and you see our login page instead of the WordPress one, Advanced Login Protection is on. Log in there with your control panel's email address and password.

If your site runs on our Hosting for WordPress, you can also open the admin area from your control panel instead of the login page.

Why does wp-admin redirect me or show a 404?

A 404 on wp-admin can mean WordPress sits in a subfolder or a security plugin has moved the login page. If your site is with us and wp-admin sends you to our login page instead of the WordPress one, Advanced Login Protection is switched on for your site.

Advanced Login Protection is a security setting, not an error. Log in on our page with the email address and password of your control panel, not your WordPress details. It's on by default for every new 1-click WordPress installation. It keeps hackers from exploiting your WordPress login page, so we recommend leaving it on. If you'd still rather log in with your WordPress details, you can switch Advanced Login Protection off for that site in your control panel.

In a subfolder install, /wp-admin may only work after the folder name, not straight after the domain.

If a security plugin such as WPS Hide Login has moved the login page, /wp-admin and /wp-login.php stop working. Use the address you set in the plugin instead. If nobody wrote it down, open your site's files with an SFTP or FTP program or your hosting provider's file manager. Then go to the plugins folder inside the wp-content folder. Remove the plugin's folder there, log in at /wp-login.php again, then reinstall the plugin. According to WPS Hide Login's own page, switching the plugin off returns your site to exactly how it was before.

With our Hosting for WordPress, you get one login for your domain, email and site, and a free SSL certificate on every plan.

What if the login page says it is blocked?

Check your browser first. WordPress uses cookies to log you in, so your browser has to accept them. If it blocks cookies, or an old cookie gets in the way, the login page can turn you away even with the right password. Clear your browser's cache and cookies, then try again.

If that doesn't help, look at the server side next. If the page still says your login is blocked, a short rule in your site's .htaccess file can fix it. That file is a small settings file the web server reads for your site. If your site is with us, you can unblock your WordPress login page in File Manager.

I forgot my WordPress password: how do I get back in?

Use the "Lost your password?" link on the login page. Enter your username or the email address on your WordPress account, and WordPress sends a reset link to that address.

1. Go to your WordPress login page.
2. Select the Lost your password? link.
3. Enter the username or the email address of your account.
4. Select Get New Password. WordPress sends you a password reset email within a few minutes.
5. Open the link at the bottom of the email.
6. Enter a new password, select Reset Password and log in with it.

If the email doesn't arrive, look in your spam folder. If you can't get into that email account at all, there's another route for sites with us. You can change your WordPress password in the database from your control panel.

With Advanced Login Protection on, it's your control panel password you reset, not your WordPress one. The forgotten password page of our control panel login emails you a one-time link to change it.

Should I change my WordPress login URL for security?

It's rarely worth it on its own. WordPress's own security guidance says hiding the login URL can reduce the noise from automated login attempts, but it shouldn't be your only defence. Your login is better protected by these measures:

• A strong, unique password for every admin account, ideally kept in a password manager.
• Two-factor authentication (2FA) for every administrator account, which asks for a second check, such as a code from an app on your phone, so a stolen password isn't enough. WordPress doesn't include it, so you usually add it with a plugin.
• Limited login attempts, set by your host or a security plugin, so bots can't keep guessing.
• Advanced Login Protection on our hosting, which puts our login page, with your control panel details, in front of the WordPress one.

Our advice: keep the standard login URL and use the measures above. A renamed login page is one more address to remember. If it gets lost, you have to work on the server to get back in.

For a second lock on the admin area, you can also password protect your WordPress site with a server password. The login is only one part of WordPress security, and the rest of your site needs protecting too.

Advanced Login Protection guards your login without a renamed login page, and it's on from your first login when you put your next WordPress site on our Hosting for WordPress with a 1-click installation.