Find the address of every login your website depends on, record it with the account names and who holds access, and keep that record where at least two people in the business can reach it.

Page not found where the login used to be

Someone in the office needs to change the website: new hours, a closure notice, a price. They type the usual login address, the one every WordPress site uses, and get a page not found.

The person who set the site up moved the login years ago, for security, to an address only they knew. They kept it as a bookmark in their own browser.

That person has since left, or the computer with the bookmark was replaced in the spring. Either way, the business owns a website that nobody in it can update.

It is a small problem with a surprising amount of friction, and it is entirely preventable.

Why sites hide the login

There is a good reason for it. Automated scripts try passwords all day at the standard login addresses of WordPress, Joomla and other common systems, because those addresses are the same on millions of sites.

Moving the login to an unusual address takes the site out of most of that traffic. Many security plugins offer it as a single setting, and a careful person turns it on.

The trouble is not the hiding. It is that the new address becomes a secret held in one browser, which is a poor place to keep anything a business depends on.

The addresses people keep as bookmarks

The second is the one that rescues the first. With access to the hosting account, a developer can restore the standard login in minutes; without it, every repair waits on the host.

How the address gets lost

Bookmarks live in one browser on one computer. When that computer is replaced, or the browser is reset, they go with it unless someone thought to move them.

Staff leave, usually on good terms and usually without a handover covering things nobody asked about. The developer who built the site may have moved on or closed the business.

Sometimes the address survives in an old email, which helps only if someone remembers it exists and can search the right mailbox.

Getting back in

If the business can get into its hosting account, the fix is quick. Switching off the plugin that moved the login, usually by renaming its folder on the server, brings back the standard address.

From there, a password reset can go to the site's admin email, and the plugin can be switched back on with a new address that gets written down this time.

If nobody can get into the hosting either, the business has to prove to the host that it owns the account. That can take days and paperwork, and it is the version worth preventing.

A worked example

A dance academy with two studios above a row of shops teaches ballet, jazz and hip hop to children and teenagers. Its former office manager built the WordPress site and ran it for four years.

She installed a security plugin that moved the login to a private address, and kept the bookmark on the front desk computer.

That computer was replaced in April, and she left for a new job in June.

This month the academy needed to post fall class times. The new manager tried the usual address and got page not found, and the former manager remembered the plugin but not the address.

The hosting account was in the owner's name, with the password in her email. A developer logged in, renamed the plugin's folder, reset the admin password, switched the plugin back on and chose a new login address.

That address now sits in the academy's access record beside the hosting, domain and email logins, and two people know where the record is kept.

Writing it down properly

Many businesses already keep a list of their accounts and who can sign in. Check that it records the exact address of each login page, copied from the browser rather than from memory.

A line saying the website runs on WordPress does not help once the standard address has been moved. The address itself is the detail that matters.

Most password managers store the login address alongside each password, so the two stay together.

Use one the business owns, and keep the record where two people can reach it, so a single absence never shuts the business out of its own site.

Codes sent to one phone

Two-step verification, where a login also needs a code from a phone, is worth turning on for every account that offers it.

It creates the same risk in a new form. If the codes go to one person's phone, that phone has become part of the login.

Most services offer backup codes when two-step verification is set up. Print them, store them with the record, and add a second phone where the service allows it.

Test the record once a year

A record nobody has used is a guess. Once a year, and after any change to the site, someone other than its author should try each login using only what the record says.

Any address that fails or account that has changed gets corrected on the spot, while the person who knows the answer is still around.

The counter-case

A business whose site is maintained by a web company under a support agreement is less exposed. The company holds the addresses and can restore access when asked.

Even then, the business should hold its own copy of the record, in case the relationship ends or the company cannot be reached on the day it matters.

And none of this argues against hiding the login. Keep the private address; just make sure it is written down where the business can find it.

Before anyone else leaves

  1. Log in from a different computer as a test.
  2. Write down the current login address.
  3. Record the hosting and registrar logins too.
  4. Note whose name each account is under.
  5. Store the record where two people can reach it.
  6. Save backup codes for two-step logins.
  7. Test the record once a year.

Step one is the quickest way to find out whether you have this problem. If logging in only works from one browser on one desk, the address is a bookmark, not a record.

The same single point of failure, applied to the recovery address, is covered in a website admin email at a personal Gmail account.

Frequently asked questions

Why do websites hide the login page?

Automated scripts try passwords constantly at the standard login addresses of WordPress and other common systems. Moving the login takes the site out of most of that traffic.

What if nobody knows the login address?

With access to the hosting account, a developer can switch off the plugin that moved it and restore the standard login. Without hosting access, the host must first confirm ownership.

Which login addresses should a business record?

Every one someone might keep as a bookmark: the website admin, the hosting control panel, webmail, the registrar, any test copy of the site and any separate booking system.

What should the record contain?

For each system, the login address, the account name, whose name or email it is under and who has access. The passwords themselves go in a business-owned password manager, not in the record.

What about two-step verification codes?

Keep using it, but store the backup codes with the record and add a second phone where the service allows. Otherwise one phone becomes part of the login.

Should we stop hiding the login?

No. The private address is a reasonable precaution. The only problem is that it lived in one browser, so write it down where the business can find it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Only one person can log in?

Tell us which logins you are missing. We will help recover access and record every login the site depends on.

Start a Conversation