Locked Out of Your WordPress Admin? How to Get Back In Safely

If you are locked out of your WordPress admin, start with the "Lost your password?" link on the login page and check your spam folder for the reset email. If that fails, ask another administrator to reset your account, and if there is none, use the WordPress tools in your hosting control panel where your host offers them. Database and file-level resets exist, but they are developer tasks.

This guide is for an owner whose developer is unavailable. Nothing in it asks you to edit code, touch the database or delete files. Entrant Technologies builds websites and web applications, including WordPress development, and these are the steps we would want an owner to take first.

Why can't I log in to my WordPress admin?

Usually one of six things has happened, and the login screen's own message tells you which.

You forgot the password. The reset email never arrives. The only administrator left the company and the account is tied to their mailbox. A security plugin or the host's firewall blocked your IP address after failed attempts. The phone holding your two-factor codes is lost. Or an attacker changed or removed your account. The first five are access problems; the last is a security incident and needs a different response.

What can I safely check in about 10 minutes?

You can work out which kind of lockout you have without changing anything.

1. Write down the exact message on the login screen and the time. "Incorrect password", "unknown username", a blocked page and a request for a code are different problems.
2. Open the login page on a phone using mobile data. If it loads there but not on the office network, your office IP address is blocked.
3. Open the public site in a private browser window and note whether it looks normal.
4. Search your inbox and spam for emails from the site and the host: reset emails, security alerts, and notices of changes you did not make.
5. Confirm which email address your admin account uses and who can read that mailbox.
6. Ask colleagues and your agency whether anyone else has an administrator login.
7. Log in to your hosting control panel and note whether it has a WordPress section.

How do I get back in to WordPress, and in what order?

Use the supported routes in this order: the lost-password link, another administrator, then the host's WordPress tools. The official WordPress "Reset your password" documentation says the easiest way is normally the "Lost your password?" link, and that the method depends on the access you still have.

1. The "Lost your password?" link

Click it, enter your username or the email address on the account, and WordPress emails that address. Request it once, wait a few minutes and check spam. If nothing arrives, the site may not be sending email; the WordPress General Settings documentation advises contacting the hosting provider when site emails do not arrive. If the mailbox belonged to a former employee on your company domain, ask whoever manages company email for access to it, then repeat the request.

2. Another administrator

Any administrator can set a new password for you under Users, All Users. They can also clear a lost two-factor device: the WordPress.org Two-Factor plugin page says that if you lose every authentication method you should contact your site administrator, who can switch off two-factor on your profile. As of October 6, 2026, that plugin also issues 10 one-time backup codes, so check whether you saved them.

3. The host's WordPress tools

Some control panels can sign you in without your WordPress password. Plesk's WP Toolkit documentation describes a Log in button that logs you in to WordPress as an administrator. Hosts decide whether to offer such a tool, so yours may not have one. For an IP block, ask the host's support team whether their firewall is blocking your address.

How do I know if the lockout is really a hack?

Treat it as a hack if your account details changed without you. A password that stops working is weak evidence on its own. Stronger signs are a username or email that is no longer recognized, a notice about a change you did not make, content or redirects you did not add, or a site the host has suspended.

The WordPress "My site was hacked" FAQ lists a host-disabled site, a search engine blacklisting and unauthorized new users among clear indicators of compromise. If you see any of these, stop trying to log in. The FAQ advises documenting what you see and when, and checking with your hosting provider. Getting your password back does not remove what an attacker left behind.

What should I not do when I am locked out of WordPress?

Do not do anything that cannot be undone, and do not keep guessing.

• Do not try passwords repeatedly. Failed attempts are what trigger IP blocks.
• Do not edit the database or files from a tutorial. WordPress labels its own phpMyAdmin method "use at your own risk".
• Do not upload a password reset script. WordPress warns that its emergency script must be deleted afterwards, because someone else could use it to change your password.
• Do not delete or rename plugin folders, restore a backup or reinstall WordPress yourself.
• Do not send passwords by email or chat.

When should I call a developer, and what should I have ready?

Call a developer when the three supported routes fail, when a security plugin is blocking you, or when you see any sign of a hack. The remaining methods in the WordPress documentation are the MySQL command line, phpMyAdmin, FTP, WP-CLI and the emergency script. Each changes the database or the site's files directly, so they belong with someone who can also check for damage.

Have this ready:

• The exact login message, when it started and what you have tried.
• The admin username and the email address on the account.
• Who else has, or had, administrator access.
• Working access to the hosting control panel.
• The names of any security or two-factor plugins, and any emails from the site or host.

How do I stop getting locked out again?

Keep two administrator accounts held by two named people, so one can always reset the other. Use a shared company mailbox that outlives any employee as the site's Administration Email Address; WordPress sends recovery mode and critical error notices there and recommends verifying that it points to an address your organization can access.

Also save two-factor backup codes in the company password manager, and review the user list when someone leaves. Our web application security checklist covers access control in more depth.

Quick answers

How do I reset my WordPress admin password?

Click "Lost your password?" on the WordPress login page, enter your username or account email, and follow the email WordPress sends. WordPress documents this as normally the easiest method.

Why am I not getting the WordPress password reset email?

It went to spam, it went to a mailbox you no longer control, or the site is not sending email. Check spam, confirm which address is on the account, then ask your hosting provider.

What if the only WordPress administrator has left the company?

If their account uses a company email address, get access to that mailbox and use the lost-password link. Otherwise use your hosting control panel's WordPress tools if it has them, or ask a developer.

I lost my two-factor phone. How do I log in to WordPress?

Use a saved backup code if your two-factor plugin issued them. If you have none, another administrator can switch off two-factor on your user profile.

How can I tell a WordPress lockout from a hack?

A forgotten password or an IP block is an access problem. An unrecognized username, account changes you did not make, unknown new users or a suspended site point to a hack; contact your host and a developer.

Conclusion

Most WordPress lockouts are solved by the lost-password link, a second administrator or the host's own WordPress tools, in that order. Leave database and file methods to a developer, and treat changed account details or an altered site as a security incident, not a password problem.

If you have no developer available, you can contact Entrant Technologies and we will take a look.