Losing access to /wp-admin/ has several very different causes — a forgotten password, a security-plugin lockout, a broken login flow, or a compromise. The right recovery depends entirely on which one it is, so confirm ownership and classify the lockout before forcing your way in.
Step 1 — Classify the lockout
- Credential: the password is wrong or the reset email never arrives.
- Blocked: a security plugin or firewall is refusing your IP after failed attempts.
- Broken: the login page errors, loops, or reports a cookie problem.
- Compromise: your account is gone, its role changed, or unknown administrators appear.
Step 2 — Recover a legitimate password
Try the standard reset first. If the email never arrives, the site likely cannot send mail. With database access (phpMyAdmin or your host’s panel), you can update the user’s password hash directly, or create a new administrator. With WP-CLI it is one command: wp user create or wp user update. Both require verified ownership of the hosting account — this is exactly why identity is confirmed before any recovery.
Is your website affected right now?
Send the URL and the symptom you can see. Jordi Ensenyat reviews the case personally and defines the scope and quote before anything is changed. This form never asks for passwords.
Step 3 — If a security plugin locked you out
A lockout after failed logins is the plugin doing its job. Rather than deleting it, clear the block: many store the lockout in the database, and renaming the plugin’s folder in /wp-content/plugins temporarily disables it so you can log in, after which you re-enable it and add your IP to its allowlist. Deleting a security plugin outright removes protection you will want back.
Step 4 — If the login page itself errors
A login page that shows a critical error or a redirect loop is usually not an authentication problem at all. Check debug.log: it is often a plugin or theme fatal error, or a site-URL/HTTPS mismatch causing the loop. Fix that underlying fault and the login returns.
When it is a compromise, stop and preserve
An unknown administrator, a changed admin email, or a reset email arriving at an address you do not recognise is not a login problem — it is a security incident. Do not delete the suspicious account first; record it, back up the state, and treat access recovery as one step inside a wider cleanup, because a backdoor will simply recreate the account.
Do not leave the door open
Whatever route you use, do not leave a permanent shared-password admin behind or a security plugin disabled. Rotate credentials, remove temporary access, and confirm two-factor and protection are back on. If you would rather not touch the database or SFTP, the recovery can be handled after ownership is verified through a secure channel.
EVIDENCE-LED WORDPRESS RECOVERY
Recover administrator access without weakening the site
A login failure may be a simple account issue, a security-plugin lockout, a broken authentication flow or evidence of compromise. Recovery begins by confirming legitimate control and preserving the audit trail before changing credentials or disabling protection.
What we verify
- Ownership and an authorised recovery route
- User roles, unexpected administrators and recent account changes
- Security plugins, cookies, redirects and authentication errors
- A successful login followed by stronger, rotated access controls
What a verified outcome means
Legitimate administrator access is restored and verified without leaving an unsafe bypass in place. Any sign of compromise is separated from the access problem and escalated for cleanup.
BEFORE THE ASSESSMENT
Common questions about this WordPress incident
Can you recover access without the current WordPress password?+
Often yes, using an authorised hosting, database, email or command-line route after ownership is verified.
Will you disable the security plugin permanently?+
No. A temporary controlled change may be diagnostic, but protection should be restored or replaced once the cause is known.
What if an unknown administrator is present?+
That is treated as a possible compromise, not just a login issue. Access recovery should then be combined with incident investigation.