Locked Out of WordPress Admin: How to Get Back In

Being locked out of WordPress admin is a particular kind of frustrating, because the tool you would normally use to fix a problem is the problem.

The good news is that WordPress stores everything in files and a database you still control. There is nearly always a way back in. The order below goes from easiest to most involved.

Route 1: Password reset

Obvious, but worth confirming it genuinely failed rather than went to spam. Check the spam folder, and check whether the address on the account is one you can still access.

Reset emails frequently fail because WordPress email is unreliable by default — our guide on contact forms not sending email explains why. If the site cannot send mail at all, no amount of clicking will help and you should move to the next route.

Route 2: Reset the password in the database

Reliable and reasonably quick. You need phpMyAdmin or similar from your hosting panel.

1. Open your database and find the wp_users table (the prefix may differ)
2. Find your user row and edit it
3. In the user_pass field, enter a new password
4. Set the function dropdown beside it to MD5
5. Save, then log in with the new password

That MD5 step matters — without it you store plain text and login will fail. WordPress will upgrade the hash to a modern format automatically on your first successful login.

Route 3: Create a new admin via functions.php

Useful when your account has been deleted or demoted. Add this to your active theme's functions.php:

add_action('init', function() {
  $u = 'newadmin'; $p = 'ChooseSomethingLong'; $e = 'you@example.com';
  if (!username_exists($u)) { $id = wp_create_user($u, $p, $e); (new WP_User($id))->set_role('administrator'); }
});

Load any page on the site once, then delete those lines immediately. Leaving them in place means anyone who finds them has a route to an admin account.

Route 4: Disable the plugin that broke login

Security plugins are a common cause — a lockout rule triggered on your own address, a two-factor setup gone wrong, or a login-URL change you forgot.

Rename the plugin's folder inside wp-content/plugins to deactivate it without dashboard access. If you are not sure which one, rename the whole plugins folder, log in, then restore it and re-enable them individually.

If you changed your login URL and cannot remember it, disabling that plugin restores the standard /wp-login.php.

Route 5: Switch to a default theme

A fatal error in functions.php can take down the admin as well as the front end. Rename your theme folder and WordPress falls back to a default theme, which usually restores access.

Route 6: Fix the site URL

If login redirects you somewhere unexpected, or bounces you straight back to the login page, the site URL may be wrong — common after a migration. Force it in wp-config.php:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

If you land in a redirect loop instead, our guide to WordPress redirect loops covers that specifically.

Route 7: Clear cookies

Worth trying before anything complicated. A corrupted session cookie can cause an endless bounce back to the login screen. Clear cookies for the domain, or use a private window.

The question worth asking

Before you settle back into work, consider how you got locked out. Most of the time it is mundane — a forgotten password, a plugin misconfiguration, a broken mail setup.

Sometimes it is not.

Removing or demoting the legitimate administrator is a standard move once an attacker has control. It slows down the response while they finish what they are doing.

Treat it as suspicious if your account was deleted or demoted with nobody else having access, if the admin email address on the account was changed, if there are administrator accounts you do not recognise, if you received password reset emails you did not request, or if the site was already behaving oddly beforehand.

If any of that applies, getting back in is the start rather than the end. Our guide to what to do in the first hour covers the response, and removing malware from WordPress covers the clean-up. Assume they still have access until you have changed every password and regenerated the security keys in wp-config.php.

Once you are back in

1. Set a strong unique password and store it in a password manager
2. Review the full user list and remove accounts nobody can account for
3. Confirm the admin email address is one you actually monitor
4. Set up proper email delivery so reset emails work next time
5. Enable two-factor authentication
6. Note down which plugin caused it, if that was the cause

That third point prevents a surprising number of repeat lockouts. Sites frequently have an admin email belonging to a developer who left years ago.

Preventing the next one

Keep more than one administrator account, held by different people, so a single lockout is not a crisis. Use a password manager rather than memory. Make sure the site can actually send email. And keep hosting-level access — FTP and the control panel — separate and available, since that is what every recovery route above depends on.

Our login security guide covers the balance between locking things down and locking yourself out.

If none of this works

Some lockouts are genuinely stubborn — particularly where hosting access is also unclear, or where the site was built by someone no longer contactable. Our guide to auditing an inherited website covers establishing ownership properly.

Our WordPress security and error fixing service handles lockouts regularly, including working out whether it was accidental or deliberate.

Get in touch with your web address and what happens when you try to log in.