Cannot Log In to WordPress
WordPress Errors
Locked out of your own site, and the reset email never arrives.
The password is rejected, the reset email never arrives, or the login page returns an error about too many attempts. In the worst case, your account no longer seems to exist.
What it actually means
Being locked out is frightening because the admin is the only door most owners know. It is not the only door. Anyone with SFTP or database access can restore an administrator account, which is why hosting credentials matter more than the WordPress password.
The reason matters for what you do next. A forgotten password is a two-minute fix. A missing reset email is a mail problem, not a login problem. An account that has genuinely vanished is a different and more serious situation.
What usually causes it
Most likely first.
- 1
The reset email is not being delivered
WordPress sends mail through the server by default, and that mail is routinely rejected or filed as spam. The reset works; the message never lands.
- 2
A security plugin has locked you out
Repeated failed attempts trigger a lockout by IP address, which looks identical to a wrong password.
- 3
The password was changed elsewhere
Another administrator changed it, or a password manager saved a value that was never actually applied.
- 4
A plugin broke the login page
Two-factor, membership, or custom-login plugins can fail after an update and refuse everyone, including you.
- 5
The account was removed or demoted
Occasionally administrative housekeeping. Occasionally the first visible sign of a compromise.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Check spam, then try a different route
Look for the reset email in junk. If it never arrives, stop retrying — resend loops often trip the lockout that makes things worse.
Step 2 — Confirm whether you are IP-blocked
Load the login page on cell data with wifi off. If it behaves differently, a security plugin or firewall has blocked your address rather than rejected your password.
Step 3 — Disable security and login plugins over SFTP
Rename the specific plugin folder — or the whole plugins directory — to switch it off without the admin.
Step 4 — Reset the password in the database
In phpMyAdmin, edit your user row in wp_users and set user_pass using the MD5 function. WordPress upgrades the hash on your next login. Back up the table first.
Step 5 — Create a new administrator in code
If your account is gone, add a temporary admin user via functions.php, log in, restore what you need, then remove that code immediately.
When to stop and call someone
Call someone if your administrator account has disappeared, if new admin users you do not recognize are present, or if you have no SFTP or database access at all. The first two suggest a compromise rather than a lockout, and the response is different.
Frequently asked
Use SFTP or your database rather than the login screen. You can disable the plugin blocking you by renaming its folder, or reset your password directly in the wp_users table. Hosting access is the real master key, not the WordPress password.
Because WordPress sends mail through the web server by default, and mailbox providers frequently reject or spam-filter it. The reset itself usually worked — the message simply never arrived. Proper mail authentication fixes this for good.
Open phpMyAdmin, find the wp_users table, edit your row, and set user_pass to your new password with the function set to MD5. WordPress rehashes it securely on your next login. Take a backup of the table before editing.
Yes, and security plugins are the usual reason. Repeated failed logins, a VPN, or a changed IP address can get your own address blocklisted. Renaming the plugin's folder over SFTP disables it and restores access immediately.
Treat it as a possible compromise rather than a glitch. Attackers commonly remove or demote legitimate administrators after creating their own. Check the user list for accounts you do not recognize and have the site scanned before simply recreating your account.
If you’d rather not
We do this work every week. These are the services that cover it.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
- Fixing WordPress PluginsOne bad plugin can take your whole site down. We fix plugin conflicts, fatal errors, and security holes fast — and build custom plugins when the off-the-shelf ones fall short.
- Forms & Scripts Not WorkingA form that quietly fails is the most expensive bug on a website — you never see the leads you lost. We fix it, then prove the message arrives.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.