WordPress Login URL: How to Find and Log In to Your Admin

The WordPress login URL for a self-hosted site is yoursite.com/wp-login.php. Typing yoursite.com/wp-admin/ also works: if you are not logged in, WordPress sends you to the login page. If neither loads, WordPress is in a subfolder, a security plugin changed the address, or the site is on WordPress.com, which uses wordpress.com/log-in.

This guide covers every way to reach the WordPress admin login: the default addresses and the shortcuts WordPress quietly redirects, WordPress.com versus your own site, subfolder installs, login pages moved by security plugins, localhost setups, multisite networks, and what to do when you have forgotten the password. It ends with hardening that actually stops attacks. We also checked 128 real WordPress sites on 29 October 2026 to see how many leave the login page at its default address: 56.3% do.

What is the WordPress login URL?

For a WordPress site you or your business runs, the login page is /wp-login.php added to your site address. The admin dashboard is /wp-admin/. These are the addresses that work on a standard install:

The short /login, /admin and /dashboard addresses come from a core function called wp_redirect_admin_locations() in wp-includes/canonical.php. It only runs when the address would otherwise be a 404 and the site uses pretty permalinks. So if a business has a real page at /login for its customer portal, that page wins, and you need the full /wp-login.php address.

The quickest way to save yourself the search next time: bookmark the login page once you find it, and let your password manager store the address with the password.

How do I log in to WordPress, step by step?

1. Go to the login page. Type your domain followed by /wp-login.php, for example https://example.com/wp-login.php.
2. Enter your username or email address. WordPress has accepted the account's email address in the username box since version 4.5 (the function wp_authenticate_email_password() is marked @since 4.5.0 in wp-includes/user.php).
3. Enter your password. If you are not sure of it, use "Lost your password?" before you try many guesses, because security plugins may lock you out after a few failures.
4. Decide on "Remember Me". Ticked, the login cookie lasts 14 days by default. Unticked, it ends when the browser closes, or after two days, whichever comes first. Both values are in wp_set_auth_cookie() in pluggable.php. Do not tick it on a shared computer.
5. Click "Log In". Administrators land on the dashboard. If your account has a lower role such as Subscriber, you may land on your profile page instead, which is normal.
6. If you use two-factor authentication, enter the code from your app or email on the next screen.

If the form reloads with no error, or you see "Cookies are blocked or not supported by your browser", the problem is usually cookies, caching or an address mismatch. Our guide to being locked out of WordPress admin walks through those fixes.

WordPress.com login vs your own WordPress site

WordPress.com and self-hosted WordPress use separate logins, and mixing them up is the most common reason people "cannot find" their login page. The software is the same; the account system is not.

WordPress.com's own help page gives wordpress.com/log-in as the login address and says that if your site is self-hosted you should log in through your hosting provider (WordPress.com support).

One overlap exists. A self-hosted site running Jetpack can turn on Secure Sign On, which lets people log in with their WordPress.com account. It is off by default and is switched on under Jetpack's Security settings (Jetpack). If your login page shows a "Log in with WordPress.com" button, that is why.

How can I find the login URL for my WordPress site?

If /wp-login.php and /wp-admin/ both fail, work through these checks in order. Each one is safe and changes nothing.

1. Check for a subfolder. WordPress is sometimes installed in a folder such as /wp/, /blog/ or /wordpress/. View the page source of your home page (Ctrl+U or Cmd+Option+U) and search for wp-content. The path in front of it shows where WordPress lives. If you see example.com/blog/wp-content/, your login is example.com/blog/wp-login.php.
2. Check the REST API link. In the same page source, search for api.w.org. The link next to it ends in /wp-json/; replace that with /wp-login.php.
3. Check from the command line.

   # where does /wp-admin/ send you?
   curl -sI https://example.com/wp-admin/ | grep -i -E "^HTTP|^location"
   
   # does the default login page exist?
   curl -s -o /dev/null -w "%{http_code}\n" https://example.com/wp-login.php

   A 302 from /wp-admin/ with a location: header shows the real login address. A 404 or 403 on wp-login.php usually means a security plugin or server rule moved or blocked it.
4. Check your hosting dashboard. If your host installed WordPress for you, its control panel often lists the install with its admin address and a log-in shortcut.
5. Search your email. WordPress sends "Your new WordPress site" or account emails containing the login link. Also search for emails from your former developer or agency.
6. Ask whoever built the site. If it was built by someone else and you have no access at all, our guide to taking over a WordPress site from a developer lists what to request.

If you have server access, WP-CLI tells you the exact addresses WordPress itself uses:

wp option get siteurl   # where WordPress files live (login is under this)
wp option get home      # the public address of the site
wp eval 'echo wp_login_url(), PHP_EOL;'

The last command prints the login URL after any plugin has changed it through the login_url filter, so it is the most reliable answer.

When a security plugin has changed the login URL

If /wp-login.php returns a 404 or sends you to the home page, a plugin has probably hidden it. The most widely used one, WPS Hide Login (2+ million active installations on WordPress.org), says that after you set a custom address "the wp-admin directory and wp-login.php page become inaccessible, so you should bookmark or remember the url" (plugin page). Other security plugins have similar "hide backend" features.

To recover a forgotten custom address:

1. Check your bookmarks, password manager and email for an address on your domain you do not recognise, such as /my-door/ or /staff-entry/.
2. Read it from the database. WPS Hide Login's FAQ says the address is stored in the whl_page option (in the network sitemeta table on multisite). With WP-CLI:

   wp option get whl_page

   In phpMyAdmin, search the wp_options table for option_name = 'whl_page' (your table prefix may differ from wp_).
3. Switch the plugin off. If you cannot read the database, rename the plugin's folder in wp-content/plugins/ with SFTP or the host's file manager. WordPress deactivates a plugin whose folder disappears, and /wp-login.php works again. The plugin's FAQ suggests this route too.

   mv wp-content/plugins/wps-hide-login wp-content/plugins/wps-hide-login.off

   Log in, then rename it back and reactivate it from the Plugins screen so the protection returns.

How do I log in to WordPress on localhost?

On a local development copy, the login page is the same /wp-login.php, but the start of the address depends on the tool you used. Match your setup:

How do I set up the WordPress admin on localhost?

The admin account is created during installation. If you unzipped WordPress into your local web folder, open http://localhost/wordpress/ (or your folder name) and the installer asks for a database, then for the site title, admin username, password and email. Those are the details you log in with afterwards. With WP-CLI the same thing is two commands:

wp core download --path=wordpress
cd wordpress
wp config create --dbname=wp_local --dbuser=root --dbpass=root
wp db create
wp core install --url=http://localhost/wordpress --title="Local test" \
  --admin_user=admin --admin_password='choose-a-password' --admin_email=you@example.com

A local login that redirects to the live site

If you copied a live site to your computer and the login page jumps to the real domain, the siteurl and home options still hold the live address. Fix them in the local database only:

wp option update home 'http://localhost/mysite'
wp option update siteurl 'http://localhost/mysite'
wp search-replace 'https://example.com' 'http://localhost/mysite' --skip-columns=guid --dry-run

Run the search-replace without --dry-run once the preview looks right.

Logging in to a WordPress multisite network

A multisite network is one WordPress install running several sites. Each site has its own login page at its own address, for example example.com/shop/wp-login.php on a subdirectory network or shop.example.com/wp-login.php on a subdomain network. The network-wide settings screen (plugins, themes, sites, users) is at /wp-admin/network/ on the main site, and only Super Admins can open it.

Your user account is shared across the network, but you only see a site's dashboard if you have a role on that site. If you can log in to the main site but get "Sorry, you are not allowed to access this page" on another, ask a Super Admin to add you to that site.

What if I forgot my WordPress admin password?

Use the "Lost your password?" link under the login form first. It is at /wp-login.php?action=lostpassword and emails a reset link to the account's address. If the email never arrives, the site may not be able to send mail at all, which is a separate fix.

With hosting access, you have three more ways, in order of preference:

1. WP-CLI

# list administrators to find the right username
wp user list --role=administrator --fields=ID,user_login,user_email

# set a new random password and show it, without emailing anyone
wp user reset-password admin --skip-email --show-password

Both commands are documented in the WP-CLI handbook.

2. phpMyAdmin

Open the wp_users table, edit your user, and in user_pass choose the MD5 function and type a new password. This still works on current WordPress: the core password check accepts a hash of 32 characters or fewer as MD5, and WordPress replaces it with a stronger hash the next time you log in (see wp_check_password() in pluggable.php). Since WordPress 6.8 that stronger hash is bcrypt (Make WordPress Core). Change the password again from your profile once you are in.

3. Ask your host

Most hosts can reset a WordPress password or give you a temporary admin login from their support desk if you can prove you own the account.

If the account itself is gone, or you suspect someone else changed the password, stop and read locked out of WordPress admin. An admin account you did not create can be a sign of a compromise.

How many WordPress sites leave the login page at the default address?

Most of them, even among well-known sites. On 29 October 2026 we requested /wp-login.php once on each of the 128 WordPress sites listed in the WordPress.org Showcase archive (the same sample as our robots.txt study) and recorded the response without following redirects.

So at least 72 of 128 (56.3%) show the standard login form at the standard address, and 10 more redirect to a wp-login.php address. About one in five (28 sites, 21.9%) hide or block it from our request. A 403 does not always mean the login page is protected on purpose: some firewalls block any automated request, so treat that row as an upper bound.

The useful conclusion is not that the majority is careless. These are sites run by publishers, universities and government departments, and most of them leave the login page where it is because hiding it is not where real protection comes from. The next section explains what does.

Should you change your WordPress login URL? What actually protects it

Changing the login address reduces automated noise in your logs, but it is not a security control on its own. WordPress's own hardening guide says "obscuring the login URL can reduce noise but should not be your only defense" and recommends rate limiting, two-factor authentication and passkeys instead (WordPress Advanced Administration).

Two-factor authentication

The Two-Factor plugin, maintained by WordPress contributors, supports authenticator apps (TOTP), email codes and backup codes, and passkeys or hardware keys through a companion WebAuthn plugin. Turn it on for every administrator and editor first.

Rate limiting with Nginx

WordPress's hardening guide recommends limiting login attempts at the server. A typical Nginx setup looks like this; adjust the rate and the PHP handler to your server, and test on staging first:

# in the http block
limit_req_zone $binary_remote_addr zone=logins:10m rate=10r/m;

# in the server block
location = /wp-login.php {
    limit_req zone=logins burst=20 nodelay;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

IP allowlist with Apache

If everyone who logs in works from known addresses, the same guide gives this Apache 2.4 rule. Replace the example addresses with yours:

<Files "wp-login.php">
    Require ip 203.0.113.15 203.0.113.16
</Files>

Remember that someone working from home or a phone network will be shut out, so keep a way to change the list.

For the full set of protections, see our WordPress security guide.

Login problems: symptom, cause, where to go

What the login page does NOT tell you

How we measured this

We used the WordPress.org Showcase archive (160 entries, collected 29 October 2026), kept the 128 sites whose home page showed a WordPress generator tag, the api.w.org link or /wp-content/ paths, and sent one GET request to /wp-login.php on each, without following redirects, using a user agent that names wpdeveloper.ca. "Working login form" means the response contained WordPress's username field. We did not attempt to log in or probe any other address. The sample is small and made of prominent sites, so treat the shares as indicative, not as a market figure. We will rerun it with the robots.txt study and update this page.