Locked Out of WordPress Admin: Why It Happens and How to Fix It
What you're seeing
- wp-admin keeps redirecting you back to the login page after you enter the correct credentials
- You see "Error: The password you entered is incorrect" even though the password is right
- A 2FA or security plugin asks for a code you no longer have, or blocks your IP entirely
- The login page loads but submitting it reloads the same page with no error (a login loop)
- You get "You do not have sufficient permissions" or are told your account isn't an administrator
What causes it
Forgotten or changed password
The simplest cause: the password no longer matches, often after a password manager update or a teammate's change. WordPress's own reset link fixes this when your site can send email. The complication is that many WordPress sites can't reliably send mail, so the reset email never arrives.
Login redirect loop from wrong Site URL settings
If the WordPress Address (siteurl) or Site Address (home) values are wrong, often after an HTTPS, domain, or migration change, wp-admin will bounce you straight back to the login screen. You enter correct credentials and just land on login again. This is one of the most common 'I can't log in' loops and it's fixed by correcting those two values.
Corrupted or misconfigured .htaccess
A broken .htaccess file, from a bad plugin write, a security rule, or a failed edit, can block access to wp-admin or trigger redirect errors. The login form may not load at all, or it loops. Regenerating a clean .htaccess usually restores access.
A security or 2FA plugin gone wrong
Plugins like Wordfence, iThemes/Solid Security, or a two-factor plugin can lock you out by blocking your IP, demanding a 2FA code you've lost, or limiting login attempts. If you can't satisfy the prompt, the plugin itself is now the barrier. It has to be disabled from outside the dashboard to get back in.
Role or capability problem
Sometimes you can log in but your account is no longer an administrator, so the admin menu is gone or you see 'insufficient permissions.' This happens after a botched user edit, a role-changing plugin, or a partial restore. Your user role has to be reset to administrator at the database level.
Hacked and locked out
If an attacker changed your password or deleted your admin account, you'll be locked out with no warning. This is more serious than the others because the site is also compromised, not just the login. Getting back in is step one; cleaning the hack and closing the entry point is the real job.
How to fix it yourself
Try these from least to most risky, and back up your site before any database or file change.
Use the password reset link first
On the login page, click 'Lost your password?' and enter your username or email. If a reset email arrives, you're back in within a minute. If it never shows up, your site likely can't send mail, so move on to the next steps.
Clear cookies and try a clean browser
A stale login cookie or aggressive cache can cause a login loop that looks like a real lockout. Clear cookies for your domain, or open the login page in a private/incognito window. This costs nothing and rules out the easiest cause before you touch files.
Deactivate plugins via FTP or your host's file manager
If a security or 2FA plugin is blocking you, connect via FTP/SFTP and rename the folder wp-content/plugins/ to plugins-off (or rename just the suspect plugin's folder). That deactivates them so you can log in, then you rename it back and re-enable plugins one at a time. This is safe to undo but touches live files, so back up first.
Reset your password or role in the database (riskier)
Using phpMyAdmin or WP-CLI, you can set a new password (wp_users) or restore your administrator role (wp_usermeta). This works when email is broken, but a wrong edit here can break your site, so export a database backup before you start. If you're not comfortable editing SQL directly, stop here and get help.
Fix the Site URL or regenerate .htaccess (riskier)
For a redirect loop, correct siteurl and home in the wp_options table (or define WP_HOME / WP_SITEURL in wp-config.php), and rename a suspect .htaccess so WordPress writes a clean one. These are powerful fixes but easy to get wrong, so back up the database and the .htaccess file first.
Rather not risk it? We'll fix it for you.
If the reset email never arrives, the database steps make you nervous, or you suspect the site was hacked, that's the right time to hand it off. Mend gets you back into wp-admin fast, and we work backup-first, so a full backup is taken before we touch anything. Every fix is documented so you know exactly what was changed, and it's covered by our money-back guarantee.