I Lost Access to wp-admin: 5 Calm Ways to Recover It

Typing your password into /wp-admin and getting „incorrect password” ten times in a row is stressful — especially when that site brings you clients. The good news: in the most common case, access is recovered in a few minutes, without losing anything.

This guide goes from the simplest method (email reset) to the technical ones (database, WP-CLI). Try them in order. Important: don't click random buttons and don't install shady „recovery” plugins from unknown sources — they often do more harm than good. Breathe, go step by step, and if you get stuck, I'll tell you at the end how we can take the problem off your hands.

First diagnose: is it the password, the email, or the site?

Before fixing anything, understand what broke. There are three different situations with three different solutions:

• You know the username but not the password → the easiest case, go to the email reset.
• You never receive the reset emails → the problem is the site's email delivery, not your account.
• /wp-admin shows a white screen, a „critical error”, or throws you out instantly → it's not the password, it's a plugin, a theme, or the database.

Check the obvious things too: Caps Lock on, the browser autofilling an old password, or the wrong login (email vs. username). Note the exact message you get — it tells you which branch of this guide to follow. And make a backup before the technical methods, if you can.

Method 1: the classic email reset

Try this first because it touches nothing technical. On /wp-login.php click „Lost your password?”, enter the account's username or email, and you'll get a reset link.

A few common traps:

• Check the Spam/Promotions folder — WordPress emails often land there.
• Enter the exact email the admin account was created with, not a random personal one.
• The link is valid for a limited time; if it expired, request another.

If the link asks you for a new password, you're saved — pick a long one and store it in a password manager, not on a sticky note. But if no email arrives at all, don't keep hammering the button: move to Method 2, because the problem is the site's email delivery.

Method 2: change the password directly in the database (phpMyAdmin)

If no email comes, go straight to the data. From your hosting panel (cPanel, Plesk, or equivalent) open phpMyAdmin and select the site's database.

The short version:

• Open the table ending in `_users` (usually `wp_users`).
• Find your admin account's row and click „Edit”.
• On the `user_pass` field, pick `MD5` in the function dropdown, then type the new password in plain text as the value.
• Save. WordPress automatically rewrites the password into a more secure format at your next login.

Careful: you're working on live data, so export the database as a backup first. Don't touch other columns or tables. If you're unsure of the steps, stop here — a mistake in the database is harder to fix than a forgotten password.

Method 3: create a new admin via FTP or WP-CLI

Sometimes the admin account is broken, deleted by someone, or stripped of its rights. Then you don't reset the password — you create a fresh user with full rights.

Two options, depending on your access:

• With FTP/File Manager: temporarily add a small snippet to your theme's `functions.php` that creates a new admin (`wp_create_user` + administrator role). Log in with it, then DELETE the snippet immediately — otherwise it's a security hole left open.
• With SSH and WP-CLI: a single command, `wp user create` or `wp user update`, handles it cleanly without touching files.

WP-CLI is the cleanest option if your host offers it. Whatever method you use, once you're back in, check the user list and delete any unknown admin account — the site may have been compromised, not just the password lost.

Method 4: when it's not the password, but a plugin, theme, or .htaccess

If /wp-admin shows a white screen, „There has been a critical error”, or logs you out instantly, the password is fine — something else is blocking the admin. The usual culprits:

• A badly updated plugin. Via FTP, rename the `wp-content/plugins` folder to `plugins-off`. This disables every plugin. If you get in, it was a plugin — reactivate them one by one to find the broken one.
• The theme. Same idea: temporarily rename the active theme's folder so WordPress falls back to a default one.
• A corrupted `.htaccess` file. Rename it to `.htaccess_old`; WordPress regenerates it.
• Not enough PHP memory — fixed from the host by raising the limit.

Work methodically: change one thing, reload /wp-admin, note the result. That's how you find the exact cause instead of guessing.

How to avoid reliving this — and when to ask for help

Recovery feels great, but prevention is cheaper. A few habits that spare you the scare next time:

• Keep admin passwords in a password manager, not in your head or on paper.
• Run regular automatic backups — a site with a backup gets repaired, one without gets rebuilt.
• Periodically check that the site actually sends email (otherwise the email reset won't work when you need it).
• Don't leave the classic „admin” username and short passwords — they're the first target of attacks.

If you've tried the methods above and you're still locked out, or you're afraid to poke around the database, don't force it. At MPO Web Studio we work fully remote and can take over the recovery safely, with a backup before any change. Message us on WhatsApp, give us the context, and we'll tell you clearly whether it's a quick fix and what it costs — no fantasy promises.