Logging in
The admin panel lives at /admin. Sign in with your email/username and password. After too many consecutive failures (10 attempts within an hour, by default) further attempts from that account/IP are temporarily throttled to slow down brute-force attacks.
Password reset
Use Forgot password? on the login form:
- Enter your account email
- A reset link with a signed token is emailed to you
- The link opens the reset form where you choose a new password
Reset tokens expire after a short period and are single-use. If you no longer control the email address, another admin can change your password from admin users.
Hardening tips
- Use long, unique passwords - consider the two-factor authentication plugin
- Keep the number of admin accounts small and review them periodically
- All login activity is subject to rate limiting; see security