Every WordPress site has a private sign-in page where you enter a username and password to manage it, and this guide shows you how to find that address for your own site. You will learn the two addresses WordPress uses by default, why a site owner might deliberately move or hide the sign-in page for security, how to track the address down when it has been changed and you can no longer remember it, and how to save it so you never have to hunt for it again. People call this the login URL, the admin URL, the wp-admin address or simply "the back end", and they all mean the same thing: the web address that brings up the login box. This article is written for Noiz clients who run WordPress, and it assumes nothing more than that you know your own domain name.
Last reviewed: 27 July 2026, against WordPress 7.0.2 (latest stable). This guide is written for Noiz hosting and is kept current against WordPress. It complements, and does not replace, the official WordPress documentation linked below.
Official Documentation Reference
- Administration Screens (WordPress Documentation): describes the admin area that sits behind the login page, which is where the login address ultimately takes you.
- Reset your password (WordPress Documentation): the official reference for the "Lost your password?" link that lives on the standard login page.
- Giving WordPress its own directory (WordPress Developer Resources): explains how a subfolder installation changes the address of the admin area.
Prerequisites
- You know the domain name your WordPress site is published on, for example
yourdomain.com. - To actually sign in once you have the address, you also need your WordPress username and password. This article is only about locating the address; the sign-in itself, including the "Remember Me" option, is covered in How to Log In to the WordPress Admin Dashboard.
The Two Default Addresses
On a standard WordPress installation there are two addresses that both lead to the login screen. Neither one is linked from your public website, which is deliberate: the login page is for site managers, not visitors, so WordPress keeps it out of the menus. You reach it by typing the address into your browser directly.
yourdomain.com/wp-login.php
This is the login page itself. It works because wp-login.php is a real file sitting in the top folder of your WordPress installation on the server, and requesting it in a browser draws the login form on screen. Type your own domain in front of it, so if your site is published at yourdomain.com the address is https://yourdomain.com/wp-login.php. This same page carries the Lost your password? link, so it is also where you start a password reset.
yourdomain.com/wp-admin/
The second address is https://yourdomain.com/wp-admin/. This is the address of the dashboard, the control panel you land on after signing in. Most people find it the easier of the two to remember. If you visit it while you are already signed in, it opens the dashboard straight away. If you visit it while you are signed out, WordPress cannot show you the dashboard, so it automatically forwards you to the login page first. You will notice the address bar change to something longer such as wp-login.php?redirect_to=.... That extra part is WordPress remembering where you were heading, so that the moment you log in successfully it returns you to the dashboard rather than dropping you on a blank page. In everyday use, then, typing /wp-admin/ and typing /wp-login.php get you to the same place.
A note on /admin and /login
Many people instinctively try yourdomain.com/admin or yourdomain.com/login, because that is how a lot of other systems work. WordPress does not create those two shortcuts by itself, so on a plain installation they lead nowhere useful. They only work if the site owner, a theme or a plugin has been set up to redirect them to the real login page. It is worth a try, but if it fails, fall back on the two addresses above rather than assuming the login is broken.
When Your Site Lives in a Subfolder
The addresses above assume WordPress is installed at the root of your domain. Some sites instead keep WordPress in a subfolder, for example a blog running under yourdomain.com/blog/ while the main homepage is something else. When that is the case, you simply add the subfolder to the address: the login page becomes https://yourdomain.com/blog/wp-login.php and the dashboard becomes https://yourdomain.com/blog/wp-admin/.
There is one variation worth knowing about. WordPress can be set up so that the site is viewed at the clean root address while its core files, and therefore its admin area, live in a subfolder. If your public site loads at yourdomain.com but /wp-admin/ does not lead anywhere, the admin area is most likely tucked into a subfolder like this. The controlling value is the WordPress Address (URL) field under Settings > General in the dashboard, which points at wherever the core files live. If you can already get into the dashboard from another device, check that field to confirm exactly where your login and admin area are served from.
When the Login Page Has Been Moved or Hidden
If you visit /wp-login.php or /wp-admin/ and instead of the login box you get a 404 Not Found page, or you are quietly bounced back to your homepage, the login page has almost certainly been moved to a custom address on purpose. This is a common and legitimate security measure. The default wp-login.php is the very first place automated attacks try when they attempt to guess passwords across the internet, so hardening the site by changing the login address, sometimes called changing the login slug, cuts off a large volume of that unwanted traffic. Various security plugins and server-level hardening setups offer this as a feature, and any of them may have been switched on by whoever built or maintains your site.
When this has been done, the login page still exists, it just answers to a different, private address that only the people who set it up are meant to know, for instance yourdomain.com/my-private-login. The two default addresses are usually turned into dead ends at the same time, which is exactly why they now return a 404 or redirect away. So a 404 at /wp-login.php is not a sign that anything is broken; it is a sign that the login has been deliberately relocated. Moving the login page is one of several steps covered in the WordPress Security Checklist.
How to Find an Address That Has Been Changed
If the login has been moved and you do not know the new address, work through these in order. One of the first few almost always turns it up.
- Your password manager. If you have ever saved your WordPress login in a browser or a dedicated password manager, the saved entry records the exact web address alongside the username and password. This is the single quickest place to look, because a password manager stores the real address you signed in at, custom slug and all.
- Your bookmarks and browser history. Look through your bookmarks, then search your browser history for your domain name or for the word "login". The custom address will show up if you have visited it before.
- The original welcome email. When WordPress was first installed, it sent a setup or welcome email that included a direct link to the login page. Search your inbox for your domain name or for "WordPress". If the login was already customised at install time, that email carries the correct link.
- Whoever set the site up. If a developer, agency or colleague built or manages the site, they chose the custom address and can simply tell you what it is. This is often the fastest route of all.
- A device you are still signed in on. If any computer or phone is still logged into the dashboard, you can read the custom address straight from the settings of the security plugin or hardening tool that changed it, then note it down for future use.
- On the server, with help. As a last resort the address can be recovered from the site's files or database on the Noiz server. Where a hardening tool stores its custom login address varies from tool to tool, so this is genuinely fiddly. Rather than guess, managed-plan clients can open a ticket and ask the Noiz support team to locate it. If you prefer to look yourself and you are comfortable with it, the site's settings are reachable through phpMyAdmin for the database and through SFTP or the panel File Manager for the files, on Plesk, DirectAdmin or ISPConfig alike.
Save the Address So You Do Not Lose It Again
Once you have a login address that works, capture it so this is the last time you go looking. Bookmark it in your browser, and let your browser or password manager save the address the next time you sign in, which stores the login address and your credentials together. If your site keeps WordPress in a subfolder, or the login has been moved to a custom slug, saving it matters even more, because there is no obvious address for you or anyone else to guess your way back to.
One thing to keep separate in your mind: bookmarking the address is not the same as staying signed in. A bookmark saves the location of the login page; the Remember Me checkbox on that page is what keeps you signed in for a couple of weeks so you are not asked for your password every visit. You generally want both.
Troubleshooting
- Symptom:
/wp-login.phpreturns 404 Not Found. The login page has been moved to a custom address for security. Recover the new address using the methods above, starting with your password manager or the person who manages the site. - Symptom:
/wp-admin/redirects to your homepage instead of a login box. This is another sign the login has been relocated or hidden, so the default admin address has been closed off. Find the custom address as above. - Symptom: the address bar cycles through redirects or shows "too many redirects", and the login never appears. This usually points to a mismatch between the WordPress Address (URL) and Site Address (URL) settings, or a mix of
httpandhttpsversions of the address, rather than a missing login page. The Noiz support team can straighten out the site addresses for you. - Symptom: you reach the login page fine but your username or password is not accepted. The address is correct; this is a credentials problem, not a location one. Use the Lost your password? link on the login page, or if the reset email never arrives, follow How to Reset a WordPress Admin Password via phpMyAdmin.
If you have worked through the options here and still cannot find the address for your site, open a support ticket with the Noiz support team. Include your domain and mention whether the site was set up with any security or login-hardening tools, and the team can locate the correct login address for you. Once you are in, keep How to Log In to the WordPress Admin Dashboard handy for the sign-in itself.
