Public testing phase We’re in a public testing phase — feel free to look around, but we’re not taking orders yet. Ordering opens 1 October 2026. See plans →

WordPress: your first steps

Picked the WordPress stack? Your site came with WordPress already installed and running.

First login: two logins in a row

  1. Your site page in the portal shows the admin address (/wp-admin/), username and a generated password — we display it for 7 days, so save it now.
  2. Open /wp-admin/. Your browser asks for a login first: that is the admin gate, a small extra lock we put in front of the WordPress login (HTTP basic auth). Its username and password are on the Settings tab of your site page ("Admin gate" — press Reveal password).
  3. Then the familiar WordPress login page appears: sign in with the WordPress username and password from the first step, go to Users → Profile and set your own password.

Why two? Bots try every WordPress login page on the internet, all day. The gate is checked at our edge, before the request reaches WordPress, so those scripts never get to your login page or your plugins. Your visitors never see it, and it leaves admin-ajax.php (used by forms and shop plugins) and the scheduled tasks untouched. You can change the gate's username and password, regenerate it, or turn it off on the Settings tab — every reveal of the password is written to your account's audit log.

What is blocked for you

  • /wp-json/batch/v1 — the WordPress "batch" REST endpoint is blocked on every WordPress site, whatever the method. It lets one request carry many, was recently used in the wild to slip past rate limits and plugin checks, and nothing you install needs it.
  • /xmlrpc.php — the old remote-publishing interface answers 403. It is a favourite for password guessing (hundreds of attempts in one call) and modern apps use the REST API instead. If a plugin insists on it, ask support.
  • /wp-login.php is also rate-limited per address underneath the gate, as a second layer.

Make it yours

  • Appearance → Themes — pick a look; the theme customizer previews before publishing.
  • Pages — your home/about/contact live here.
  • Settings → General — site title and language.

Keeping it healthy

  • We keep WordPress core security updates applied and run real scheduled tasks (no traffic-dependent cron). Plugins are yours: fewer is better, update them, delete what you don't use.
  • Before experimenting, press Back up now on the Files tab — restoring takes one click.
  • If the site white-screens after a plugin update, check the Logs tab, then restore.