The short answer
For a WordPress site, add /wp-admin to your web address and you will be taken to the login screen. For Shopify, use the sign-in page for your store admin. If the address gives an error, your login may have been moved for security. Check for a typo first, then ask us. Never send a password.
Find the right login page
Your website has two sides. The public side is what customers see. The admin side, sometimes called the dashboard or back end, is where you edit pages and manage settings. Logging in means getting to the admin side.
Which login you need depends on what the site is built on. Most Webtec sites run on WordPress, and some are Shopify stores. If you are not sure which you have, ask your project manager.
| Platform | Where to log in | Notes |
|---|---|---|
| WordPress | yourdomain.com/wp-admin | WordPress redirects /wp-admin to its login screen (wp-login.php) if you are not signed in. Sign-in uses a username or email plus password. |
| Shopify | Shopify's sign-in page, using the email on your account | Shopify's help says that if you are asked for your store's .myshopify.com address, give the original one, even if you later added a custom domain. |
| Custom or other platform | Ask the person who built it | Look for a login link in the site footer, or an address your developer gave you. We can tell you if it is one we built. |
| Hosting control panel | The address in your hosting welcome email | This is separate from your website login. It manages the server, not your pages. |
Step by step for WordPress
- 1Type your website address into the browser bar yourself, then add /wp-admin at the end. Avoid clicking a login link from an email.
- 2Check that the page shows your own domain in the address bar and a padlock. If it shows a different domain, stop.
- 3Enter your username or email address and your password. If your password manager offers to fill it in, let it. Autofill is also a quiet safety check: a manager will not fill in a fake look-alike page.
- 4If your site uses two-factor sign-in, enter the six-digit code from your authenticator app or use your security key. The article on two-factor sign-in explains how this works.
- 5You should land on the dashboard. Bookmark that page so you do not need to remember the address again.
Why your login page may have been moved
Every WordPress site has the same default login address, so automated bots try it constantly, guessing common usernames and passwords. Some sites move the login page to a custom address, or put an extra gate in front of it, to cut down that noise. If your usual address now shows a 404 error or redirects to the home page, this is the likely reason.
Be clear about what this does and does not do. A moved login page reduces bot traffic and log clutter, but it is not a security measure on its own, because a determined attacker can often find it. The protections that actually stop break-ins are unique long passwords, a second sign-in step, limits on repeated failed attempts, and keeping the software updated. The WordPress developer handbook's hardening guide recommends exactly those kinds of measures, along with HTTPS for administration, and does not rely on hiding the page.
If your login was moved on a site we manage, your project manager can give you the correct address. Keep it in your password manager next to the username so you do not have to ask again.
Why a login fails, in the order to check
When a login fails, the cause is usually small. Work down this list before you reset anything, because a reset on the wrong account just creates more confusion.
- The wrong address. A typo in the domain, a missing /wp-admin, or an old address from before a redesign. Try the address from your bookmark or password manager.
- The wrong username. WordPress accepts a username or the email on the account. If you have more than one email, you may be using the wrong one. Try the others.
- A password that is nearly right. Caps Lock, a trailing space copied with the password, or an old password still saved in your browser. Type it into the username field visibly to check, then delete it.
- A browser problem. Cookies blocked, a stale saved page, or an extension interfering. Try a private window. If that works, clear cookies for the site.
- A security plugin lock. Many sites temporarily block an address after several failed attempts. Waiting and then trying once with the right details is better than hammering the form.
- A second step that no longer works. A new phone, a deleted authenticator entry or a dead security key. Use a backup code, and see the two-factor article for recovery.
- The account was removed or changed. A colleague may have deleted the user or changed its role. Ask whoever manages users on your site.
- The site itself is down or broken. If the public site also does not load, read my website is down instead.
Keeping the login page safe
Treat the login page like the front door of a shop. You cannot make it invisible, but you can make it very hard to open with the wrong key.
- Use a unique password for each site, kept in a password manager. See reset your password for how long it should be.
- Turn on a second sign-in step for every administrator and editor.
- Avoid usernames like admin or webmaster. The WordPress hardening guide specifically advises against easily guessed names.
- Log in over HTTPS only, which means a padlock in the address bar. If you see a warning instead, read SSL padlock warning.
- Do not log in on shared or public computers, and sign out on any device that is not yours.
- Never share one login between several people. Create a separate user for each person instead. The article on how to add or remove a user shows how.
A fake login page looks real
Criminals send emails that say your account is locked or your site is about to be suspended, with a button that leads to a convincing copy of a login screen. Entering your details there hands them over. This is called phishing.
CISA lists the usual signs: urgent or emotional language, requests for personal information, shortened links, and email addresses or links that are slightly wrong. Its guidance also notes that clean grammar no longer proves a message is real, because AI can write flawless text.
If an email asks you to log in urgently, do not click its link. Type the address yourself or use your bookmark. If you are still unsure, forward the message to us through the support form as a link to a screenshot, and we will tell you if it is genuine.
Example: A login that suddenly stopped working
Maria runs a physiotherapy clinic and logs in once a month to update opening hours. This month yourclinic.com/wp-admin shows a 404 page. She checks her bookmark and it is the same address. She tries a private window and gets the same result, so it is not her browser. Because she has not changed anything, she suspects the login page was moved when her site was last updated. She sends a request through the support form asking for the current login address, with no password in the message. Her project manager replies with the correct address and she saves it in her password manager. Total effort for Maria: two minutes and one request. Total risk: none.
When to ask us
Ask us when you have checked the address, the username and a private window and still cannot get in, when your login page has moved and you do not have the new address, or when you are not sure an email is real.
Send a request through the support form and include: the web address you are trying, the exact message on the screen (a screenshot shared as a Google Drive or Loom link is best), the browser and device you are using, and roughly when it last worked. Do not include your password. Our team can restore access without seeing it. If you also suspect someone else has been in your account, go straight to suspected hack.
