I Lost Access to wp-admin: 5 Calm Ways to Recover It

To get back into wp-admin without your password, start with the “Lost your password?” link on /wp-login.php. If the reset email never arrives, set a new password directly instead: from your host's WordPress manager, phpMyAdmin, WP-CLI or a temporary line in functions.php. If the login page shows an error, keeps reloading or says you're blocked, the password isn't the problem, and the fix is usually a plugin, a setting or a file left behind by an update.

None of the methods below delete posts, pages or images. They only change login details or switch something off for a few minutes. Go through them in order, from the simplest to the most technical, and export the database before you touch it. Don't install random “recovery” plugins or scripts from unknown sources: they often do more damage than the lockout itself.

First, work out what's actually blocking you

The message you get tells you which part of this guide you need. Rule out the boring causes first: Caps Lock, a browser autofilling an old password, or the wrong account (the form accepts a username or an email address, so check you're using the one tied to the admin account). Then try a private or incognito window, which takes old cookies and browser extensions out of the picture.

One more check: if your site runs on WordPress.com, you sign in with a WordPress.com account and recovery goes through WordPress.com account recovery. Everything below is for self-hosted WordPress, installed on your own hosting.

If the last column says yes, work through methods 1 to 5. If it says no, skip to the section on lockouts, loops and errors further down.

Method 1: “Lost your password?” (or ask another admin)

On yoursite.com/wp-login.php, click “Lost your password?”, enter the account's username or email address, and WordPress emails you a link to set a new password. It needs no technical access and touches no files, so it's always the first thing to try.

• Check Spam, Promotions and any inbox filters. The email is sent by your own website's server, which is exactly why it often ends up there.
• Use the address on the admin account. On older sites that's often an inbox nobody checks any more: a former developer's address or a generic info@.
• The link works for a limited time. If it says the link is invalid or expired, request a fresh one and use the newest email.
• If someone else still has Administrator access, they can open Users > All Users, hover over your name and click “Send password reset”. You get the same link, and nothing else about your account changes.

Once you're in, choose a long password and save it in a password manager. If no email shows up after a few minutes and it isn't in spam, stop hitting the button: your site most likely can't send email. Move on to Method 2.

Method 2: log in from your hosting control panel

Many hosts add a WordPress manager to the control panel. On cPanel and Plesk it's usually WP Toolkit; some hosts have their own version. Find your site in the list: the Log in button opens wp-admin as an administrator without asking for the password, and Setup, next to it, lets you set a new admin password. If there's no Log in button, it usually means the toolkit has no admin password stored for that site: set one in Setup first, and the button appears.

This is the quickest route when email is broken, because you don't edit anything by hand. If your panel has no WordPress manager, or your site isn't listed in it, ask your host's support. Once they've confirmed you own the account, they can reset the admin password or point you to the right tool.

Method 3: change the password in phpMyAdmin

No WordPress manager, but you can open phpMyAdmin from your hosting panel? Then change the password straight in the database. Export the database first (Export tab, default settings) so you can undo any mistake.

• Open phpMyAdmin and click your site's database. If there are several, the right name is in wp-config.php, on the DB_NAME line.
• Open the table whose name ends in _users. It's wp_users by default, but many installs use a different prefix, which you'll find in wp-config.php as $table_prefix.
• Find your account in the user_login column and click Edit.
• In the user_pass row, delete the long string, type your new password, and pick MD5 from the Function dropdown next to it.
• Click Go, then log in with the new password.

Does the MD5 trick still work in 2026? Yes. Since WordPress 6.8, new passwords are stored with bcrypt, but older hash formats are still accepted, and WordPress rehashes your password in the new format the first time you log in. So MD5 is only a bridge to get you in, not a weak password left in the database.

Edit only that one field. If you're not sure you're in the right table or row, stop there: a damaged database is a much bigger problem than a forgotten password. Your account was deleted or demoted rather than just locked? Creating an admin in phpMyAdmin means adding rows to two tables by hand, so use Method 4 or 5 for that instead.

Method 4: WP-CLI, if you have SSH access

WP-CLI is the official command-line tool for WordPress, and it's the cleanest option: it uses WordPress's own functions, so nothing is edited by hand. Connect over SSH, go to the folder that contains wp-config.php, and use:

• wp user list to see every account with its ID, login and role.
• wp user update 1 --user_pass=YourNewLongPassword to set a new password for user ID 1. Replace the ID and the password, and put the password in quotes if it contains spaces or symbols.
• wp user create newadmin you@example.com --role=administrator to create a fresh administrator. If you don't give a password, WP-CLI generates one and prints it in the terminal.
• wp user set-role 12 administrator to give the administrator role back to an account that lost it.

If the wp command isn't available on your server, ask your host whether they offer it, or use another method.

Method 5: a temporary line in functions.php (FTP or File Manager)

No database access and no SSH, but you can reach the files? WordPress's own documentation describes a one-line fix. Download your active theme's functions.php through FTP or your host's File Manager, keep an untouched copy, and add this line near the top, right after the line that opens PHP:

wp_set_password( 'YourNewLongPassword', 1 );

The 1 is the user ID. The first account created is usually ID 1, but not always; if you can see the database, check the ID column in the users table. Upload the file, log in, then delete the line straight away. Until you do, it resets that password on every page load.

If you need a new administrator rather than a new password (because your account was deleted), the same approach works with a short snippet that creates a user with wp_create_user() and gives it the administrator role. Remove it as soon as you're in. A typo in functions.php can bring up a white screen, which is why you kept the original copy: upload it back and you're where you started.

Blocked after too many attempts, or by two-factor authentication

Security plugins and some server firewalls block an IP address after a run of failed logins. You'll see a lockout notice, a 403 page or a message that you've been blocked, even with the right password.

• Wait and try again later. Most of these blocks are temporary.
• Try from another network, such as your phone on mobile data. The block is tied to your IP address, so a different connection often gets straight through.
• Some security plugins put an unlock option on the block page that emails you a link. That email also comes from your own site, so check spam.
• Still blocked? Through FTP or the File Manager, rename that plugin's folder in wp-content/plugins (for example by adding -off to the end). Log in, rename it back, then add your IP to the plugin's allowlist.
• If renaming the plugin changes nothing, the block is probably at server level. Ask your host to check their firewall for your IP.

Lost the phone with your authenticator app? If your 2FA plugin gave you backup codes when you set it up, use one of them. Without them, rename the 2FA plugin's folder the same way, log in, rename it back and set 2FA up again, this time with the codes stored somewhere safe.

The login page loops, or /wp-admin shows a 404

• Clear the cookies for your site, or use a private window. WordPress needs cookies to keep you logged in, and a privacy extension that blocks them can send you straight back to the login form.
• Check the site address. If the WordPress Address or Site Address was changed by mistake (common after moving to HTTPS or a new domain), add two lines to wp-config.php: define( 'WP_HOME', 'https://example.com' ); and define( 'WP_SITEURL', 'https://example.com' ); with your real address, https:// included and no slash at the end. These override the values stored in the database. While they're in place, the two address fields in Settings > General are locked; you can leave the lines there for good, or correct the siteurl and home rows in the options table (wp_options by default) and then remove them.
• Using Cloudflare? With the SSL/TLS encryption mode set to Flexible, Cloudflare talks to your server over plain HTTP, and if your server redirects HTTP to HTTPS you get an endless loop. Switch to Full or Full (strict); both need an SSL certificate on your server.
• If /wp-admin returns a 404 page, a plugin has probably moved your login page to a custom address. Check your notes or emails for it. WPS Hide Login, for example, stores it as whl_page in the options table. Or rename that plugin's folder to get the standard wp-login.php back, then reinstall or reactivate it once you're in.

White screen, critical error, maintenance message or database error

Here the password is fine; something stops WordPress from loading. Change one thing at a time, reload /wp-admin and note what happened, so you find the cause instead of guessing.

• “There has been a critical error on this website”: WordPress emails the site's admin address a link to recovery mode, where the faulty plugin or theme is paused so you can log in and deactivate it. Look for that email, including in spam.
• No email, or a blank white screen: rename the wp-content/plugins folder to plugins-off. If wp-admin loads, open the Plugins screen while the folder is still renamed, so WordPress deactivates them all. Then rename the folder back and reactivate the plugins one by one; the one that brings the error back is the culprit.
• The theme: rename the active theme's folder in wp-content/themes. WordPress switches to a default theme, as long as one of the bundled “Twenty” themes is still installed.
• A broken .htaccess file (on Apache or LiteSpeed servers): rename it to .htaccess_old. Once you're in, go to Settings > Permalinks and click Save Changes to write a clean one.
• “Allowed memory size exhausted”: PHP ran out of memory. Raise the PHP memory limit in your host's panel, or in wp-config.php with WP_MEMORY_LIMIT (WP_MAX_MEMORY_LIMIT sets the limit for the admin area). WordPress can't go above what your host allows.
• “Briefly unavailable for scheduled maintenance”: an update was interrupted and left a file called .maintenance in the site's root folder (the one that contains wp-admin). Delete it, clear any cache, then run the update again in case it didn't finish.
• “Error establishing a database connection”: compare DB_NAME, DB_USER, DB_PASSWORD and DB_HOST in wp-config.php with the database details in your hosting panel. If they match, the database server itself may be down, which is a job for your host.

For the blank-screen case in more detail, see our step-by-step guide to the WordPress white screen of death.

Once you're back in: clean up and prevent the next lockout

• Open Users > All Users and look for administrators you don't recognize. If you find any, treat the site as hacked, not just locked: here's how to check WordPress for malware and clean it.
• Undo everything temporary: the functions.php line, renamed folders, any test accounts.
• Make sure the Administration Email Address in Settings > General is an inbox someone actually reads, because recovery-mode emails go there. Password reset links go to the email on each user's profile, so check yours under Users > Profile too.
• Fix email sending, for example with an SMTP plugin connected to a proper email service, so the reset email arrives next time.
• Keep two administrator accounts belonging to two different people, so one can always send the other a reset link.
• Store passwords in a password manager, keep 2FA backup codes somewhere safe, and avoid the username “admin”.
• Run automatic backups that are stored off the server, and test a restore now and then. A site with a working backup gets repaired; one without gets rebuilt.

If you've tried all this and you're still locked out, or you'd rather not touch the database, don't force it. At MPO Web Studio, a small web studio in Cluj-Napoca, we work remotely and can take over the recovery safely, with a backup before any change. Message us on WhatsApp with what you see on screen, and we'll tell you plainly whether it's a quick fix and what it costs.