Locked Out of WordPress Admin: How to Get Back In

You cannot access your WordPress admin panel. The login page is returning an error, your password is not working, a security plugin has locked you out, or the /wp-admin URL is not loading at all.

Here is how to get back in. The fix depends on why you are locked out — work through these in order. If the lockout started after a plugin update broke your site, or you are staring at a white screen, fix that first — admin access often returns once the site loads again.

Reason 1 — Forgotten Password

The simplest lockout, and usually the quickest to fix.

On the WordPress login page at yourdomain.com/wp-admin, click "Lost your password?" Enter your email address and WordPress will send a reset link. Click the link in the email and set a new password.

If the password reset email does not arrive, check your spam folder. If it is not there, your site may have an email delivery problem — move to the database method below.

Reset via phpMyAdmin if email is not working: log into your hosting control panel and open phpMyAdmin. Select your WordPress database and click the wp_users table. Find your admin user, click Edit, and change the user_pass field. Select MD5 from the function dropdown and type your new password in the value field. Click Go. Your password is now reset to whatever you typed. WordPress upgrades the MD5 value to a stronger hash the first time you log in. If your tables don't start with wp_, look for the one ending in _users.

Reason 2 — Blocked by a Security Plugin

Wordfence, Kadence Security (formerly iThemes Security), and similar security plugins block login attempts after a set number of failures. If you entered the wrong password too many times, your IP address may be blocked.

The quickest fix: try logging in from a different network — your mobile phone on cellular data, not your home WiFi. If that works, your home IP is blocked, not your account.

To unblock your IP permanently, connect via SFTP and deactivate the security plugin by renaming its folder in wp-content/plugins/ with -disabled added to the end. Log into WordPress, go to the security plugin settings, and whitelist your IP address before reactivating the plugin.

Alternatively, if your host provides cPanel or Site Tools access, check whether the security plugin has written block rules to your .htaccess file. Opening the file in a text editor will show any IP-blocking rules recently added.

Reason 3 — The Login Page Is Returning an Error

If yourdomain.com/wp-admin loads but returns an error instead of the login form, the cause is usually one of three things.

Redirect loop — the login page is redirecting to itself repeatedly. Usually caused by a misconfigured plugin or a caching problem. Clear your site cache via your caching plugin or hosting panel. If that does not help, connect via SFTP and rename your plugins folder to plugins-disabled. Clear your browser cookies and try again.

Too many redirects error in your browser — same cause as above. Clear browser cookies and site cache first. If the problem persists, check whether your wp-config.php defines WP_HOME and WP_SITEURL. If it does, both should match your actual domain exactly, including https and www.

Critical error message — a PHP error is preventing the login page from loading. Since WordPress 5.2, the site admin may get an email with a recovery mode link that lets you log in and deactivate the plugin causing it. Otherwise, in wp-config.php set WP_DEBUG and WP_DEBUG_LOG to true and WP_DEBUG_DISPLAY to false, then read the error in wp-content/debug.log. Our white screen guide walks through the rest of the fix.

Reason 4 — Account Was Deleted or Compromised

If your admin account has been deleted or the password changed without your doing, your site may have been hacked. See our guide on what to do when a WordPress site is hacked for the full incident response sequence.

Create a new admin account via phpMyAdmin:

Open phpMyAdmin in your hosting panel. Select your WordPress database. Click the wp_users table and click Insert. Fill in the following fields:

• user_login: choose a new admin username

• user_pass: choose a password, select MD5 from the function dropdown

• user_email: your email address

• user_registered: today's date in YYYY-MM-DD format

• user_status: 0

Click Go to create the user. Note the ID number assigned to the new user.

Now click the wp_usermeta table and click Insert. Add two rows:

Row 1: umeta_id (leave blank), user_id (the ID from above), meta_key: wp_capabilities, meta_value: a:1:{s:13:"administrator";b:1;}

Row 2: umeta_id (leave blank), user_id (the ID from above), meta_key: wp_user_level, meta_value: 10

If your tables use a prefix other than wp_ (for example abc_), use that prefix in the meta_key names too, such as abc_capabilities and abc_user_level. Click Go. You can now log in with your new admin account.

If your account was compromised, treat the site as hacked — change all passwords, audit your user list for unknown accounts, and scan your files for malware before doing anything else.

Reason 5 — The /wp-admin URL Is Not Loading at All

If yourdomain.com/wp-admin returns a 404 or does not load, the cause is usually a broken .htaccess file or a WordPress installation issue.

Reset your .htaccess file: connect via SFTP, find the .htaccess file in your WordPress root directory, and rename it to .htaccess-old. WordPress will regenerate a clean .htaccess file on the next page load. Try accessing /wp-admin again.

If that does not help, replace your WordPress core files with clean copies from wordpress.org without touching wp-content or wp-config.php — a corrupted core file can prevent the admin panel from loading.

If None of These Work

If you have worked through all five reasons and still cannot access your WordPress admin panel, the issue is likely a database connection problem or a corrupted WordPress installation that requires deeper diagnosis.

At this point the quickest route is usually professional help or a full restore from backup. WPOPS guarantees a response within 1 hour on every plan. If you are locked out and need to get back in fast, get in touch via our emergency support page.

How to Prevent Getting Locked Out Again

Two habits prevent many WordPress lockouts.

Keep a secondary admin account — create a second administrator account with a different email address and store the credentials somewhere secure. If your primary account is ever compromised or deleted, you have an immediate fallback.

Use a backup before making changes — any time you update security plugins, change login settings, or add new admin users, having a recent backup means you can restore to a known working state if something goes wrong. Test risky changes on a staging environment first when you can.

Every WPOPS care plan includes daily off-site backups and security monitoring — the combination that catches the account changes and suspicious logins that often precede a lockout before they escalate. That is the same foundation as solid WordPress maintenance: prevent the lockout, or recover from a known-good backup when you cannot.

Frequently Asked Questions

How do I get back into WordPress if I forgot my password?

Go to yourdomain.com/wp-admin and click 'Lost your password?' Enter your email address and WordPress will send a reset link. If the email does not arrive, you can reset your password directly via phpMyAdmin — open your wp_users table, find your account, click Edit, set a new password value with MD5 selected as the function, and click Go.

How do I access WordPress admin if I am blocked by a security plugin?

Try logging in from a different network first — your mobile phone on cellular data rather than your home WiFi. If that works, your home IP is blocked. Connect via SFTP, rename the security plugin's folder in wp-content/plugins/ to deactivate it, then log in and whitelist your IP address in the plugin settings before reactivating it.

How do I log into WordPress without the login page?

If the login page itself is broken, you can create a new admin account directly in your database via phpMyAdmin. Open your WordPress database, insert a new row in wp_users with administrator credentials, then add the corresponding capability and user_level rows in wp_usermeta (matching your table prefix if it isn't wp_). You can then log in with the new account.

Why is my WordPress admin login redirecting in a loop?

A redirect loop on the login page is usually caused by a misconfigured plugin or caching problem. Clear your site cache and browser cookies first. If that does not help, deactivate all plugins via SFTP by renaming the wp-content/plugins/ folder, then check your wp-config.php for incorrect WP_HOME or WP_SITEURL values.

What should I do if my WordPress admin account was hacked?

Create a new admin account via phpMyAdmin immediately. Then treat the site as compromised — audit your user list for unknown accounts, change all passwords and WordPress security keys, scan your files for malware, and check your recent login history. A hacked admin account can mean malware has already been installed, so check before you assume the site is clean.

How do I prevent being locked out of WordPress admin?

Keep a secondary admin account with a different email address as a fallback. Store credentials for both accounts securely outside WordPress. Whitelist your IP address in any security plugin you use. And maintain daily off-site backups so you can restore to a known working state if a lockout or compromise cannot be resolved directly.

By Manny — Founder, WPOPS