WordPress forgot admin password and how to get back in

WordPress has a working reset built in, and in most cases it takes a couple of minutes. It works when three things are true: you know which account you are resetting, the email reaches you, and the reset page loads without interference. Lockouts that go on for days nearly always mean one of those three has failed, not the password.

So treat this as a diagnosis. Start with the standard reset. If it fails, find out why before you try something heavier. If the problem turns out to be a login that rejects you even though your password is correct, our guide to fixing a WordPress login by symptom covers that separately.

What “Lost your password?” actually does

It emails you a link to set a new password. It does not send your old password or a new one. WordPress’s Developer Handbook describes this as the standard recovery route and the one to try first.

1. Go to your site’s login page, usually yoursite.com/wp-login.php or yoursite.com/wp-admin.
2. Click “Lost your password?” under the form.
3. Enter the username or the email address on your WordPress user account. The site name and your display name will not work.
4. Open the newest email you receive and click the link. Choose a new password and save it in a password manager.
5. Log in with the new password in a private browser window to check that it works.

Ask for one link and wait. WordPress checks each link’s reset key against your account, and a newer request can make older links stop working. If you click the form five times while the mail is slow, you get five emails and only one link that still works.

Why the reset usually fails before the password does

Nobody publishes data on how often each failure happens. In WordPress.org and Reddit support threads, the same causes come up again and again, roughly in the order below.

The email never arrives

When WordPress says the email was sent, it means the site passed the message to its mail system. It does not mean the message was delivered. WordPress’s troubleshooting FAQ explains that it sends mail through PHP’s mail() function, so a badly configured server or sender address can stop delivery completely. Many cheap hosts and every local development site have this problem.

Check spam and any other inboxes you use. Then confirm which address is on the account. If you inherited the site from a developer or agency, the admin account often points to their old mailbox, and no number of retries will change that. If the address is right and nothing arrives, ask your host to check the outgoing mail log. On a WooCommerce store, don’t rely on WooCommerce’s email log for this. WooCommerce’s email troubleshooting docs send you to your SMTP provider’s logs or a mail-logging plugin instead.

Fixing mail delivery for good, with an SMTP plugin connected to a real sending service and a test email, usually needs you to be logged in. So while you are locked out, the faster route is often to skip email and reset another way (see below).

WordPress doesn’t recognise the username or email

The messages are “The email address provided is not associated with a user account” or “The username … is not registered on this site.” The usual cause is that the address you are using receives the site’s notifications but does not belong to an administrator account. WordPress keeps these separate. The address under Settings, General is the site’s contact address, and each user has their own email address on their profile.

Other causes are a username that was changed, a migration that brought over a different user table, or a staging copy that you have mistaken for the live site. To see which accounts really exist, you need a second administrator or access through your host (the WP-CLI and database routes below).

The reset link says it is invalid or expired

“Your password reset link appears to be invalid. Please request a new link below.” Request one fresh link and use it straight away. If you still get the error, look at the reset URL, not your password.

The most common hidden cause is caching. If your host, a caching plugin or a CDN caches the reset page, the key in your link never reaches WordPress. In one WordPress.org thread about WPS Hide Login, the invalid links stopped as soon as WP Engine’s support team added action=rp to the site’s cache exclusions. Other causes people report are switching between www and non-www or between HTTP and HTTPS partway through, old cookies, and custom login or membership plugins that take over the reset form.

/wp-login.php returns a 404 or a blocked page

A 404, a redirect to the homepage or a “blocked” screen means you never reached WordPress’s login. That is not a password problem. Login-hiding plugins such as WPS Hide Login move the login page to a custom address. Use that address, and the lost-password page that goes with it.

If nobody remembers the custom address, WPS Hide Login’s documentation describes two ways out, and both need hosting access. You can look up the whl_page option in the database, or you can temporarily rename or remove the plugin’s folder in wp-content/plugins so the default login page comes back. Put the plugin back afterwards. Security plugins that limit logins by IP address or require a secret word cause the same kind of lockout, and the fix is the same: whoever controls the hosting disables the plugin for a few minutes, or the host does it for you.

You are trying the wrong login

WordPress sites often involve several separate accounts, and people mix them up:

• Your hosting control panel login is not your WordPress admin login.
• A WordPress.com account is separate from a self-hosted site. WordPress.com has its own account recovery process.
• Your WordPress.org forum account cannot reset your site’s password.
• WooCommerce’s docs say the mobile app can sign you in with a WordPress.com account or with your site’s own credentials. Test your password on the site’s login page first.
• A customer resetting their password on a WooCommerce “My Account” page is not an admin reset.

How to reset the password without email

All of these routes need access to the hosting behind the site. Go down the list and stop at the first one that works. Each step down is more powerful and easier to get wrong.

1. Use your host’s tool or ask support

Many managed hosts have a “change admin password” option in their WordPress management screen. Where they don’t, the host’s support team can often reset the password from a ticket once they have confirmed you own the account. If mail is broken, this is often faster than trying to fix mail first. It is the safest route for a non-technical owner because nothing on the site has to be edited by hand.

2. Reset with WP-CLI over SSH

WordPress’s Developer Handbook recommends WP-CLI for a technical reset. Connect over SSH and go to the folder that contains wp-config.php. If the server hosts more than one site, run wp option get siteurl to make sure you are working on the right one. Then list the administrators:

wp user list --role=administrator

Choose the account by its exact username or ID. Don’t assume the admin is user 1, because many inherited sites deleted the original admin long ago. To set a password you choose yourself, run:

wp user update USERNAME --prompt=user_pass

This asks for the password at a prompt, so it never appears in your shell history. Some guides suggest --user_pass='newpassword' instead, but that saves the password in plain text in your history file. The other option is wp user reset-password USERNAME --show-password, which creates a password and prints it on screen. Treat that output as sensitive and keep it out of screenshots and tickets.

3. Edit the database in phpMyAdmin as a fallback

Use this when you can open the database through your hosting panel but have no SSH access. The Handbook gives the steps and says to back up first. Export the database and download the file before you change anything. Our guide to backing up a WordPress site explains what a backup you can restore should contain.

1. Open wp-config.php and check the database name and $table_prefix. The prefix is often not wp_.
2. In phpMyAdmin, open yourprefix_users and find your row. Check user_login and user_email, not just the ID.
3. Click Edit. In the user_pass row, set the Function dropdown to MD5 and type a temporary password in the Value field.
4. Click Go, log in, and then change the password again from your profile in wp-admin.

The most common mistake is forgetting to choose MD5. If you do, the column holds plain text that WordPress will never accept. One WordPress.org support thread was solved by doing exactly that step. The Handbook describes the MD5 value as temporary: WordPress replaces it with its own hash after you log in successfully. That is why you should change the password again from inside wp-admin once you are back in.

4. Theme code or the emergency script, only as a last resort

WordPress.org’s reset guide still documents two methods that only need file access over FTP. One is a line of code in the theme’s functions.php. The guide warns that this code resets the password every time a page loads, until you remove it. The other is an emergency reset script that you upload to the site’s root folder, and the guide says to delete it when you are done. Both leave a password in a file on a live server, so they are risky if anyone forgets to clean up. If you have to use one, remove the code or file in the same sitting, then check that it has really gone.

What if the reset worked and login still fails?

Then something other than the password is wrong. Go through these in order, because the first ones take the least time:

• Exact username and case. Passwords are case-sensitive. Try the user_login value rather than your email address.
• A clean browser session. Use a private window or clear the site’s cookies. An old session cookie can make a good password look wrong.
• The same address throughout. Mixing www and non-www, or HTTP and HTTPS, can bounce you back to the form. Check that the site address and WordPress address match.
• Login and security plugins. Too many failed attempts can block your IP, and from the outside that looks exactly like a wrong password. Disable the plugin by renaming its folder, test, then put it back.
• Your role. If you get in but see “You do not have sufficient permissions to access this page,” the account may no longer be an administrator. That is a separate fix, done in the database or with WP-CLI.

Don’t add another method on top of one that has not worked. A half-finished database edit plus a theme snippet is harder to undo than one attempt that failed cleanly.

When to stop and get help

Stop if you have only the login page. Every route above needs either the account’s email or access to the hosting. Without either, you cannot reset the password from inside WordPress. A WordPress.org moderator said the same thing in a recent thread: the owner has to get hosting access or contact the host. WordPress.org’s own support cannot reset a self-hosted site’s password.

That makes it a question of ownership. Find out who pays for the hosting and the domain, because whoever pays can usually get the hosting account back from the host. If you are a freelancer and the client cannot prove they have legitimate access, work through the client and the host. Don’t look for a way around the login. Be wary of anyone who offers to “get you in” through an unusual sign-in flow. Practitioners report fake client requests used to hijack accounts.

Also stop if the reset keeps failing for reasons you can’t see: a reset loop that clearing the cache doesn’t fix, a plugin that takes over the reset form, or two-factor codes that never arrive. That is a troubleshooting job. If you would rather not do it yourself, SiteSelf takes on WordPress troubleshooting work like this through chat. While you are locked out of wp-admin, it needs hosting (SSH) access to reach the site, and it cannot recover a hosting account you don’t hold.

What to do once you are back in

Check the email address on your profile first. It should be a mailbox you control, not a former contractor’s. Then set things up so the next lockout takes two minutes instead of two days:

• Set up an SMTP plugin with a real sending service and send a test email. Then you will know a reset email can actually be delivered.
• Add a second administrator with a different email address, held by someone you trust.
• Write down who owns the hosting account, the domain and the login details for each.
• Give collaborators their own user accounts instead of sharing yours, and remove admin accounts nobody can explain.
• Delete any reset code, emergency script or database export left on the server.

If you find admin users you did not create, or files you don’t recognise, treat it as a possible break-in rather than a lockout. Read what to do when a WordPress site is hacked before you go any further.