How to Find Your WordPress Login URL and Get Back Into Your Dashboard!

Trying to find your WordPress login page? For most self-hosted sites, the default URL is simply your domain followed by /wp-login.php (e.g., https://yourdomain.com/wp-login.php).

Alternatively, typing /wp-admin/ will redirect you to the same form if you aren’t logged in.

However, if you’ve reached the form but still can’t get in, the problem isn’t the URL. In that case, you have a login issue and should follow a troubleshooting checklist before attempting more complex fixes.

Once you regain access, make sure to strengthen your WordPress login security to prevent future lockouts and brute force attacks.

Try the default WordPress login URL first

For a self-hosted WordPress site installed on the main domain, use:

• Login page: https://yourdomain.com/wp-login.php
• Admin dashboard: https://yourdomain.com/wp-admin/

The login page is where you enter your username or email address and password. The dashboard is where you edit pages, install plugins, update themes, manage users, and change site settings.

These two URLs are connected, but they are not the same. /wp-login.php is the form. /wp-admin/ is the protected admin area. If you are logged out and visit /wp-admin/, WordPress normally sends you to the login page first.

We checked this on a clean WordPress install. /wp-login.php loaded directly. /wp-admin/ redirected to the login page with a return address for the dashboard. That redirect is normal. It means WordPress is asking you to sign in before showing the admin area.

🔎 Note: If you see the login form after visiting /wp-admin/, the URL is probably working. The next problem may be your password, user role, browser cookies, or a security lockout.

Use the exact place where WordPress is installed

The default path only works when you add it to the right base address. This is the most common reason the login URL looks broken.

• Use the main domain when WordPress is installed there: https://example.com/wp-login.php
• Use the folder name when WordPress is installed in a subdirectory: https://example.com/blog/wp-login.php
• Use the subdomain when WordPress is installed on one: https://blog.example.com/wp-login.php

The same rule applies to /wp-admin/. Use https://example.com/wp-admin/, https://example.com/blog/wp-admin/, or https://blog.example.com/wp-admin/ based on where WordPress lives.

If your company has more than one WordPress site, each install can have its own login URL. A blog, store, help center, or campaign site may not share the same dashboard.

Skip unreliable shortcuts until later

Some guides suggest /login/ or /admin/. These can work on some sites because of redirects, plugins, or host settings. They are not dependable default WordPress login paths. On our clean WordPress test site, /login/ and /admin/ loaded the normal public site page instead of the login form. That is why they should be treated as guesses, not the main answer.

Start with /wp-login.php and /wp-admin/. If those fail, move to the recovery steps below instead of trying random URLs for too long.

Check whether you are using the wrong WordPress account

WordPress.com, WordPress.org, and a self-hosted WordPress site can all involve “WordPress login,” but they are not the same login.

• Use your own domain for a self-hosted site. If your site is example.com, your admin login is usually on example.com, not on WordPress.com or WordPress.org.
• Use WordPress.com only for sites managed through WordPress.com. That account controls WordPress.com-hosted sites and related services.
• Use WordPress.org for community tasks. A WordPress.org account is for support forums, plugin reviews, theme reviews, translations, and contribution work. It does not unlock your private site dashboard.
• This mix-up is common when someone inherits a site. If you need to edit the site itself, look for the login tied to the site’s domain or hosting account.

Find the login URL through your web host

If the default URL does not work, your hosting account is the next best place to check.

Many hosts show a button named WP Admin, Log in to WordPress, Manage WordPress, or Admin. In cPanel or Softaculous, it often appears beside the WordPress installation.

• Open the host dashboard when someone else set up the site: the host may show the exact WordPress install location.
• Use the admin shortcut when a plugin changed the login URL: some hosts can still sign you in without showing the custom URL.
• Save the working URL after access returns: put it in your password manager with the right username or email address.

⚠️ Note: A host shortcut proves you have hosting access. It does not always mean you have a WordPress administrator account. If the dashboard opens with limited permissions, ask another admin to check your user role.

Recover a changed login URL

Changing the WordPress login URL is often sold as a security trick. We do not recommend relying on it. It can reduce low-effort bot visits to the default page, but it can also lock out real admins when the custom URL is forgotten. If you changed the URL and lost it, start with the least risky checks:

• Ask the previous admin, developer, agency, or host about the custom URL.
• Search your password manager for saved logins on the domain.
• Check launch notes, onboarding docs, emails, and host tickets for “login,” “wp-admin,” or the plugin name.
• Try the host’s WordPress admin shortcut before editing files.

If those fail and you have file access, deactivate the plugin that changed the URL. You can do this through your host file manager or through an FTP app such as FileZilla or Cyberduck. FTP means a file transfer connection for site files. If you need a rollback point before touching files, WP Remote has a guide to WordPress backup and restore.

Before renaming anything in your site files, identify the plugin name from WordPress or your setup notes when you can.

• Collect the file access details from your host: you usually need a username, password, server address, and sometimes a port number.
• Open the site files through the host file manager or FTP app: go to the folder where WordPress is installed.
• Find the plugins folder carefully: it is usually inside wp-content/plugins.
• Rename only the login-changing plugin folder: WordPress will treat that plugin as unavailable and deactivate it.
• Retry the default login URL: use /wp-login.php or /wp-admin/ on the correct WordPress install address.

Do not rename the whole wp-content folder, the whole plugins folder, your active theme folder, or WordPress core files. If you are not sure which plugin changed the URL, ask your host or developer.

🛟 Note: Do not edit database values just to find the login URL. The site_url and home_url values store site addresses, not a secret login endpoint. Changing them without a clear reason can make the site harder to access.

Fix the right login problem

Once you reach a login form, the URL may be correct. Use the symptom to choose the next step.

Do not keep trying passwords again and again. Repeated failures can trigger a lockout. Use password reset or ask another administrator to reset your account.

If a two-factor login plugin blocks you, deactivate that plugin through the host file manager or FTP only if you know the plugin folder. Two-factor authentication means a second login check after the password.

If a plugin or theme conflict blocks the admin area, start with plugins. Deactivate them one at a time only when you understand what each plugin does. Do not remove or rename the active theme unless a developer or host is guiding the fix.

If the login page redirects to an unrelated site, treat it as a security issue. A bad redirect can come from malware, which is unwanted code added to the site, or from a damaged .htaccess file, which controls some URL behavior on many servers. Back up the site before changing that file.

Know the multisite and developer cases

Most site owners do not need a special multisite URL. If you manage a WordPress multisite network, each site can still have its own dashboard path. The network admin area is usually reached from the main site at /wp-admin/network/ after login, and you still need the right account role.

For developers building login links, wp_login_url() returns the login URL and admin_url() returns an admin area URL. These are better than hard-coding a path because they respect the site’s configured WordPress address.

Do not treat a hidden login URL as full security

The default WordPress login URL is public and predictable. That is why bots often try /wp-login.php and /wp-admin/ on many sites. A custom login URL can reduce some of that noise, but it does not protect the site by itself.

Attackers can still try stolen passwords, target XML-RPC if it is enabled, find the custom URL, exploit weak plugins or themes, or attack the hosting account. If you do not use XML-RPC for remote publishing or app integrations, disabling XML-RPC removes one more potential attack surface.

XML-RPC is a WordPress feature that lets outside apps talk to the site, and on some sites it can be abused for repeated login attempts. Better login security includes:

• Use strong, unique passwords for every admin account.
• Turn on two-factor authentication for administrators.
• Limit repeated login attemptsor use rate limiting, which slows repeated requests.
• Remove unused admin accounts and keep user roles tight.
• Use a firewall or WAF, which filters harmful traffic before it reaches WordPress.
• Use a WordPress malware scanner and monitor the site for suspicious changes.
• Keep a written recovery path with the host, developer, and a trusted admin.

This is where MalCare fits. It does not help you remember the URL itself. It helps with the bigger risk around that URL: bot traffic, brute force attempts, suspicious redirects, malware scanning, cleanup, firewall protection, and monitoring. Use login URL changes only as a small extra step.

🔐 Note: If you do change the login URL, save it in a password manager, record the plugin name, and make sure one trusted admin knows how to reverse the change.

Conclusion

For most self-hosted sites, the WordPress login URL is simple: use your site address with /wp-login.php. If you want the dashboard, use /wp-admin/ and let WordPress send you to the login form when needed. If WordPress is installed in a folder or subdomain, add the login path to that exact install address.

If the default URL fails, do not keep guessing. Check your hosting account, confirm you are not using a WordPress.com or WordPress.org account by mistake, recover any changed login URL carefully, and match the fix to the symptom you see. Once you get back in, save the working URL and secure the login properly so this does not become a repeat problem.

FAQs