Quick answer: To log in to a self-hosted WordPress site, go to yoursite.com/wp-admin or yoursite.com/wp-login.php and enter your username (or email) and password. If WordPress is installed in a subfolder, add it: yoursite.com/blog/wp-admin. For WordPress.com sites, log in at wordpress.com. If you can’t log in, start with “Lost your password?”, then clear cookies, check whether a security plugin changed the login URL, and disable plugins over FTP if needed.
WordPress login URLs
| Situation | Login address |
|---|---|
| Standard install | yoursite.com/wp-admin or yoursite.com/wp-login.php |
| Installed in a subfolder | yoursite.com/folder/wp-admin |
| Installed on a subdomain | blog.yoursite.com/wp-admin |
| Local site on your computer | localhost/wordpress/wp-admin (or your local domain) — see localhost guide |
| WordPress.com site | Log in through wordpress.com |
| Security plugin changed it | The custom address set in that plugin |
Tip: bookmark your login page, or tick Remember Me on a private computer so you stay logged in longer.
How to log in (step by step)
- Type your login address into the browser.
- Enter your username or email address.
- Enter your password.
- Complete two-factor authentication if it’s enabled.
- Click Log In — you’ll land on the dashboard. New to it? Read our dashboard guide.
Can’t log in? Fixes from easiest to hardest
1. Reset your password
Click “Lost your password?” on the login page, enter your username or email and follow the link in the email. Check your spam folder. If no email arrives, your site may not be sending email correctly — try the next methods.
2. Clear cookies and cache
Login loops (you log in and get sent back to the login page) are often caused by old cookies. Clear cookies for your site, try a private window or another browser, and clear any caching plugin or server cache.
3. Check whether the login URL was changed
Some security plugins hide the login page at a custom address, so /wp-admin shows a 404. Check your notes or emails from setup. If you can’t remember it, disable the plugin (method 5) to restore the default login page.
4. Check for too many failed attempts
Security plugins and hosts may lock you out for a while after several wrong passwords. Wait for the lockout to expire, or ask your host to whitelist your IP address.
5. Disable plugins via FTP or file manager
Connect with SFTP or your host’s file manager, go to wp-content and rename the plugins folder to plugins-off. Try to log in. If it works, a plugin was the cause — rename the folder back and reactivate plugins one at a time to find it. Our plugin troubleshooting guide explains this in detail.
6. Switch to a default theme
If plugins weren’t the problem, rename your active theme’s folder inside wp-content/themes. WordPress will fall back to a default theme if one is installed.
7. Check your site URL settings
If the login page redirects to the wrong address, the WordPress Address and Site Address may be wrong. You can set them in wp-config.php with WP_HOME and WP_SITEURL, or ask your host to help.
8. Reset your password in the database
As a last resort, open phpMyAdmin from your hosting panel, find the wp_users table, edit your user, choose the MD5 function for user_pass and enter a new password. WordPress will upgrade the hash the next time you log in. Back up the database first.
Common login errors and what they mean
| Error or symptom | Likely cause | Fix |
|---|---|---|
| Incorrect password | Wrong password or caps lock | Reset password |
| Redirect loop | Cookies, cache, wrong site URL | Clear cookies; check URLs |
| 404 at /wp-admin | Custom login URL or wrong folder | Find the custom URL or disable the plugin |
| White screen after login | Plugin or theme error | See white screen fixes |
| “Cookies are blocked” | Browser settings or caching | Allow cookies; exclude login page from cache |
| No reset email arrives | Email delivery problem | Use an SMTP plugin or reset via database |
Logging in to WordPress.com vs a self-hosted site
This confuses many people. If your site was created on WordPress.com, you log in with your WordPress.com account at wordpress.com, and you manage everything there. If you installed WordPress on your own hosting, your login lives on your own domain, and a WordPress.com account won’t work there (unless you’ve connected the two with a plugin). If you’re not sure which you have, read WordPress.com vs WordPress.org.
Locked out after an update?
If you can’t log in right after updating a plugin, theme or WordPress itself, the update probably caused a fatal error. Since WordPress 5.2, a “recovery mode” email is usually sent to the admin email address with a special link that lets you log in and deactivate the broken plugin or theme. Check your inbox (and spam folder) for an email titled something like “Your Site is Experiencing a Technical Issue”. If no email arrives, use the FTP method above to disable plugins.
When to ask your host for help
Contact your host if you see server errors (500, 503), if the database won’t connect, or if you can’t access your files at all. Hosts can restore a backup, check error logs and confirm whether a firewall is blocking you — often in minutes.
Make your login more secure
- Use a long, unique password stored in a password manager.
- Turn on two-factor authentication.
- Limit failed login attempts.
- Never use “admin” as your username.
- Remove old user accounts you don’t need.
More in our WordPress security guide and the official hardening WordPress documentation.
Frequently asked questions
What is the default WordPress login URL?
yoursite.com/wp-admin or yoursite.com/wp-login.php.
Can I log in with my email instead of username?
Yes, WordPress accepts either.
Should I change my login URL?
It can reduce bot traffic, but it’s not a replacement for strong passwords and two-factor authentication. Write the new URL down.
How do I log out?
Hover over your name at the top right of the admin bar and click Log Out.
Final thoughts
Most login problems are solved by a password reset, clearing cookies or disabling a plugin. Bookmark your login page and protect it with two-factor authentication.
Protecting your login page
Your login page is the front door of your site, and bots try to guess passwords on WordPress sites every day. Protect it with a long, unique password stored in a password manager, two-factor authentication for every administrator and editor, and a limit on failed login attempts. Avoid using “admin” as a username, and remove old accounts that nobody uses. If you notice thousands of failed login attempts in your security logs, consider a firewall that blocks attackers before they reach the login page.
Remember that some attacks don’t need your password at all. In October 2026, the PHP2Shell vulnerabilities let attackers target unpatched servers directly, bypassing the login page entirely. Strong login security is essential, but it works best alongside a host that keeps server software patched. Our security checklist covers both layers.
Review your list of users every few months and remove anyone who no longer needs access.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
