Locked Out of WP-Admin? Five Ways Back In

September 7, 2026

Locked out of WP-Admin and recovering access to WordPress

Updated for WordPress 7.1 and PHP 8.3 — 7 September 2026.

Being locked out of wp-admin is nearly always recoverable without touching your content, and which method you need depends on why you are locked out rather than how urgent it feels. A forgotten password, a rate limit you triggered yourself, an email address you no longer control and a hacked account all look identical from the login screen and need completely different fixes. Work out which one you have before you start changing things.

Start with the password reset link

The built-in reset works whenever you still control the account’s email address, and it is the only method that requires no server access at all. Click “Lost your password?” on the login screen and follow the emailed link — WordPress documents the whole flow in resetting your password.

If the email never arrives, do not immediately assume the account is broken. Site email is unreliable by default, and a WordPress install that cannot send a password reset usually cannot send anything else either — the same underlying fault that stops contact form emails arriving. Check your spam folder, then move to a method that does not depend on email.

Reset the password over WP-CLI

With SSH access this takes one command and bypasses email entirely. First find the account, using wp user list:

wp user list --field=ID,user_login,user_email,roles

Then set a new password, identifying the user by ID, login or email address:

wp user update 1 --user_pass='a-long-unique-password-here'

The WP-CLI user update documentation confirms both the flag and that any of those three identifiers work. Two practical notes: wrap the password in single quotes so your shell does not interpret symbols inside it, and be aware the password will sit in your shell history in plain text — clear it afterwards, or set it once and change it from the dashboard.

If no account has an administrator role any more, create one with wp user create rather than trying to repair the old record. The role name must be exact — the roles and capabilities reference lists them:

wp user create recovery you@example.com --role=administrator

Log in with it, fix the original account from the dashboard, then delete the recovery account. Leaving spare administrator accounts lying around is how a temporary fix becomes a permanent liability.

You may have triggered a login rate limit

If the password is definitely correct and the form simply refuses you, a security layer is probably blocking your IP address rather than rejecting your credentials. Login rate limiting is standard on managed hosts and in security plugins, and repeated failed attempts while you tried to remember the password will trip it.

The giveaway is that the site loads fine everywhere else and the block follows you rather than the browser. Test on mobile data with wifi off — a different IP address. If you can suddenly reach the login screen normally, you have found your answer, and the fix is waiting for the block to expire or asking your host to clear it.

When the email address on the account is wrong

An account whose email you no longer control cannot be recovered by email, so change the address directly instead. Over WP-CLI:

wp user update 1 --user_email=you@example.com

This is a common situation after taking over a site from a previous developer or agency, where the administrator account still points at somebody who left two years ago. Fix the address first, then reset the password normally — and while you are there, audit the other accounts for the same problem.

Rule out a plugin breaking the login screen

If the login page errors, redirects in a loop, or renders blank, the problem is code rather than credentials. Security plugins, two-factor plugins and anything that customises the login URL are the usual suspects, particularly straight after an update.

Deactivate plugins without the dashboard, either over WP-CLI with wp plugin deactivate:

wp plugin deactivate --all

or by renaming wp-content/plugins to plugins-off over SFTP, which has the same effect because WordPress can no longer find them. If the login screen returns, reactivate one at a time to identify the culprit. When a WordPress site is down after an update covers that isolation process in more detail.

A plugin that changes your login URL deserves special mention, because it does not break anything — it just moves the door. If you inherited the site, the login page may simply be somewhere other than /wp-admin, and no amount of password resetting will help until you find where.

Consider that you might be locked out deliberately

If your administrator account has been demoted, deleted, or its email changed without you doing it, treat this as a compromise rather than a lockout. Regaining access is not the end of that job; it is the start of it.

Get back in, then change all administrator passwords, force logout of every active session, review the user list for accounts you do not recognise, and check when files were last modified. Restoring from a backup taken before the compromise is often cleaner than trying to find everything that was changed — though be careful that the backup itself predates the intrusion, which is not always the same as predating the symptoms.

Frequently asked questions

Can I reset a WordPress password directly in the database?

You can, but WP-CLI is safer and does the hashing for you. WordPress stores passwords hashed, so pasting plain text into the database will not work — and a mistake in a manual query on wp_users is easy to make and hard to undo. Use wp user update where you have SSH.

Why does the reset email never arrive?

Because most WordPress installs send mail directly from the web server by default, and that mail is routinely filtered or blocked. It is the same root cause as contact form failures. Use WP-CLI instead, then fix email delivery properly.

I get “too many failed login attempts”. How long does it last?

It depends entirely on the plugin or platform enforcing it, typically minutes to an hour. Confirm it is an IP block by trying from mobile data, then either wait it out or ask your host to clear it.

Is renaming the plugins folder safe?

Yes. WordPress deactivates plugins it cannot find, and renaming the folder back restores the files. Settings are kept in the database, so nothing is lost — but reactivate one at a time rather than all at once, or you will not learn which one broke.

Should I delete the recovery admin account afterwards?

Yes. Every administrator account is attack surface, and a spare one created during an emergency is exactly the sort of thing nobody remembers to remove.