Why does my login page show a 404 or blocked page?

How do I get back in after a 404?

1. Check the address. Make sure you typed your own domain correctly and aren’t on an old site.
2. Try both standard addresses: yourbusiness.com/wp-admin and yourbusiness.com/wp-login.php.
3. Look for a custom login address. Many security plugins move the login page, so the usual addresses show “not found” on purpose. Check your bookmarks and password manager.
4. Try a private or incognito window. A cached page or stale cookie can send you to the wrong place.
   • Expected result: the WordPress login box appears.
5. Ask an administrator for the custom address if you still can’t find it. Finding your login page lists other places to look.

How do I tell which problem I have?

What you see	What it usually means
“Too many failed login attempts” or “try again in X minutes”	A security plugin paused logins from your device for a while.
“Your IP has been blocked” or “access denied”	A firewall or plugin blocked your internet connection’s address.
“403 Forbidden”	The server or firewall refused the request before WordPress saw it.
“404” or “page not found”	Wrong address, a custom login address, or a firewall rule hiding the page.
A blank page or “critical error”	A fault on the site, not a lockout. See critical error or white screen.

The short version

• A 404 on /wp-admin often means the login page was moved or a firewall is hiding it. Blocked or 403 means a security tool stopped you.
• Stop retrying, then ask whoever manages the site to clear the block.

How do I get back in after a lockout?

1. Stop trying for now and read the message. Note how long the lockout lasts.
2. Wait the full time, then select Lost your password? and follow WordPress’s reset steps.
   • Expected result: the reset email arrives, you set a new password, and you log in once.
3. Save the new password in a password manager, and fix any old one your browser keeps filling in.
4. Have your authenticator app ready if the site uses two-factor login. A wrong or expired code can count as a failed attempt.

What if my whole connection is blocked?

A block on your IP address affects every device on that internet connection. That’s why a whole office can be blocked while the owner still gets in from home.

1. Test once on mobile data, with your phone’s Wi-Fi off. Do this only to diagnose.
   • Works on mobile data: your office or home connection is blocked. The site manager can unblock it.
   • Fails everywhere: the block covers more than you, or the login page only allows certain addresses.
2. Don’t keep retrying from the blocked connection. That can turn a short block into a long one.
3. Ask the site manager to unblock you, and tell them what changed: a new internet provider, a VPN, or someone trying an old password.

Why does this matter?

These blocks are protection doing its job. WordPress’s guide on brute force attacks explains that firewalls and security plugins throttle or block repeated logins, because bots guess passwords all day. Sometimes they catch a real person too. A 404 on the login page can be exactly that: a security firewall blocking your own network, while the public site loads fine. The fix is adjusting one rule, not removing the protection.

Should I turn off the security plugin?

Not on your own. Advice online says to rename the security plugin’s folder over FTP to get in. That disables the plugin, but on a live business site it also removes your protection, can scramble its settings, and can break the site if done wrong. Leave that to whoever manages the site, with a current backup in hand. Waiting out a lockout or asking for an unblock is faster and safer.

What are the common mistakes and edge cases?

• Out-of-date saved passwords. The browser fills in the old one, every attempt fails, and the lockout grows.
• Shared logins. One person’s wrong guesses lock out everyone. Give each person their own login. See add or remove a person’s access.
• Lockout warnings when nobody was logging in. Someone else may be guessing. Change your password, turn on two-factor login and read I think my site was hacked.
• Logged in on a shared computer. WordPress keeps you signed in with a cookie, as the Administration Screens guide notes. Use Log Out under your name when you’re done.

What if this didn’t work?

• The reset email doesn’t arrive: see log in and reset a forgotten password.
• You waited and the lockout hasn’t lifted: some blocks last until someone clears them. Contact your site manager or host.
• You don’t know who manages the site: see who owns your domain, and who to call for how to find out who can help.

When you ask for help, give the exact message and the time it happened. A screenshot helps, but crop out anything personal. Never include a password or login code.

How does E-3 handle this?

If E-3 looks after your site, call 814-399-4655 or email support@e3help.me. Tell us the exact message, roughly when it started, and whether it also happens on mobile data. If your site uses a custom login address, ask us for it.

Never send your password by email.

Related questions

• How do I log in to my website, and what if I forgot my password?
• How do I turn on two-factor login?
• How many plugins is too many?