Locked Out of WordPress Admin: Safe Ways Back In

Short answer: before forcing your way back in, work out which kind of lockout this is. A forgotten password, a security-plugin block, a broken login flow and an attacker who changed your credentials all look similar from the login screen but need very different responses.

Classify it first

• Credential: the password is wrong or the reset email never arrives.
• Blocked: a security plugin or firewall is refusing your IP after failed attempts.
• Broken: the login page errors, loops, or reports a cookie problem.
• Compromise: your account is gone, its role changed, or unknown administrators exist.

Recover a password when the email fails

Try the standard reset first. If it never arrives, the site likely cannot send mail. With database access via phpMyAdmin, you can reset the password directly: in the wp_users table, edit the user’s user_pass, choose the MD5 function and enter a new value (WordPress upgrades the hash on next login). With WP-CLI it is cleaner still — wp user update admin --user_pass=NEW, or create a fresh administrator with wp user create. Both require verified ownership of the hosting account.

Clear a security-plugin lockout

A lockout after failed logins is the plugin doing its job. Rather than deleting it, disable it temporarily by renaming its folder in /wp-content/plugins over SFTP, log in, then re-enable it and add your IP to its allowlist. Some plugins also store the block in the database, which the rename clears on reload.

When the login page itself errors

A login page showing a critical error or a redirect loop is usually not an authentication problem. Check /wp-content/debug.log: it is often a plugin or theme fatal error, or a site-URL/HTTPS mismatch causing the loop. Fix that underlying fault and the login returns.

When it is a compromise, preserve first

An unknown administrator, a changed admin email, or a reset email arriving at an address you do not recognise is a security incident, not a login problem. Do not delete the suspicious account first — record it, back up the state, and treat access recovery as one step inside a wider cleanup, because a backdoor will simply recreate it. Whatever route you use, do not leave a permanent shared-password admin or a disabled security plugin behind: rotate credentials and restore protection before you finish.