The admin gate is a second login (HTTP basic auth) in front of your WordPress admin. Your browser asks for it before the WordPress login page appears. It is checked at our edge, before a request reaches WordPress, so the scripts that try passwords on every WordPress site on the internet never get as far as your WordPress login page.
A WordPress site installed by us comes with the gate already on. This article shows how to find its password, change it, and switch it off or on.
What the gate covers
- Behind the gate:
/wp-admin/and/wp-login.php. - Not behind it: your visitors,
/wp-admin/admin-ajax.php(forms and shop plugins use it from the public site)/wp-cron.php(scheduled tasks) and the REST API under/wp-json/(apart from the batch endpoint, which is blocked). These keep working as before. - Blocked on every WordPress site, whether the gate is on or off:
/xmlrpc.phpand the batch REST endpoint/wp-json/batch/v1. WordPress: your first steps explains why. /wp-login.phpis also rate-limited per address, as a second layer under the gate.
Before you start
- The gate is offered on WordPress sites only: sites built on the WordPress stack, or with the WordPress or WooCommerce one-click app.
- You need to be the account's owner, an admin or a developer to see the site's Settings tab and the Reveal password button. Roles and permissions has the details.
Find the gate password
- Open Sites → your site. On the Overview tab, the Your WordPress site panel says Admin is protected by an extra login (basic auth) and shows the gate's user.
- Press Reveal password next to it. The same login is on the Settings tab, under Admin gate login (Gate username, Gate password).
- Open
/wp-admin/on your site. Enter the gate user and password when your browser asks, then sign in to WordPress with your WordPress username and password as usual.
Every reveal is written to your account's audit log, with who did it and when.
Set a new password or username
Open Sites → your site → Settings. The gate is under Visibility, in the row Admin gate (extra login on /wp-admin/).
- A new random password: press Regenerate password, then Reveal password to see it. The username stays the same.
- Your own username or password: open Change username or password, fill in Username and, if you want to change it, New password (leave it blank to keep the current one), then press Save. The username may contain letters, digits and
._@-. The password may not contain spaces or colons. If something is not accepted, the form says why.
The old password stops working once the change is applied. While a change is on its way, the Settings tab shows Applying changes….
Turn the gate off or on
On the Settings tab, in the Admin gate (extra login on /wp-admin/) row:
Caution: With the gate off, anyone can reach your WordPress login page again, and only the WordPress password protects it.
- Turn off: press Turn off and confirm.
/wp-admin/then answers to the WordPress login alone. - Turn on: press Turn on. The gate gets a new random password. The username stays the one it had, or, if the gate has never been on, your WordPress admin username (or
adminif we no longer have it). Reveal the password and save it.
The row shows Protected while the gate is on and Off while it is off. Switching it either way is recorded in your audit log.
If a tool can't reach your admin
Anything that opens /wp-admin/ or /wp-login.php from outside, such as a monitoring service that checks your login page, meets the gate first. Give it the gate login if it supports basic auth, or point it at a page your visitors use. Plugins that call admin-ajax.php from the public site are not affected.