Locked out of wp-admin? How to get back into WordPress

01

Before you start: what access do you have?

Almost every fix below needs one of these: your hosting control panel, FTP or SFTP, phpMyAdmin, or SSH. If a former developer or agency set up the hosting and you have none of them, that's the first problem to solve. In this thread, an owner had their account email but no hosting, database, FTP or SSH access, and the reset email wasn't arriving. Without server access, the person who controls the hosting account has to act.

02

The reset email never arrives

The Reset your password guide starts with the "Lost your password?" link on the login page. It also warns that you may need other steps "especially if your email isn't working correctly."

A missing reset email usually means your site can't send mail that gets delivered. Check spam first. Then check your domain's SPF and DMARC records, since mail that fails them can be rejected or sent to spam. Our free email security check shows what your domain publishes.

If mail can't be fixed quickly, reset the password on the server.

With WP-CLI

The same guide gives two commands. List users to find your ID, then set a new password:

wp user list
wp user update 1 --user_pass='a-long-new-password'

Swap 1 for your user ID. The WP-CLI reference has the full options. Quote the password so the shell doesn't mangle special characters.

With phpMyAdmin

Open your WordPress database, browse the wp_users table (your prefix may differ), and edit your row. Replace the user_pass value with a new password, choose MD5 from the function dropdown, and save. The guide notes WordPress will accept the MD5 value and let you log in. Change the password again from your profile once you're in, so it's stored with a proper hash.

03

"Sorry, you are not allowed to access this page"

This means you logged in but your account has no admin rights. In one thread, it started after an owner removed a plugin's data by hand in the database and got the same message even from a new admin user. If you've edited the database, restore a backup from before the change. Otherwise check wp_usermeta for your user's capabilities entry, or ask a developer to, since a wrong edit there makes things worse.

04

A security plugin locked you out

Too many failed attempts can get your IP blocked by a security or firewall plugin. Waiting out the lockout often works. If it doesn't, rename that plugin's folder in wp-content/plugins/ over FTP. WordPress deactivates a plugin whose folder it can't find. Log in, rename it back, reactivate it, and remove your IP from its block list.

05

The login URL was changed

Plugins that hide wp-login.php behind a custom address leave you stuck if nobody wrote the address down. Renaming the plugin's folder brings the normal /wp-login.php back. The same works for a broken redirect. If the problem is the site address itself, the Common Errors page and the wp-config.php WP_HOME and WP_SITEURL constants are where to look.

06

Two factor codes go somewhere you can't reach

In this thread, a Jetpack login step sent a one time code to an address the owner didn't recognise. Start with the 2FA provider's own recovery route, such as backup codes. If that fails and you have FTP, renaming the plugin folder that adds the 2FA step removes it until you reactivate it. Set 2FA up again straight away afterwards.

07

"Cookies are blocked or not supported by your browser"

The full message is "Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress." It wears people down. Someone on WordPress Stack Exchange wrote in October: "I keep getting the enable cookies for Wordpress!! Very frustrating I have done everything I could have done". They were trying to log in to someone else's site, so the question got closed, but the frustration will sound familiar.

The WordPress Cookies page says WordPress uses cookies for authentication, so you must have cookies enabled to log in. When the browser allows them and the error stays, check these in order.

The browser

Allow cookies for your domain, clear existing cookies for the site, and try a private window with extensions off.

Caching or a CDN on the login page

A cached copy of wp-login.php can arrive without the test cookie WordPress sets. Exclude wp-login.php and /wp-admin/ from page caching in your caching plugin, your host's cache and any CDN, then purge the cache.

The site address doesn't match

If Settings > General says http:// and you log in over https://, or one uses www and the other doesn't, the cookie gets set for a different address than the one you're on. Make the WordPress Address and Site Address match the exact address in your browser bar. Without wp-admin, set them in wp-config.php:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

HTTPS

A broken or half configured SSL certificate can do the same thing, especially behind a proxy or CDN that handles HTTPS for you. Make sure every page loads over HTTPS without warnings.

08

Could it be a hack?

Be suspicious if your password stopped working without you changing it, or if your email address changed on the account. Watch for admin users you don't recognise in wp user list. The WordPress FAQ My site was hacked lists the creation of new users among clear signs of a hack. Read is my WordPress site hacked? before you start resetting things, so you don't wipe evidence.

09

Sources

• WordPress.org forum, "Broken WordPress Login URL, Unable to Access Website Editor"
• WordPress.org forum, "Locked out of WordPress admin; password-reset email is not sending"
• WordPress.org forum, "Can't access wp-admin"
• WordPress.org forum, Jetpack 2FA thread
• WordPress Stack Exchange, "Enabling cookies"
• Reset your password
• WP-CLI user update
• Cookies (Advanced Administration)
• Common WordPress Errors
• FAQ My site was hacked