Locked out of WordPress admin: how to get back in when the reset email never comes

Being locked out of WordPress admin means the login page at /wp-admin will not let you in and the normal "Lost your password?" link does not fix it. It is one of the most common problems reported by business owners on the WordPress.org support forums, and it usually happens after the person who built the site leaves. The good news is that WordPress almost never locks the real owner out for good. The fix depends on one question: do you, or someone who works for you, still control the hosting account? This guide explains what you are seeing, what you can safely check yourself, and the exact steps a host or developer can follow.

What you are seeing and what it usually means

Most lockouts come from one of six causes, and the screen you see tells you which one. Find your symptom in the table, then read the matching section.

One more pattern is worth naming. If you can log in but the site shows "There has been a critical error on this website", that is not a lockout. It is a broken plugin or theme, and our guide to the WordPress critical error covers it.

Safe checks you can do yourself

These six checks cannot damage your site, and between them they solve a large share of lockouts. Do them in order.

1. Make sure you are on the right login page. It is usually yourdomain.com/wp-admin or yourdomain.com/wp-login.php. Some security plugins move it to a custom address. Search your old emails for "wp-admin" or "login" to find a link the developer sent you.
2. Try your email address instead of a username. WordPress accepts either on the login form.
3. Check the spam and junk folders of every address you might have used, for an email with "Password Reset" in the subject.
4. Clear cookies for the site, or open a private browser window, and try again. This fixes many login loops.
5. Try from your phone on mobile data, not your office Wi-Fi. If that works, your office IP address has been blocked by a security plugin, and the block usually expires on its own within minutes to hours.
6. Stop after about five failed attempts. More attempts can extend a security lockout.

If none of that works, do not install anything, do not "reinstall WordPress" from the host's one-click tool, and do not delete anything. Move on to the next section.

Why the password reset email never arrives

The reset email is sent to the email address stored on your own user account, not to the "Administration Email Address" in Settings, General. These are two separate settings, and most people do not know that. If the developer created your account using their own email, or a generic address that nobody checks, the reset link goes there.

There are three common reasons the email does not arrive:

• The address on the account is wrong. It belongs to a former developer, an old employee, or a mailbox that no longer exists.
• The site cannot send email. Out of the box, WordPress hands email to the server's built-in mail function, and many mailbox providers now reject or junk mail that is not properly authenticated. If your contact forms also go quiet, that is the cause. Our guide to WordPress not sending email explains it.
• A security plugin has disabled password resets for administrator accounts, which some do by default.

The WordPress.org forums have threads describing this exact situation, where a site owner had no admin access after the designer stopped responding, for example this one and this one. The answer in every case is the same: someone with hosting or database access has to make the change.

Who can get you back in, in order

The fastest route is whoever already has the highest level of access. Work down this list.

Two points matter here:

• Look for any other administrator. A marketing person, an office manager or a past agency may still have an admin login. Ask around before you do anything technical.
• Hosting access is the master key. WordPress stores every user in its database, and the hosting account gives access to that database. If you pay the hosting bill, the host can confirm you as the account holder and let you in, even if the developer set it up.

If the hosting account is in the developer's name, or you do not know which company hosts the site, read how to take back your WordPress site from a former developer before going further.

For your developer or host: five ways back in

This section is for whoever has hosting access. Each method is documented by WordPress in its Logging In guide or the WP-CLI user commands. Take a database backup before any of them.

# always first: a database backup
wp db export before-access-fix.sql

1. WP-CLI (preferred)

If the host offers SSH, this is the safest route because it uses WordPress itself and cannot corrupt the password field.

# who are the administrators, and what email do they use?
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# point the owner's account at an address the business controls
wp user update 1 --user_email=office@yourcompany.com --skip-email

# set a new password without it appearing in shell history
wp user update 1 --prompt=user_pass

# or create a fresh administrator for the business
wp user create officeadmin office@yourcompany.com --role=administrator --prompt=user_pass

Replace 1 with the ID from the first command. The WordPress handbook recommends --prompt=user_pass because it keeps the password out of your shell history.

2. phpMyAdmin (no SSH needed)

Most control panels include phpMyAdmin. Open the WordPress database, then the users table (often wp_users, but the prefix can differ: check $table_prefix in wp-config.php). Click Edit on the right user, choose MD5 in the function dropdown next to user_pass, type a new password, and save. While you are there, correct user_email.

Two details trip people up. First, typing a password without choosing MD5 stores it as plain text, which will not work. Second, WordPress 6.8 moved password hashing to bcrypt, and the core team confirmed that MD5 hashes remain supported for exactly this recovery case. WordPress replaces the temporary MD5 hash with a stronger one after the next successful login.

3. SQL: create a new administrator

If there is no usable account at all, create one. Adjust the wp_ prefix in all four places, including inside the meta key names.

INSERT INTO wp_users
  (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
VALUES
  ('officeadmin', MD5('use-a-long-temporary-password'), 'officeadmin',
   'office@yourcompany.com', NOW(), 0, 'Office Admin');

SET @uid = LAST_INSERT_ID();

INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES
  (@uid, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}'),
  (@uid, 'wp_user_level', '10');

Log in, change the password from the profile screen straight away, and check that the account shows as Administrator.

4. Security plugin or two-factor lockout

Renaming a plugin's folder deactivates it, because WordPress can no longer find it. This is the standard way to switch off a plugin that is blocking the login.

# find the security or two-factor plugin
wp plugin list --status=active --fields=name,version

# deactivate it without loading it
wp plugin deactivate wordfence --skip-plugins

# no SSH? rename the folder in the host's file manager instead
mv wp-content/plugins/wordfence wp-content/plugins/wordfence.off

Use the real folder name of the plugin on your site. Some firewall plugins also load before WordPress through a server setting (often in .user.ini or .htaccess); if the block survives the rename, the host can check for that. Turn the plugin back on once you are in, and set up two-factor login again on a device the business owns.

5. Login redirect loop

If the password is right but the login page keeps reloading, compare the two site address settings with the address in the browser. A mismatch between http and https, or between www and no www, breaks the login cookie.

wp option get home
wp option get siteurl

If they are wrong and you cannot reach Settings, WordPress documents fixing them in wp-config.php (wp-config reference):

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Also clear any server or plugin cache, and check that the CDN is not caching wp-login.php.

After any of these: close the old doors

# log every user out everywhere by changing the security keys
wp config shuffle-salts

# list every administrator again and remove any you do not recognise
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# delete a former contractor's account and give their posts to the new admin
wp user delete 7 --reassign=2

An administrator you do not recognise, especially one created recently, can be a sign of a compromise rather than an old account. If you find one, stop and follow how to fix a hacked WordPress site.

Once you are back in: make sure it cannot happen again

Getting back in is half the job. These steps take about fifteen minutes and stop the next lockout.

1. Put two administrators on the site, both on company addresses. One for the owner, one for a second trusted person. Use a role address such as web@yourcompany.com that survives staff changes.
2. Change the Administration Email Address in Settings, General to a company address. WordPress sends a confirmation link to the new address and only switches once it is clicked, a safeguard documented in the core reference. This address receives security and error notices, so it matters.
3. Answer the admin email check. WordPress asks administrators to confirm the admin email every six months by default (the admin_email_check_interval setting). If you have been clicking "Remind me later", this is the time to correct it.
4. Give contractors their own accounts, never a shared login, so you can remove one person without locking out everyone.
5. Store every login in a company password manager, not in one person's browser.
6. Fix outgoing email so the next reset link actually arrives.

What being locked out does NOT mean

People in this position often fear the worst. Most of these fears are wrong.

When to hand it over, and what to gather first

Hand it to a developer if you have no hosting access, if the host will not help, if you find administrators you do not recognise, or if you would simply rather not touch a database. Before you contact anyone, gather what you can. It saves hours and money.

With hosting access, a lockout is a short job. Without it, the first task is recovering the accounts, which our takeover guide walks through step by step. Either way, tell whoever helps you that you want every login handed back to you at the end.