Skip to main content

Get back into a locked WordPress admin

If you cannot sign in to the WordPress dashboard at /wp-admin, the cause is usually a forgotten password, a reset email that never arrives, a security plugin that has blocked you, or a site address that sends you in circles. This guide covers each case, starting with the simplest. It is for site owners and administrators who have access to their hosting account.

Make sure it is your account

Only reset passwords for sites and accounts you are responsible for. If you see administrator accounts you do not recognise, the site may have been compromised. See What to do if your website is hacked.

Reset a lost password by email​

  1. Open the sign-in page, for example https://example.com/wp-login.php.
  2. Choose Lost your password?.
  3. Enter your username or the email address of your WordPress account.
  4. Open the email WordPress sends and follow the link to choose a new password.

If the reset email does not arrive​

  • Check your spam or junk folder, and wait a few minutes.
  • Make sure you used the email address on the WordPress account, which may be different from the one you normally use.
  • Your site may not be able to send email. Many sites deliver email more reliably through an SMTP plugin connected to a real mailbox. See Email delivery problems.

If email does not work, reset the password directly with one of the methods below.

Reset the password with WP-CLI​

WP-CLI is the official command-line tool for WordPress. If your hosting gives you SSH access and has WP-CLI installed, this is the cleanest way to reset a password.

  1. Connect to your hosting with SSH and go to the folder where WordPress is installed.

  2. List the users to find the right username:

    wp user list --fields=ID,user_login,user_email,roles

  3. Set a new password. The --prompt option asks for the password instead of putting it on the command line, so it is not saved in your shell history:

    wp user update jane --prompt=user_pass

  4. Sign in with the new password.

See the WP-CLI documentation for more commands.

Reset the password in phpMyAdmin​

phpMyAdmin is a web tool for managing databases that many hosts provide. Use it only if the other methods are not possible, and take a database backup first.

  1. Open phpMyAdmin from your hosting control panel or account and select your site's database. Its name is the DB_NAME value in wp-config.php.
  2. Open the users table. It is usually called wp_users, but the wp_ prefix may be different; check $table_prefix in wp-config.php.
  3. Edit the row for your account.
  4. In the user_pass field, type a new temporary password and choose MD5 from the function list next to it.
  5. Save, then sign in with that password.
  6. Straight away, set a new strong password under Users > Profile.

MD5 is an old, weak way of storing passwords. WordPress still accepts an MD5 value in user_pass so that this kind of manual reset works, and it replaces it with its own stronger format the first time you sign in successfully. That is why you should change the password immediately afterwards. If this method does not work on your WordPress version, use WP-CLI or ask your host for help.

Locked out by a security plugin​

Security plugins can block an account or an IP address after several failed sign-in attempts, or after a two-factor device is lost.

  1. Wait for the lockout period to end if the plugin shows one.
  2. If you still cannot get in, connect with SFTP and open wp-content/plugins. See Upload files with SFTP.
  3. Rename the security plugin's folder, for example from example-security to example-security-off. WordPress deactivates the plugin.
  4. Sign in, fix the setting that blocked you, and rename the folder back. Then reactivate the plugin under Plugins.

Leave the plugin switched off for as short a time as possible.

Sign-in page keeps reloading or redirecting​

If the sign-in page reloads without an error, or sends you to the wrong address, check the site address settings. A wrong value often appears after moving the site or switching to HTTPS.

Add these lines to wp-config.php, above the line that says /* That's all, stop editing! */, using your real address:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

These override the WordPress Address and Site Address stored in the database. If WordPress is installed in a subfolder, WP_SITEURL must include that folder. Once you can sign in, correct the addresses under Settings > General and you can remove the two lines.

Clear cookies and cache​

WordPress uses browser cookies to keep you signed in. An old cookie or a cached page can stop the sign-in from working.

  • Clear cookies for your site, or try a private browser window.
  • If your site uses a caching plugin or CDN, clear its cache.
At DomainPilot

If you are locked out and none of these steps work, contact DomainPilot support with the support form. Never send passwords in a support request.

Did this article help you?