Lavkush If you cannot log in to WordPress admin, you can almost always get back in without reinstalling anything: try the password reset email first, clear your browser cookies or use an incognito window, check you are on the correct login URL, and — if those fail — reset your password directly in the database through phpMyAdmin, disable a faulty plugin or security tool via FTP, or restore login access by fixing your site URL settings. Being locked out feels terrible because the dashboard is where all the fixes normally live, but WordPress keeps several back doors open for exactly this emergency. Work through the seven methods below in order, from the gentlest to the strongest, and stop as soon as one lets you in.
A lockout usually strikes at the worst moment — a client waiting, an update half-finished, coffee going cold. Take one slow breath. Your content is still there, your site is probably still online for visitors, and this problem has well-trodden solutions. Let us open the door.
Way 1: Use the Password Reset — Properly
Start with the obvious, because it works more often than pride admits. On the login page, click “Lost your password?”, enter your username or the admin email address, and follow the link that arrives by email. The official WordPress guide to resetting your password covers this and the stronger methods below, and it is worth keeping open while you work.
Three small traps hide here. The reset email may land in spam. The link expires, so use the newest email, not an old one from yesterday's attempts. And if several admins share the site, make sure you are resetting your account, not kindly locking a colleague out of theirs. If no email arrives at all, do not keep clicking — that points to a mail or account problem, and Way 5 will fix it directly.
Way 2: Clear Cookies, or Try a Different Browser
WordPress login depends on cookies. If your browser holds an old, damaged login cookie, the site can bounce you back to the login page forever, in a polite but maddening loop: correct password, page refreshes, login form again. Clear cookies for your site only — your browser settings let you search for your domain and delete just its cookies — then try again. Faster test: open an incognito or private window and log in there. If incognito works, cookies or a browser extension were the problem, and no server surgery is needed at all.
Also double-check the simple human things, because every support technician has lived them: Caps Lock off, the right keyboard language, no extra space copied at the end of the password, and the correct site — many of us manage a live site and a test site, and their passwords are never the ones we type.
Way 3: Check You Are Using the Right Login URL
The standard login addresses are yoursite.com/wp-login.php and yoursite.com/wp-admin, which redirects you to login when you are signed out. But security plugins can move the login page to a custom address like yoursite.com/secret-door, and after a few months it is very easy to forget your own secret door. The WordPress.org Login Trouble guide lists this and other classic causes of login failure, including URL mismatches after a site move.
If your site was recently moved or its domain changed, the old URL settings can send the login form to the wrong place. That connects to a bigger topic: moves create several small mismatches like this, and our step-by-step guide to moving a WordPress site to a new host shows how to check URLs after a migration so problems like this do not keep returning.
Way 4: Disable Plugins Through FTP or the File Manager
A faulty security, login or caching plugin can lock everyone out after an update. You cannot deactivate it from the dashboard — that is the whole problem — but you can switch it off from outside. Connect with FTP or your hosting file manager, open wp-content/plugins, and rename the suspicious plugin's folder, for example from security-plugin to security-plugin-off. WordPress cannot find it, deactivates it automatically, and very often the login page starts working immediately.
Not sure which plugin? Rename the whole plugins folder to plugins-off and create a new empty plugins folder. If login works now, move plugin folders back one at a time until it breaks again — the last one back is the culprit. The same rename trick rescues sites from worse crashes, as shown in our guide to fixing the critical error in WordPress.
Way 5: Reset the Password Directly in the Database
When email reset fails, go straight to the source. In your hosting control panel, open phpMyAdmin, select your site's database, and find the wp_users table (the prefix may differ, like wp2_users). Find your username row and click Edit. In the user_pass field, choose MD5 from the function dropdown, type a new strong password in plain text, and save. phpMyAdmin converts it safely, and you can log in with the new password straight away.
Table: wp_users
Field: user_pass
Function: MD5
Value: your-new-strong-passwordRead that table name twice before editing — you want your live database, not a leftover test one. And once you are back in, change the password again from your profile page, so it is stored exactly the way WordPress prefers.
Way 6: Create a New Admin User via functions.php
If your old admin account itself seems damaged, make a fresh one. Using FTP or the file manager, open your active theme's functions.php and add this code at the end:
add_action( 'init', function() {
if ( ! username_exists( 'newadmin' ) ) {
$uid = wp_create_user( 'newadmin', 'StrongPass123!', 'you@example.com' );
$user = new WP_User( $uid );
$user->set_role( 'administrator' );
}
} );Visit your site once, then log in with the new account. Important: delete that code from functions.php immediately afterwards. Leaving account-creating code on a live site is like leaving a spare key under the mat with a sign pointing to it.
Way 7: Check the Site URL and .htaccess
Finally, if the login page itself behaves strangely — endless redirects, a page that will not load, or a 404 — check the foundations. In phpMyAdmin, the wp_options table holds siteurl and home; both should show your correct domain, with the correct http or https. A wrong value there can make login chase its own tail. You can also regenerate a broken .htaccess file: rename the old one, and if the site loads, go to Settings > Permalinks in the dashboard and simply press Save to create a clean new one.
| Symptom | Try first |
|---|---|
| Password rejected, no email problems | Way 1, then Way 5 |
| Login page loops back to itself | Way 2 — cookies |
| Login page is a 404 | Way 3 and Way 7 |
| Locked out right after an update | Way 4 — rename plugins |
| Reset email never arrives | Way 5 — database reset |
Frequently Asked Questions
Why does WordPress keep sending me back to the login page?
That loop is usually a cookie problem or a wrong site URL. Test in an incognito window first; if it works there, clear your site's cookies in your normal browser.
Is editing the database dangerous?
It needs care, not fear. Change only the user_pass field of your own row in wp_users, using the MD5 function in phpMyAdmin, and take a backup first if your host offers one-click backups.
Can my hosting company help me get back in?
Yes. Good hosts reset admin passwords or disable plugins for customers every day. If FTP and phpMyAdmin feel overwhelming, ask them — that is literally what support is for.
How do I avoid being locked out again?
Keep a second admin account with a strong password, store credentials in a password manager, keep your admin email current, and note down any custom login URL your security plugin creates.
What if I suspect someone else changed my password?
Get in first using Way 5, then change every admin password, check the user list for accounts you do not recognise, and run a security scan before doing anything else.
Conclusion
Being locked out of WordPress feels like being locked out of your own house, but there are seven doors and windows to try — and one of them is almost always open. Start gentle with the reset link and cookies, move to plugin renames and the database only if needed, and once you are back inside, tidy up passwords and admin accounts so the next login is boring. Boring logins are the best logins.
Leave a Comment