Access and logins
Sign in, reset passwords and add people safely.
6 answers · Updated 2026-10-17
Almost every website problem that costs a business real money starts or ends with access. A former freelancer still has an administrator login. The domain is registered under someone's personal email. The one person who knows the password has left. Or a stranger has found a way in because a password was reused from some other site. Access is boring until the day it is the only thing that matters.
This category covers the whole life of an account: how to log in to your website, how to reset a password without making things worse, how to add or remove a user with the right level of permission, and how to switch on two-factor sign-in so a stolen password alone is not enough. Two articles go beyond day-to-day tasks. Who owns your accounts is an audit you can do in an afternoon, and it is the single most useful thing a business can do for its web presence. Suspected hack is the calm, ordered list for the worst day.
Three principles run through all of it. First, each person gets their own login, never a shared one, so you can see who did what and remove one person without disturbing anyone else. Second, give the least access that lets the person do their job. A writer does not need to install plugins. An accountant does not need to publish pages. Third, the business should own the keys. The domain, hosting, analytics and ad accounts should sit under an account your company controls, with you as owner and everyone else, including agencies, added as users.
On passwords, the guidance has changed in recent years and it is simpler than the old rules. Long beats complicated. The UK National Cyber Security Centre recommends combining three random words, and NIST's current digital identity guidelines say sites should not force periodic changes or odd composition rules, and should allow password managers. Use a password manager, make every password unique, and add a second step wherever it is offered.
One rule from our side: we never ask for your password and you should never send it to us, in a ticket, an email or a chat. Our team can reset or grant access without seeing a password. If something in this category is blocking you, send a request through the support form and a person on our team will follow up.
All answers in access and logins
- How to log in to your websiteWhere the login page is for WordPress, Shopify and custom sites, why it may have been moved, and the usual reasons a login fails.
- How to reset your password safelyThe safe reset flow, why the reset email may not arrive, and how to choose passwords that are actually strong.
- How to add or remove a user, and what each WordPress role can doWordPress roles explained, how to choose the lowest one that works, and a clean offboarding routine.
- Two-factor sign-in: what it is and how to set it upWhat two-factor authentication is, which type to choose, how to handle backup codes and a lost phone, and how to roll it out to a small team.
- Who owns your accounts? A business ownership auditA table to audit who really controls your domain, hosting, DNS, email, Google tools and ad accounts, and what to ask any agency.
- Suspected hack: what to do in the first hourThe signs a website has been hacked, what to do first, what not to do, how cleanup works, and how to report phishing.
Questions about access and logins
Where do I log in to my WordPress website?
Add /wp-admin to the end of your web address, for example yourbusiness.com/wp-admin, and WordPress sends you to its login screen. If that shows an error or a blank page, your site may use a different login address for security reasons. Ask your project manager or send a request through the support form and we will confirm the correct address. We will never ask you for your password to do this.
I forgot my password. What is the safest way to reset it?
Type the login address yourself, click the Lost your password link and enter your username or the email on the account. Do not use a link from an unexpected email to start a reset. If no email arrives, check spam and the address on file, and then ask us. A person on our team can restore access without ever seeing your password, so there is never a reason to send it.
What level of access should I give a new team member?
Give the lowest level that lets them do their job. On WordPress that usually means Author or Contributor for writers, Editor for someone who manages all content, and Administrator only for the one or two people who truly run the site. Everyone should have their own login. Review the list of users every few months and remove anyone who has left the business.
Do I really need two-factor authentication?
Yes, for any account that can change your website, move money, or reach your customers. A second step means a stolen or guessed password is not enough to get in. An authenticator app or a security key is stronger than text messages, but any second step is much better than none. Save your backup codes somewhere safe when you set it up.
How do I know who owns my domain and hosting accounts?
Look up the domain and ask your registrar who the account holder is, then check your hosting invoices for the name and email billed. You want both under an account your business controls. If either sits with a former agency, freelancer or employee, move it now rather than when something breaks. The article on who owns your accounts has a full table to work through.
What should I do first if I think my site has been hacked?
Stay calm, write down what you see and when, and contact your host and our team. Change the password on your email account first, then your site and hosting logins, from a device you trust. Do not delete files or reinstall things in a hurry, because you may destroy evidence the cleanup needs. Never send passwords to anyone, including us.
Did not find it? Ask our AI.
It answers from our own support content and sends anything else to a person.
