Locked Out of WordPress Admin: Every Way Back In

If you're locked out of WordPress admin, you're not stuck for long — there are at least six distinct ways back in, and most take under ten minutes. The right method depends on why you're locked out, so this guide walks through every scenario in order from quickest to most technical.

First: Figure Out Why You're Locked Out

The fix is fast once you know the cause. Lockouts fall into a handful of categories:

• Wrong password — most common, easiest to fix
• Email recovery isn't arriving — spam filter, wrong address, or broken mail config
• Account was deleted or role was changed — often after a hack or bad plugin
• Login page returns you to itself (the redirect loop) — usually a cookie or URL mismatch
• Login page shows a critical error or white screen — plugin or theme conflict
• IP or login has been blocked — a security plugin did its job too aggressively

Work through the section that matches your situation. Before you touch any database or file, take a full backup — even a partial one via your host's snapshot tool is better than nothing.

Method 1: WordPress Built-In Password Reset

Go to yoursite.com/wp-login.php and click Lost your password? Enter your username or the email address on the account. WordPress sends a reset link to that address.

If the email doesn't arrive within a couple of minutes, check your spam folder and any "quarantine" folder your host or email provider maintains. If nothing shows up, your site's outgoing mail is broken — move to Method 2.

Method 2: Reset the Password via phpMyAdmin

This works even when WordPress can't send email. You'll need access to your host's control panel (cPanel, Plesk, or similar).

1. Open phpMyAdmin from your host control panel and select your WordPress database.
2. Click on the wp_users table (the prefix might differ — look for a table ending in _users).
3. Find your account row and click Edit.
4. In the user_pass field, delete the existing hash. In the Function dropdown next to that field, select MD5. Type your new password in the value field.
5. Click Go to save.

WordPress actually uses a stronger hash than plain MD5, but it will detect the MD5 hash on first login, accept it, and immediately re-hash it properly. So this is safe for a one-time reset.

Alternatively, if you want to use WordPress's own hashing upfront: in phpMyAdmin, run this SQL query (replacing the values):

UPDATE wp_users
SET user_pass = MD5('YourNewPasswordHere')
WHERE user_login = 'your_username';

Method 3: Reset the Password via WP-CLI

If you have SSH access and WP-CLI installed (most managed hosts include it), this is the cleanest option:

wp user update your_username --user_pass="YourNewPassword" --allow-root

WP-CLI uses WordPress's own password hashing, so the result is identical to changing it through the dashboard. You can also list all users first with wp user list if you're not sure of the username.

Method 4: Create a New Admin User via functions.php

If you can't reset the existing account but have FTP or file manager access, you can inject a new admin temporarily via your active theme's functions.php.

1. Connect via FTP or your host's file manager and navigate to wp-content/themes/your-active-theme/.
2. Download functions.php as a backup first.
3. Open it and paste this at the very end:

add_action('init', function() {
    if (!username_exists('temprescue')) {
        $user_id = wp_create_user('temprescue', 'StrongPassword123!', '[email protected]');
        $user = new WP_User($user_id);
        $user->set_role('administrator');
    }
});

4. Save the file and upload it back.
5. Visit your site's front end once (this triggers init), then log in with the new credentials.
6. Immediately remove the code from functions.php after you're in. Leaving it there is a security risk.

If your theme is a child theme, edit the child theme's functions.php, not the parent's.

Method 5: Fix the Login Redirect Loop

You enter your credentials, the page reloads, and you're back at the login form — no error message. This is almost always caused by one of two things: a mismatch between your siteurl / home settings and the actual URL, or a cookie domain mismatch after moving to HTTPS or changing domains.

Fix the URL settings: In phpMyAdmin, open the wp_options table and look for the rows where option_name is siteurl and home. Make sure both values exactly match your current URL, including https:// if you're on SSL.

Fix the cookie path: Open wp-config.php via FTP and add these two lines above the line that says /* That's all, stop editing! */:

define('COOKIEPATH', '/');
define('COOKIE_DOMAIN', 'yourdomain.com');

Clear your browser cookies for the site, then try logging in again.

Method 6: Recover from a Security Plugin Block

Security plugins like Wordfence, iThemes Security, and Solid Security can block your IP after failed login attempts, or block access to wp-admin entirely during a lockdown. The symptoms look like a blank page, a 403 error, or a "you've been locked out" message.

If you see a lockout message with a countdown timer, wait it out, or whitelist your IP from the plugin's settings — but you're locked out, so you need to do this at the file level.

For Wordfence, connect via FTP and rename or delete the plugin folder: wp-content/plugins/wordfence → wordfence-disabled. This deactivates it without touching the database. Log in, re-enable it from the dashboard, and add your IP to the whitelist before renaming the folder back.

The same rename trick works for any security plugin causing the block. See the guide on isolating plugin conflicts without killing your site for a fuller walkthrough of safely disabling plugins via FTP.

Method 7: Your Account Was Deleted or Downgraded

After a hack or a bad plugin run, admin accounts can be deleted or have their role changed to "subscriber." You'd see a login that succeeds but lands you on a "you do not have permission" screen.

Use Method 3 (WP-CLI) or phpMyAdmin to inspect and fix the user role directly:

-- In phpMyAdmin, run:
SELECT * FROM wp_usermeta
WHERE user_id = YOUR_USER_ID
AND meta_key = 'wp_capabilities';

The meta_value should contain administrator. If it doesn't, update it:

UPDATE wp_usermeta
SET meta_value = 'a:1:{s:13:"administrator";b:1;}'
WHERE user_id = YOUR_USER_ID
AND meta_key = 'wp_capabilities';

If your account was deleted entirely during a hack, use Method 4 to create a fresh admin, then investigate thoroughly — a deleted admin account is a serious indicator of a compromised site. Check the guide on cleaning up a hacked WordPress site before assuming you're clear.

When the Login Page Itself Is Broken

If wp-login.php throws a critical error, a white screen, or a 500 error, the problem isn't your credentials — it's a broken plugin, theme, or WordPress core file. Disable all plugins via FTP by renaming wp-content/plugins to plugins-disabled, then try the login page again. If it loads, rename the folder back and deactivate plugins one at a time from the dashboard.

If the page is still broken with all plugins off, re-upload clean copies of WordPress core files (download from wordpress.org and replace everything except wp-content and wp-config.php). This fixes corrupted core without touching your content.

How to Prevent Getting Locked Out Again

• Store credentials in a password manager — not a sticky note, not a browser that auto-clears.
• Keep a secondary admin account with a different email address. If one breaks, the other gets you in.
• Whitelist your home and office IP in any security plugin before it blocks you.
• Verify your site's outgoing email works — send a test from WP Mail SMTP or similar. If email is broken, password recovery is broken.
• Keep backups you can restore from your host control panel, independent of WordPress itself.

When to Call a Professional

If you've tried every method above and still can't get in — or you suspect the lockout was caused by a hack — that's the right moment to stop experimenting. Repeated failed attempts, especially in the database, can make a recoverable situation harder. If the account was deleted, files look unfamiliar, or you're seeing new admin users you didn't create, treat it as a security incident before a login problem.

Mend's engineers handle this kind of situation every day. A free Diagnosis will triage exactly what's wrong and give you a flat-price quote before any work starts — no card required. If it's urgent, the Emergency Rescue gets a senior engineer on your site same day, with a plain-English report of what happened and what changed.