Your account

Your account is created by an administrator on the Staff page. The welcome email, Your CMS account is ready, holds the sign-in link, your email address and a temporary password.

Signing in

1. Open /admin/login on your website's address. The screen reads Staff sign in.
2. Enter your Email and Password, and press Continue.

A wrong address or password reads Invalid email or password. After ten tries for one address within fifteen minutes, the screen reads Too many sign-in attempts and asks you to wait a few minutes.

Signing in with Microsoft

A site set up for Microsoft sign-in shows Sign in with Microsoft above the password fields. Press it, sign in to Microsoft as you do at work, and the admin opens.

Your Microsoft address must match a staff account an administrator has created. Your organization's Microsoft sign-in asks for its own second factor. The CMS asks for no code of its own.

The authenticator app

A site that requires two-factor sign-in asks for a six-digit code from an authenticator app, such as Google Authenticator, Microsoft Authenticator or 1Password.

The first time

1. After your password, the screen shows a QR code.
2. Scan it with your authenticator app. The app lists the entry under your email.
3. Enter the six-digit code the app shows under Code from the app, and press Enable & sign in.
4. The screen shows eight recovery codes. Save them somewhere safe, then press I've saved them — continue.

Each recovery code signs you in once, for the day you lose your phone. The screen shows them this one time.

Every time after

Enter the code your app shows, or one recovery code, under Code, and press Sign in. A recovery code is used up once it signs you in.

A new phone or a lost one

Ask an administrator to press Reset 2FA on your row of the Staff page. At your next sign-in you set up the authenticator again, with a new QR code and new recovery codes.

An administrator decides whether the whole site requires two-factor sign-in, with Require two-factor sign-in under Settings → Security.

A forgotten password

1. On the sign-in screen, press Forgot password?
2. Enter your Email and press Send reset link.
3. Open the email and follow its link. The link works once, within an hour.
4. Enter your email, then a New password twice, and press Set password and sign in.
5. Sign in with the new password.

A password needs at least ten characters and a strength of Good or better. The screen rates it as you type.

To change your password while signed in, use Forgot password? the same way, or ask an administrator to set one for you.

Signing out

Press Sign out at the foot of the sidebar. The sign-in screen opens.

Trouble signing in

Having trouble signing in? under the sign-in card offers Refresh app data & reload and Reset app. Each clears what your browser kept from the CMS, for a fresh start.