How to Regain WordPress Admin Access When You're Locked Out

To regain WordPress admin access when traditional login and password resets fail, you must bypass the standard login interface using backend file or database access. The fastest and safest method is creating a temporary administrator user by adding a code snippet to your active theme’s functions.php file via FTP or cPanel File Manager, or by editing user tables directly inside phpMyAdmin.

Being locked out of your own WordPress website is frustrating, alarming, and surprisingly common. Whether a security plugin blocked your IP address, a password reset email never arrived, or a broken code snippet wiped out user roles, losing dashboard access halts updates, content management, and business operations. Fortunately, as long as you have server access through your web hosting account or FTP, you can always recover control.

Symptoms of a WordPress Admin Lockout

Admin lockouts present differently depending on the underlying failure point. Identifying your exact symptom helps pinpoint the right recovery strategy quickly:

• Endless Login Redirect Loop: Entering correct credentials simply reloads the login page without displaying an explicit error message.
• Security Plugin Access Denied: Pages display "403 Forbidden," "Too Many Failed Attempts," or an explicit lock screen generated by plugins like iThemes Security, Wordfence, or Solid Security.
• Password Reset Email Not Arriving: Clicking "Lost your password?" indicates an email was sent, but the notification never arrives in your inbox or spam folder.
• "Sorry, you are not allowed to access this page": You log in successfully, but WordPress blocks access to admin screens due to corrupted user roles or capabilities.
• White Screen on /wp-admin: Attempting to load the login page yields a completely blank screen or a generic critical error message.

Likely Causes Behind Admin Lockouts

Before modifying files or database entries, understanding why the lockout happened helps prevent recurring issues once access is restored:

• Failed Authentication Limits: Security tools automatically block IP addresses after multiple incorrect password attempts or automated brute-force attacks.
• Two-Factor Authentication (2FA) Failures: Lost phones, reset authenticator apps, or misconfigured SMS gateways render standard 2FA prompts unpassable.
• Corrupted .htaccess or Site URLs: Unintentional edits to site URLs inside administrative settings break redirect routes between http and https.
• Database Corruption: Damaged database tables can clear the wp_user_roles capability array, rendering legitimate administrator accounts powerless.
• PHP Mailer Misconfigurations: Web servers lacking transactional email routing fail to deliver password reset tokens.

Step 0: Always Create a Backup First

When executing manual backdoors or directly editing database tables, precision is crucial. A syntax error in PHP or an unintended SQL query can take down the entire site front-end.

Before proceeding with any fix, access your web hosting control panel (cPanel, Plesk, or host dashboard) and export a database backup (.sql file) alongside a full backup of your wp-content directory.

Fix 1: Create an Emergency Admin User via functions.php

If you have FTP credentials or access to your web host's File Manager, you can force WordPress to generate a new administrator account automatically when any visitor loads the website.

Step 1: Access Your Theme Files

1. Connect to your web server using an FTP client (like FileZilla) or open your host’s File Manager.
2. Navigate to /wp-content/themes/your-active-theme/.
3. Locate the functions.php file and download a copy to your computer as a backup.

Step 2: Add the Emergency User Code

Open functions.php in a plain text editor (such as VS Code or Notepad) and paste the following snippet at the very bottom of the file:

function mend_create_emergency_admin() {
    $user = 'tempadmin';
    $pass = 'ChangeMeNow!2026#';
    $email = '[email protected]';

    if ( ! username_exists( $user ) && ! email_exists( $email ) ) {
        $user_id = wp_create_user( $user, $pass, $email );
        $user_obj = new WP_User( $user_id );
        $user_obj->set_role( 'administrator' );
    }
}
add_action( 'init', 'mend_create_emergency_admin' );

Step 3: Trigger Execution and Log In

1. Save the modified functions.php file and upload it back to your server.
2. Visit your main site URL in an incognito or private browser window. Loading any page executes the code and registers the user.
3. Navigate to example.com/wp-admin and log in using the temporary username (tempadmin) and password (ChangeMeNow!2026#).
4. Crucial Step: Once logged in, remove the snippet from functions.php immediately. Leaving active account creation code in production poses a massive security vulnerability.

Fix 2: Add a New Admin User Directly via phpMyAdmin

When files cannot be edited or execution hooks fail, creating a user directly within the MySQL database bypassed WordPress internal application logic altogether.

Step 1: Open phpMyAdmin

Log into your web hosting control panel and locate phpMyAdmin. Select your site's database from the left-hand menu.

Step 2: Execute SQL Query

Click on the SQL tab at the top menu bar. Copy and paste the following queries into the command box. Note: If your database uses a custom prefix instead of default wp_, replace wp_ with your custom prefix (e.g., wp_a1b2c_).

INSERT INTO `wp_users` (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_url`, `user_registered`, `user_activation_key`, `user_status`, `display_name`)
VALUES ('dbadmin', MD5('StrongPassword123!'), 'dbadmin', '[email protected]', '', NOW(), '', 0, 'DB Admin');

INSERT INTO `wp_usermeta` (`user_id`, `meta_key`, `meta_value`)
VALUES (LAST_INSERT_ID(), 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

INSERT INTO `wp_usermeta` (`user_id`, `meta_key`, `meta_value`)
VALUES (LAST_INSERT_ID(), 'wp_user_level', '10');

Click Go to execute the query. You can now log into /wp-admin with username dbadmin and password StrongPassword123!.

Fix 3: Disable Security Plugins and 2FA Lockouts

If you know your password but are blocked by an IP firewall or broken 2FA prompt, temporarily disabling the responsible plugin restores immediate access.

Method A: Rename the Plugin Folder via FTP

1. Open FTP or host File Manager and navigate to /wp-content/plugins/.
2. Locate the folder belonging to your security or 2FA plugin (e.g., wordfence, iThemes-security-pro, or two-factor).
3. Rename the directory by appending -disabled to the end (e.g., wordfence-disabled).

WordPress automatically deactivates any plugin whose directory name changes, clearing firewalls and authentication gates instantly.

Method B: Clear Security Locks via WP-CLI

If your host provides Command Line (SSH) access, execute WP-CLI commands to manage plugins and users instantly without web interfaces:

# List installed plugins
wp plugin list

# Deactivate a troublesome security plugin
wp plugin deactivate wordfence

# Reset password for primary admin user
wp user update admin_username --user_pass="NewSecurePass123!"

For more details on resolving specific system lockouts, consult our complete guide on recovering locked out WordPress admin access.

Fix 4: Correct Mismatched Site and Home URLs

If changing domain settings or migrating to SSL causes a login redirect loop, force hardcoded site URLs via wp-config.php.

1. Connect via FTP and open wp-config.php located in your root directory.
2. Add these two lines near the top of the file, right after the opening <?php tag:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Save the changes and re-upload. This temporarily overrides settings saved in the database and resolves continuous authentication redirection loops.

How to Prevent Future WordPress Admin Lockouts

Once you've regained control of your site, take proactive security and administrative measures to ensure you never get locked out again:

• Configure Transactional Mail Services: Set up an SMTP plugin (such as Post SMTP or FluentSMTP) connected to a transactional provider (SendGrid, Mailgun, or Amazon SES). This ensures critical email alerts and password reset links bypass server spam filters.
• Store 2FA Backup Keys Securely: When setting up two-factor authentication, download emergency offline recovery keys and store them inside a secure password manager.
• Establish a Secondary Admin Account: Maintain a secondary administrator account with a separate email address specifically reserved for emergency management.
• Keep Staging Environments Active: Test major updates, security rule modifications, and code snippets in a isolated staging environment before pushing changes to production.

When to Call a Professional

Fixing an administrative lockout using code snippets or database queries works well when file access is straightforward. However, complex security breaches, database corruption, or hosting-level restrictions can complicate matters significantly.

If you are uncomfortable executing raw SQL statements, if editing system files causes a WordPress White Screen of Death, or if security plugins continue re-locking your server despite manual edits, calling an expert engineer saves valuable downtime.

If you're stuck or short on time, let a senior engineer handle it safely. Submit an Emergency Rescue request with Mend. Our team will access your server securely, clear lockouts, repair corrupted user roles, and return full administrative control with flat pricing and zero risk.

For ongoing site maintenance, automated backups, and real-time security monitoring that prevents administrative lockouts entirely, explore our comprehensive WordPress Care Plan.