Recommended Free Tools
Start with the least invasive fix: look for a WordPress Recovery Mode email, then try the password-reset link. If the message never arrives, use hosting or command-line access to reset the administrator password. If a plugin, theme, security block, or configuration change is preventing login, disable the suspect component and correct the underlying setting. Back up the database and files before changing the database, wp-config.php, or plugin directory.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide covers the common meanings of “locked out”: a fatal error, a rejected password, a broken login email, a plugin conflict, an IP block, incorrect site URLs, or a damaged configuration. Follow the branches in order and stop as soon as access returns.
As an Amazon Associate I earn from qualifying purchases.
Quick diagnosis: why you cannot reach wp-admin
The symptom usually identifies the safest first move. Use this table before making a database or file change.
| What you see | Likely cause | First action | Access needed |
|---|---|---|---|
| A fatal-error screen or a white screen after a recent update | Plugin or theme PHP failure | Use the WordPress Recovery Mode email link | Administrator email inbox |
| The login form works but rejects the password | Wrong, changed, or forgotten password | Select “Lost your password?” | Access to the administrator email |
| Password reset mail never arrives | Broken site mail, wrong account email, or mail filtering | Reset with WP-CLI or hosting database access | SSH/WP-CLI or phpMyAdmin |
| Login fails only after installing a plugin or security tool | Plugin conflict or IP blocklist | Deactivate the plugin outside WordPress | FTP, file manager, or WP-CLI |
| The site redirects to the wrong domain or loops between URLs | Incorrect WordPress URL or site URL | Check the database values and temporarily override the URLs | File or database access |
| Credentials appear correct but every session is rejected | Changed security keys, damaged configuration, or a security rule | Inspect wp-config.php and server/security logs |
File access and, ideally, host support |
Do not repeatedly guess passwords. Multiple attempts can trigger a security plugin or host-level rate limit and make a simple password problem look like an IP ban.
#1 Best Overall
First response when you are locked out of WordPress admin
1. Check for the WordPress Recovery Mode email
WordPress Recovery Mode was introduced in version 5.2. It can restore access when a fatal PHP error prevents normal administration. During a fatal error on a regular page load, WordPress sends a special login link to the site administrator’s email address. Open the message on the same device and browser where you will use the link.
- Search the administrator inbox, spam folder, quarantine, and any forwarding mailbox for a message from the site.
- Open the newest Recovery Mode message and follow its unique login link.
- After signing in, open the Plugins or Themes screen identified by WordPress.
- Deactivate the named plugin or switch away from the named theme.
- Exit Recovery Mode, test the front end and
/wp-admin/, and then update, replace, or remove the faulty component.
Recovery Mode is a containment mechanism, not a general password bypass. It helps with fatal errors; it does not correct a wrong password, a security plugin’s IP blocklist, or a mail-delivery failure. It is triggered by fatal errors during normal page loads, not by cron jobs or other background tasks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The mode is associated with a browser cookie rather than a particular user account. If the link works in one browser but not another, use the browser that opened the link and allow cookies. A site can also disable the feature with the WP_DISABLE_FATAL_ERROR_HANDLER constant in wp-config.php; if that constant is present and set to disable the handler, remove or correct it only after making a backup.
2. Try the normal password-reset flow
On the login screen, select Lost your password?, enter the administrator username or email address, and submit the form. Check spam and filtering rules before requesting several messages. Use the newest reset message because older links can expire or be superseded.
If WordPress confirms that it sent a message but nothing arrives, the site may be unable to send mail, the account’s email address may be wrong, or a provider may be rejecting the message. Move to an authenticated technical method rather than continuing to retry.
3. Determine which technical access you have
- SSH and WP-CLI: the safest technical route when the hosting account provides a working WordPress installation and command-line access.
- FTP or a hosting file manager: useful for disabling all ordinary plugins when one blocks login.
- Database access: a last-resort route for changing the administrator record or correcting URL values.
- Host support: appropriate when you lack these credentials, suspect a server-level block, or need logs before changing production files.
Before using the database or editing wp-config.php, make a current backup of both the database and the WordPress files. Confirm the backup can be downloaded or restored; a backup that exists only on the same failing account is not a reliable recovery point.
How to reset WordPress admin password without email
Reset it with WP-CLI
WP-CLI can operate even when the browser login page is broken. From the WordPress installation directory, first list administrator accounts:
wp user list --role=administratorIdentify the correct user ID, then set a long, unique password:
wp user update <ID> --user_pass='Use-a-long-unique-password'Replace <ID> with the numeric account ID and use a password that is not reused elsewhere. The command shown is the standard WP-CLI form, but command behavior and shell quoting depend on the installed WP-CLI and operating system. Run wp help user update on the server first, and avoid placing a real password in shell history or a shared ticket. If the command fails, ask the host to run it securely rather than repeatedly guessing syntax.
After the update, sign in at the site’s normal login URL, confirm that the account has the intended administrator role, and change the password again from the profile screen if your host used a temporary credential. Do not leave a shared or emergency password in place.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Change the record in phpMyAdmin only as a last resort
Open the database assigned to the site and locate the users table. Its name may not literally be wp_users because the installation can use a custom table prefix; inspect the $table_prefix value in wp-config.php before editing.
- Back up the database and export the relevant user row.
- Open the users table and identify the administrator by username or email, not by a guessed row number.
- Edit only the password field for that account.
- Save the change, close phpMyAdmin, and test one login.
Some hosting guides instruct users to select an MD5 function when saving a password. That advice is not verified here against current WordPress documentation and should not be treated as a universal, preferred method. WordPress’s password system and hosting panels can differ, so confirm the correct procedure with your host or current WordPress developer documentation. Never paste a plaintext password into an unrelated database column, change several accounts at once, or run an unreviewed SQL statement on production.
When the reset succeeds but login still fails
- Make sure you are using the correct site URL and the correct login form for that installation.
- Delete stale browser cookies for the site and retry in a private window.
- Check whether a security plugin or host firewall is blocking your IP address.
- Inspect server and PHP logs for a fatal error that occurs after authentication.
- Check
wp-config.phpfor changed security keys, URL constants, or a setting that disables normal error handling.
How to deactivate plugins when locked out of WordPress
Rename the plugins directory with FTP or a file manager
This method disables every ordinary plugin without requiring a WordPress login. It is useful when a plugin causes a fatal error, redirects the login form, or blocks your IP.
- Open the WordPress installation directory in FTP or your host’s file manager.
- Locate
wp-content/plugins. - Rename it to a temporary name such as
plugins.disabled. - Try the login page again. WordPress no longer recognizes the renamed directory, so ordinary plugins are deactivated.
- Once access returns, rename the directory back to
plugins. - Reactivate plugins one at a time, testing the front end and admin after each activation.
Renaming the directory is broad: it disables all ordinary plugins, not just the suspected one. Do not delete the directory or its contents. If the site remains broken after the rename, the cause may be the theme, a must-use plugin, wp-config.php, a server rule, or a database value.
Deactivate a specific plugin with WP-CLI
When SSH access works, use the plugin’s slug:
wp plugin deactivate <plugin>You can deactivate everything with:
wp plugin deactivate --allTo deactivate all ordinary plugins except selected slugs, use the exclusion option:
wp plugin deactivate --all --exclude=<plugin-slug>The --skip-plugins flag loads WordPress without ordinary plugins for one command, which is useful for diagnostics. Must-use plugins still load when ordinary plugins are skipped, so this flag will not bypass a blocking component stored in wp-content/mu-plugins.
After the command, retry the login. If it works, reactivate plugins individually and identify the first one that reproduces the failure. Update or replace that plugin before reactivating the rest.
When a security plugin has blocked your IP
A security plugin can reject a valid password because your address is on its blocklist. If renaming the plugins directory restores access, sign in from a trusted connection, remove the blocklist entry, and review the plugin’s login and rate-limit settings before reactivating it. If you cannot access its settings, the plugin’s data may need to be cleared or corrected in the database; make a backup and ask the host for help rather than deleting unknown rows.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
A host firewall, content-delivery layer, or web-server rule can create the same symptom. Test from a permitted network only as a diagnostic, not as a permanent workaround, and ask the host to review firewall and access logs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to check in wp-config.php
Download a copy before editing the live file. Compare it with a known-good backup and look for changes you did not make.
Security keys and salts
Inspect the authentication and other security-key definitions, including AUTH_KEY and the related keys. Unexpected changes can invalidate or disrupt login cookies. Treat an unfamiliar change as a possible compromise: preserve the file for investigation, scan the account, and ask the host to review access logs before overwriting evidence.
Site URL and home URL
If the site redirects to a different domain, alternates between HTTP and HTTPS, or sends the login form to an old address, verify the WordPress URL values in the database. As a temporary measure, you can override them in wp-config.php with the site’s correct URL:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Replace the example address with the exact canonical URL, including the protocol, and do not add a trailing path unless WordPress is installed in a subdirectory. Use the override only while correcting the database values, then remove it so the database remains the single source of truth. A wrong URL can make a successful password reset appear to fail because the browser is sent to another host.
Fatal-error handling
Check whether WP_DISABLE_FATAL_ERROR_HANDLER has been added or changed. If it disables the fatal-error handler, Recovery Mode may not send its normal email. Remove an unauthorized setting only after backing up the file and confirming that no host-specific configuration requires it.
Best Value
When the WordPress login page is not working
The page is blank or shows a PHP fatal error
Use the Recovery Mode branch first. If no email arrives, disable ordinary plugins by renaming wp-content/plugins or with WP-CLI, then test again. If the error persists, switch temporarily to a default theme only if you have a safe way to do so, and ask the host for the PHP error log naming the file and line that failed.
The page redirects continuously
Check the WordPress and site URL values, HTTPS configuration, reverse-proxy settings, and any redirect plugin. Clear browser cookies after correcting the URL. Do not keep changing several redirect rules at once; make one change, test, and record the result.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The page returns “cookies are blocked” or immediately logs out
Confirm that the browser accepts cookies for the correct domain, then test in a private window. A URL mismatch, changed security keys, caching layer, or security plugin can also prevent the authentication cookie from being accepted. Purge the site’s page and object caches only after recording the current configuration.
The login form is missing, forbidden, or blocked
A security plugin, host firewall, web-application firewall, or renamed login path may be responsible. Use the host’s access logs to distinguish a WordPress response from a server-level denial. If you own the server, temporarily allow your administrative IP for testing; do not permanently weaken firewall rules just to regain access.
What to do immediately after access returns
Secure every administrator account
- Set a strong, unique password for each administrator account touched during recovery.
- Remove emergency accounts you created, or reduce them to the minimum role they need.
- Confirm that each remaining administrator is a real person with a current email address.
- Review active sessions and sign out unknown devices where your security tools provide that option.
Find and fix the root cause
- Review recent plugin, theme, WordPress, user, and settings changes.
- Restore disabled plugins one at a time, testing after each activation.
- Update, replace, or remove the component that caused the failure instead of leaving it disabled indefinitely.
- Check server, PHP, and WordPress logs for the exact error and timestamp.
- Ask the host to investigate if the logs show resource exhaustion, firewall rules, malware indicators, or a server configuration problem.
Preserve a recovery path
Create a fresh backup of the corrected database and files. Store a copy outside the hosting account and verify that it can be opened or restored. Record who controls the administrator email, hosting account, DNS, and database credentials. Keep an emergency procedure that uses an approved account rather than a shared password in a text file or support ticket.
Prevention checklist for future lockouts
- Keep WordPress core, plugins, themes, PHP, and the hosting stack supported and updated.
- Test updates on a staging copy when the site is important enough to justify one.
- Maintain at least one working administrator account with a monitored email address.
- Use a password manager and unique passwords instead of reusing credentials.
- Know where FTP, file-manager, SSH, WP-CLI, database, and host-support access are stored.
- Monitor recovery and security-plugin emails so a fatal-error notice is not missed.
- Schedule independent backups and periodically test restoration.
- Limit administrator privileges and remove accounts that no longer need access.
The safest recovery order is therefore: Recovery Mode email, normal password reset, WP-CLI or carefully controlled database reset, plugin deactivation, configuration and URL checks, then host-level investigation. Each step increases the amount of access and risk involved, so do not skip to database edits when an email link or a reversible plugin rename can solve the problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
