HolidayActivities Portal: Login and security guide

1. Visit the login page: go to app.holidayactivities.com/login
2. Enter your email address and click Sign in
   
   
    
3. You will then receive a login link to your email
   
   
    
4. Click on the link in this email to log in to your account
   
   
    

Step 1

Choose your preferred verification method: authenticator app or SMS.

If you choose SMS, you will see this screen:

If you choose an authenticator app, you will see this screen:

Step 2

Enter the verification code as prompted and, once confirmed, you’ll be logged in as usual.

To change your methods later:

Click your Settings (bottom left) > Your Account > Multi-factor Authentication (MFA) .

Here you can enable MFA or reconfigure (e.g. change to authenticator app from SMS or update a phone number for SMS authentication).

If you prefer not to use your phone, you can use browser extensions.

How do I get an account?

If you are not an admin, ask an existing Wonde admin at your school to invite you. If no admin is available, contact HolidayActivities Support at 01638 438311 or support@holidayactivities.com.

What if I lose my phone or can’t access my authenticator app?

You will need to raise a support ticket for your MFA to be reset: 

Raise a support ticket

⚠️ Be cautious of:

• Unexpected calls, emails, or messages asking for your MFA code
• Requests that create urgency (e.g. “this must be done immediately”)
• Anyone asking you to approve a login you didn’t initiate

🛟 How to stay safe:

• Never share your MFA code with anyone - even if they claim to be from HolidayActivities, Wonde or your IT team
• Only enter codes when you are actively logging in yourself
• If you receive a code without requesting one, treat it as a warning sign and report it

📋 Your staff security checklist

• Review admin access every few months and remove anyone who no longer needs it
• Ensure all access is removed as part of the employee exit process
• If you receive a request from a staff member, confirm directly with them that the request is genuine
• Check notifications when new admins are added to confirm the access is legitimate