Locked out of WordPress admin: find which lockout you have and get back in

"Locked out" is a dozen different faults, and what you see on the login screen tells you which one you have. Find your row in the table below, then go to the section or the page it names. In every case your posts, pages and settings are where you left them.

Two things decide which fixes are open to you: whether WordPress can send you email, and whether you can reach the server, through SSH, SFTP or your host's file manager and database tool. If you have neither, your hosting company is the first call.

Which lockout do you have?

Go to your login page, usually https://example.com/wp-login.php, and try once. Then match what happened.

A security plugin may replace WordPress's own messages with one that does not say which part was wrong. If your message is not in the table, paste it into the error decoder, which says what it means and what to do first.

Reset a password without email

Try the ordinary way first. On the login screen, select "Lost your password?" and enter your username or email address. WordPress emails a link to the address on that user account, and by default the link works for one day.

If that email cannot reach you, set the password from the server. WordPress's page on resetting a password lists several methods and says the one you use depends on the access you still have. Start with these two.

With WP-CLI

WP-CLI is the command line tool for WordPress, and how to use WP-CLI covers connecting over SSH. Run the commands from the folder that holds wp-config.php. --skip-plugins and --skip-themes keep the plugins and the theme from loading, so a broken plugin cannot stop the command. Must-use plugins are still loaded.

With a database tool

WordPress's page gives a method for phpMyAdmin, and warns you to use it at your own risk. Export the database from the tool first, to your own computer. Then open the table whose name ends in users and edit the row for your account: clear the user_pass field, type the new password, choose MD5 in the function menu beside it, and select "Go". This statement does the same from the SQL tab, with your own table name and the ID of your row:

UPDATE wp_users SET user_pass = MD5('a-long-new-password') WHERE ID = 1;

WordPress still accepts a password stored this way, and stores it again in its current, stronger format the first time you log in with it.

If the only problem is that the account's email address is one you can no longer read, WordPress's documentation offers a shorter route: put your own address in user_email in that row, then use "Lost your password?".

How to take over a WordPress site when your web developer has disappeared goes through both methods step by step.

When the reset email does not arrive

What WordPress said after you asked narrows it down.

• "Check your email for the confirmation link, then visit the login page." WordPress handed the message to the server's mail program and got no error back. That is not the same as delivered.
• "The email could not be sent. Your site may not be correctly configured to send emails." The server did not take the message at all.

Check three things before you go further:

• The spam folder. The subject is the site's name in square brackets, then "Password Reset".
• Which address it went to. The link goes to the email address on the user account. That is separate from the Administration Email Address under Settings, then General, and it may be an old address of yours or a former colleague's.
• How long ago you asked. A link older than a day has run out. Ask for a new one.

The short route is not to wait. Set a new password from the server, as above. Then fix the mail, because the recovery link WordPress sends after a critical error travels the same way. How to fix WordPress not sending email has a two-minute test and the fix.

Find a moved login address

When wp-login.php answers "Page not found", a plugin has moved the login page. Your account is untouched. Only the way to the form is missing.

Look first where the address may be saved: your password manager, your bookmarks, your browser's history, anyone else who logs in. After that it depends on the plugin. WPS Hide Login's listing says it keeps the address in an option named whl_page, in the options table, or in the sitemeta table on multisite. This prints it:

wp option get whl_page --skip-plugins --skip-themes

Put the answer after your domain, as in https://example.com/the-answer/. If WP-CLI answers that the option does not exist, no address was saved under that name.

Failing that, switch the plugin off from outside, as in the next section. The same listing says that deactivating the plugin brings the site back to the state it was in before, and /wp-login.php answers again. How to change the WordPress login URL covers the other plugins that move the login page and what to do if the address is still refused.

Get past a security plugin's lockout

A plugin that limits login attempts counts failures from one address and then refuses that address for a set time. While the lockout runs, the right password is refused too. Limit Login Attempts Reloaded, for one, says "Too many failed login attempts." and how long to wait.

Start with what costs nothing.

• Wait. The message may say how long.
• Come from another address. The lockout is on your connection, not on your account. Limit Login Attempts Reloaded's listing suggests opening the site from your cell phone. Use mobile data, not the same Wi-Fi.
• Use the plugin's own way out, if it has one. Kadence Security's listing describes Magic Links, which let you log in while your username is locked out, if the feature was turned on beforehand. Its documentation also gives a line for wp-config.php, define('ITSEC_DISABLE_MODULES', true);, which turns the plugin's features off until you remove the line.

If none of those works, switch the plugin off from outside.

While the plugin is off, none of its protection is running, so do all four steps in one sitting.

If you are refused with the plugin off, the block is not in WordPress. WordPress's guide to brute force attacks describes limits set on the server or at a CDN, which answer before WordPress runs. How to fix the 403 Forbidden error shows how to tell who is refusing you and what to send your host. How to deactivate plugins when you are locked out has the other ways to switch one off, including through the database.

Recover from a lost second factor

Work down this list and stop at the first step that is open to you. The commands and screen names are those of the Two Factor plugin.

With another plugin, look for its own switch before you turn the whole thing off. Kadence Security's documentation gives a line for wp-config.php, define('ITSEC_DISABLE_TWO_FACTOR', true);, which turns off two-factor login and leaves its other features running. Remove the line as soon as you are in.

Then set the second step up again on the new phone and generate new codes. How to set up two-factor authentication covers that, and how to finish the last-resort route on a site with one administrator.

Restore an administrator

Use this when WordPress says your username is not registered, or when you can log in and the dashboard menu is nearly empty. An Administrator has access to all the administration features of a site. Every other role is refused some of its screens.

Without WP-CLI, another administrator can change your role on the Users screen, and the page for "Sorry, you are not allowed to access this page." shows how to set it in the database. An account that is gone altogether has to be created, so send your host the last command and ask them to run it.

An account does not lose its role or disappear on its own. Before you carry on, find out who changed it.

Rule out a break-in

These are not ordinary lockouts:

• Your password stopped working and you did not change it. When a password is changed from the dashboard, WordPress emails a "Password Changed" notice to the account's address. Look for one you did not cause.
• The email address on your account changed. WordPress sends an "Email Changed" notice to the old address.
• The site's Administration Email Address changed. WordPress sends an "Admin Email Changed" notice to the old address.
• Your account is gone, is no longer an administrator, or the list shows an administrator nobody can name.

WordPress's documentation counts behavior that nobody authorized, such as the creation of new users, among the clear signs of a hack, and notes that there are times when a bad actor will hijack an administrator account.

Ask first. Another administrator, your developer or your host may have made the change, and one message settles it.

If nobody did, getting back in is not the fix. Whoever changed the account had a way in, and a new password does not close it. Do not delete what you find. Follow the runbook for the first hour, then how to check whether your site has been hacked and what an unknown admin user means and how to remove it properly. WordPress's documentation says to change the passwords again once the site is clean.

Once you are back in

Fix what locked you out, then make the next lockout a short one.

• Close the cause. Put your address on the security plugin's allow list, repair the mail, set up the second step on the new phone, or save the moved login address in your password manager.
• Add a second administrator account. Go to Users, then Add User, and choose the Administrator role. Give it a different email address from the first, a long password of its own and its own second step. With two, one can let the other back in.
• Save backup codes for every administrator, somewhere other than the phone that holds the authenticator app.
• Check both email addresses. The one on your profile receives password resets. The Administration Email Address under Settings, then General, receives the recovery mode and critical error notices. Make sure you can read both.
• Test the reset email now. In a private window, select "Lost your password?" and see that the message arrives.

When to get help

Ask your host if you have no way into the files or the database. Most of the fixes on this page are one command or one renamed folder for someone with that access.

If a check in "Rule out a break-in" came back positive, you have a different job from a lockout. Follow the runbook linked there.

If it is a plain lockout and you would rather not edit a database or a server by hand, hand it over. Being locked out of your own site is one issue on one site, which is what our one-time fix covers. It starts with a free diagnosis that gives you a written cause and a fixed quote.