DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
FREEDOM251

Freedom251 › Blog › password recovery

How to Fix Being Locked Out of WordPress Admin

By Freedom251 Team · · 10 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start with the least invasive fix and stop as soon as access returns. Check the site administrator’s inbox for a WordPress Recovery Mode link, then try the Lost your password? form. If email is unavailable, use WP-CLI or a database reset. If a plugin or security rule is blocking the login, disable it through FTP, your host’s file manager, or WP-CLI. Only then inspect wp-config.php and site URLs.

Before changing database records or configuration files, make a backup of the database and site files, and make sure you can restore them. The correct path depends on whether the failure is a fatal PHP error, a forgotten password, broken mail, a plugin conflict, an IP block, or a configuration problem.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Locked out of WordPress admin? Identify the failure first

Do not repeatedly guess passwords or make several changes at once. Use the symptom that you can observe to select the safest recovery method.

What you see Most likely cause First action Access needed
A fatal-error screen, a blank page, or a site that fails after a recent update Broken plugin, theme, or PHP code Look for the WordPress Recovery Mode email Administrator email inbox
The login form works but rejects a known password Wrong password, changed account, or damaged user record Use Lost your password? Administrator email inbox
The reset message never arrives Incorrect account email, outbound mail failure, spam filtering, or a mail plugin problem Use WP-CLI or a database-level reset SSH with WP-CLI, or database access
The login page loops, returns an error, or fails after enabling a plugin Plugin conflict, fatal plugin code, or a security plugin’s IP block Deactivate the suspected plugin; if necessary, deactivate all plugins FTP, host file manager, or WP-CLI
The site redirects to the wrong domain or HTTPS variant Incorrect WordPress Address or Site Address values Check wp-config.php and the database URL values File or database access
Your password is correct but your IP is denied Security rule or blocklist entry Remove the block or disable the security plugin temporarily File, database, or hosting-panel access

Test in a private browser window after each change. A cached redirect, stale cookie, or browser extension can make a successful fix look unsuccessful.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

WordPress recovery mode email link: the safest first fix

WordPress Recovery Mode was introduced in WordPress 5.2. It can isolate a fatal PHP error and let an administrator enter the dashboard without editing files or using FTP. It applies to fatal errors encountered while a normal page is loading; it does not handle a wrong password, a security plugin’s IP block, cron failures, or other background tasks.

Find and use the message

  1. Open the mailbox for the site’s administrator address. Search for messages from WordPress and inspect spam, junk, quarantine, and server-side filtering.
  2. Open the Recovery Mode message and follow its special login link in the same browser where you intend to work. The link starts a Recovery Mode session; it is not a replacement for your normal password.
  3. After WordPress admits you, open Plugins and deactivate the plugin named in the error. If the message identifies a theme, open Appearance and switch to a default theme or remove the offending change.
  4. Load the public site and the regular login page in a separate private window. If both work, update or replace the faulty component before reactivating it.

Recovery Mode is associated with a cookie on the client rather than being permanently tied to one user account. If the link works on one device but not another, use the original browser session or repeat the link there.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If no Recovery Mode message arrives

Check that the administrator email stored for the site is still yours and that your mail provider accepts messages from the site. A broken outbound-mail setup can prevent the message even when WordPress detected the fatal error. Also check whether WP_DISABLE_FATAL_ERROR_HANDLER was added to wp-config.php; that constant can turn off the fatal-error handler that provides Recovery Mode. Do not add or remove the constant casually: save a copy of the file and ask your host or developer to confirm the intended setting.

WordPress login page not working: try a normal password reset

When the page loads and the account is merely rejecting credentials, use the built-in reset before touching files or the database.

  1. Go to the site’s normal login screen and select Lost your password?.
  2. Enter the administrator username or email address exactly as it exists in WordPress, then submit the form once.
  3. Open the reset email, follow its one-time link, and set a long, unique password. Store it in a password manager.
  4. Sign in from a private window, then review the account’s email address and role under Users.

If the form says the account exists but no message arrives, wait briefly, check every spam and quarantine folder, and verify that the address is correct. Repeated requests can invalidate earlier links. When ordinary mail delivery is broken, stop retrying and move to a technical reset path.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

How to reset WordPress admin password without email

There are two practical routes when you cannot receive WordPress mail: WP-CLI through SSH, or a direct database edit through a hosting database tool. Both require an existing administrator account and careful identification of the correct site and user.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Reset with WP-CLI

WP-CLI can operate even when the web login page is broken, provided the command runs from the correct WordPress installation and the shell account has permission to read it.

  1. Connect to the server over SSH and change to the directory containing wp-config.php.
  2. List administrator accounts so you can distinguish the intended user from a similarly named account:
    wp user list --role=administrator
  3. Confirm the user ID or login, then set a new password with the corresponding wp user update command. A commonly used form is:
    wp user update <ID> --user_pass='Use-a-long-unique-passphrase'
  4. Because command syntax and security policies can vary by WP-CLI version, run wp help user update on that server and verify the available options before executing the change.
  5. Delete the shell history entry or otherwise protect the password if your server records command lines. Test the new credentials in a private browser window.

Do not run the command from a parent directory containing several WordPress sites without specifying the correct installation. A successful command against the wrong site will not restore the account you need.

Reset through the database as a last resort

Use your host’s database tool, commonly phpMyAdmin, only after making a database backup and confirming the site’s table prefix. The table may not be named exactly wp_users if the prefix was changed.

  1. Open the database used by the affected WordPress installation and locate its users table, such as wp_users.
  2. Find the administrator row by matching the user_login or user_email value. Do not edit a similarly named account.
  3. Edit that row’s user_pass field. Some hosting guides instruct selecting the MD5 function for a temporary password, but this advice is not confirmed by current WordPress documentation; verify the method with your host or a WordPress specialist before saving.
  4. Save the row, close the database tool, and test the login immediately. Once inside WordPress, change the password again through the Users screen so the account uses the site’s normal password-management flow.

Never paste a real password into a public support ticket, screenshot, or shared document. If you cannot confidently identify the correct database, table prefix, or user row, ask the host to perform the reset while you retain a backup.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

How to deactivate plugins when locked out of WordPress

A plugin can prevent the login screen from loading, trigger a fatal error, or block your IP. Disable the smallest possible unit first, then broaden the change only if needed.

Rename the plugins directory with FTP or a file manager

  1. Open the site’s document root, the directory that contains wp-admin, wp-includes, and wp-content.
  2. Inside wp-content, rename plugins to a temporary name such as plugins.hold. Renaming removes the directory from WordPress’s expected path, so all standard plugins become inactive.
  3. Try the login page. If it loads, leave the renamed directory in place while you sign in and inspect the Plugins screen.
  4. Rename plugins.hold back to plugins. Reactivate plugins one at a time, testing the login and front end after each activation. The plugin that reproduces the failure is the likely cause.

This method deactivates every standard plugin at once and does not identify the culprit automatically. A must-use plugin in wp-content/mu-plugins can still load, so renaming the normal plugins directory will not disable it.

Deactivate with WP-CLI

From the WordPress directory, the official WP-CLI plugin command supports targeted and bulk deactivation:

  • wp plugin deactivate <plugin> deactivates one or more specified plugins.
  • wp plugin deactivate --all deactivates all standard plugins.
  • wp plugin deactivate --all --exclude=<plugin-slug> keeps the named slug active while disabling the rest.
  • --skip-plugins tells a WP-CLI command to load WordPress without standard plugins for that command; must-use plugins still load.

Use the plugin slug shown by wp plugin list, not the display name. After access returns, update or remove the plugin that caused the fault instead of leaving every plugin disabled.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

When a security plugin has blocked your IP

An IP block can leave the password and account untouched while denying every request from your network. Test the login from a different trusted connection only to confirm the symptom; do not use that as a permanent workaround. From the hosting file manager, WP-CLI, or the plugin’s database tables, remove the blocklist entry or temporarily disable the security plugin. If the block is stored in a custom table, ask the plugin’s documentation or your host for the exact table and cleanup procedure rather than deleting rows at random.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Check wp-config.php for unexpected changes

Once Recovery Mode, password reset, and plugin isolation have been ruled out, inspect wp-config.php. Download a copy before editing and compare it with a known-good backup or your deployment history.

Security keys and salts

Look for changes to AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their corresponding salts. Unexpected changes can invalidate existing login cookies and may indicate an unauthorized edit. If you did not make the change, preserve the original file and review hosting access logs before replacing it.

WordPress and site URLs

Check for an accidental change between http and https, a missing www, or a domain that no longer points to this installation. A mismatch can create redirect loops or send the login form to a different host. Correct the stored WordPress Address and Site Address values in the database only after confirming the canonical domain with your host.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A temporary URL override in wp-config.php can bring a site back while the database values are corrected, but it is a short-term repair, not a permanent substitute for fixing the stored settings. Have the host or developer apply the override if you are not comfortable editing PHP configuration.

What to do after you regain access

Recovery is incomplete until you remove the cause and secure every account that may have been exposed.

  1. Set a strong, unique password for every administrator account involved in the incident, not just the account you used to recover access.
  2. Delete emergency administrator accounts that are no longer needed. If an account must remain, reduce its role to the minimum permissions required.
  3. Review the timeline of plugin, theme, user, and settings changes. Remove unknown users, restore legitimate configuration, and update or replace the component that caused the lockout.
  4. Reactivate disabled plugins one at a time, testing both /wp-login.php and representative public pages after each change.
  5. Ask the host for server and PHP error logs. The exact file path and plugin name in a fatal-error entry can distinguish a code defect from a configuration or resource problem.
  6. Confirm that scheduled backups complete and that you can restore both files and the database before making further updates.

Troubleshooting branches when the first fix fails

The Recovery Mode link opens but still shows an error

Use the same browser that opened the message, clear only the site’s cookies if necessary, and retry. If the error is not a fatal PHP error, Recovery Mode cannot solve it; use the password, plugin, IP-block, or URL path that matches the symptom.

All plugins are disabled but the login still fails

Check the active theme, must-use plugins, PHP version errors, security rules at the host or web server, and the account record itself. A plugin-directory rename does not disable code loaded from mu-plugins or server-level firewalls.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The password reset succeeds but WordPress immediately logs you out

Check the site URL and HTTPS configuration, then inspect security keys and cookie-domain settings in wp-config.php. A domain mismatch or recently changed keys can invalidate the session as soon as it is created.

The dashboard works but the public site is broken

Keep the offending plugin or theme disabled, capture the PHP error from the server log, and restore a known-good version. Do not reactivate everything at once; otherwise the triggering change will be difficult to identify.

Prevent another WordPress admin lockout

  • Keep at least two verified administrator accounts, each with a different strong password and a current email address.
  • Record the hosting-panel, FTP, SSH, and database recovery paths in a secure password manager so a broken login is not also a loss of infrastructure access.
  • Test that site mail reaches an administrator before relying on Recovery Mode or password resets.
  • Back up before plugin, theme, PHP, URL, or security-setting changes, and retain a restore point outside the hosting account.
  • Apply plugin and theme updates in a staging environment when possible, then test the login and front end after each change.
  • Review security-plugin allowlists and blocklists so your normal office, home, and mobile addresses are not accidentally denied.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

password recoveryplugin troubleshootingwebsite securityWordPressWordPress adminWP-CLI

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.