# The WordPress admin gate

> An extra login in front of /wp-admin/: find its password, change it, or turn it off and on again.

Source: https://veldhost.eu/docs/wordpress-admin-gate

Last verified: 2026-11-12

The admin gate is a second login (HTTP basic auth) in front of your WordPress admin. Your browser asks for it before the WordPress login page appears. It is checked at our edge, before a request reaches WordPress, so the scripts that try passwords on every WordPress site on the internet never get as far as your WordPress login page.

A WordPress site installed by us comes with the gate already on. This article shows how to find its password, change it, and switch it off or on.

## What the gate covers

- **Behind the gate:** `/wp-admin/` and `/wp-login.php`.
- **Not behind it:** your visitors, `/wp-admin/admin-ajax.php` (forms and shop plugins use it from the public site) `/wp-cron.php` (scheduled tasks) and the REST API under `/wp-json/` (apart from the batch endpoint, which is blocked). These keep working as before.
- **Blocked on every WordPress site, whether the gate is on or off:** `/xmlrpc.php` and the batch REST endpoint `/wp-json/batch/v1`. [WordPress: your first steps](https://veldhost.eu/docs/wordpress-getting-started#what-is-blocked-for-you) explains why.
- `/wp-login.php` is also rate-limited per address, as a second layer under the gate.

## Before you start

- The gate is offered on WordPress sites only: sites built on the WordPress stack, or with the WordPress or WooCommerce one-click app.
- You need to be the account's **owner**, an **admin** or a **developer** to see the site's **Settings** tab and the **Reveal password** button. [Roles and permissions](https://veldhost.eu/docs/roles-and-permissions) has the details.

## Find the gate password

1. Open [Sites](https://manage.veldhost.eu/portal/sites) → your site. On the **Overview** tab, the **Your WordPress site** panel says *Admin is protected by an extra login (basic auth)* and shows the gate's user.
2. Press **Reveal password** next to it. The same login is on the **Settings** tab, under **Admin gate login** (**Gate username**, **Gate password**).
3. Open `/wp-admin/` on your site. Enter the gate user and password when your browser asks, then sign in to WordPress with your WordPress username and password as usual.

Every reveal is written to your account's [audit log](https://veldhost.eu/docs/audit-log), with who did it and when.

## Set a new password or username

Open [Sites](https://manage.veldhost.eu/portal/sites) → your site → **Settings**. The gate is under **Visibility**, in the row **Admin gate (extra login on /wp-admin/)**.

- **A new random password:** press **Regenerate password**, then **Reveal password** to see it. The username stays the same.
- **Your own username or password:** open **Change username or password**, fill in **Username** and, if you want to change it, **New password** (leave it blank to keep the current one), then press **Save**. The username may contain letters, digits and `.` `_` `@` `-`. The password may not contain spaces or colons. If something is not accepted, the form says why.

The old password stops working once the change is applied. While a change is on its way, the Settings tab shows **Applying changes…**.

## Turn the gate off or on

On the **Settings** tab, in the **Admin gate (extra login on /wp-admin/)** row:

> **Caution:** With the gate off, anyone can reach your WordPress login page again, and only the WordPress password protects it.

- **Turn off:** press **Turn off** and confirm. `/wp-admin/` then answers to the WordPress login alone.
- **Turn on:** press **Turn on**. The gate gets a new random password. The username stays the one it had, or, if the gate has never been on, your WordPress admin username (or `admin` if we no longer have it). Reveal the password and save it.

The row shows **Protected** while the gate is on and **Off** while it is off. Switching it either way is recorded in your audit log.

## If a tool can't reach your admin

Anything that opens `/wp-admin/` or `/wp-login.php` from outside, such as a monitoring service that checks your login page, meets the gate first. Give it the gate login if it supports basic auth, or point it at a page your visitors use. Plugins that call `admin-ajax.php` from the public site are not affected.

## Related

- [WordPress: your first steps](https://veldhost.eu/docs/wordpress-getting-started)
- [WordPress vulnerability scanning and auto-patching](https://veldhost.eu/docs/wordpress-security-scanning)
- [Two-factor sign-in and passkeys](https://veldhost.eu/docs/two-factor-and-passkeys)
- [Audit log](https://veldhost.eu/docs/audit-log)