Locked out of the WordPress admin area
Forgotten password, redirect loop, or locked out after too many attempts – there is a way back for each case, even without the admin area.
Almost every lockout can be solved through the database or a file – you do not need the admin area, only access to the hosting. Which route is right depends on what exactly happens: a wrong password, a loop after signing in, or a lockout message.
Reset the password without email
If the reset email never arrives – a very common case, because many servers do not send mail – the database is the way. In phpMyAdmin open the wp_users table, edit your own user, choose MD5 as the function for the user_pass field and enter the new password.
WordPress recognises the outdated MD5 hash at the next login, accepts it once and then stores the password securely anew. The table name may differ if a different prefix was chosen at setup.
The redirect loop
You enter the right details and the login page returns – with no error message. Usually the two addresses in the settings are to blame: siteurl and home do not match the address actually being used, for example with and without www, or http instead of https.
Both can be corrected in the wp_options table or overridden in wp-config.php with WP_HOME and WP_SITEURL. The second possible cause is cookies: a test in a private browser window rules that out in a minute.
Locked out after too many attempts
Security plugins block the IP address after a few failed attempts. That is correct behaviour, but it hits the owner too. Two ways out: wait for the block to expire – usually minutes to hours – or disable the plugin over FTP by renaming its folder in wp-content/plugins.
After renaming, the plugin is deactivated but its settings are kept. Log in, lift the block in the plugin's settings, rename the folder back and activate it again.
Sources and further documentation
Frequently asked questions
Why does the reset email never arrive?
Because WordPress sends mail through PHP's mail() function by default, which many recipients classify as unreliable or which the server does not support at all. The lasting fix is sending through a real outgoing mail server over SMTP – which at the same time improves every other mail the site sends, such as order confirmations and form notifications.
There is no user left in the list at all.
Then the administrator was deleted or demoted – both happen after a break-in. A new user can be created directly in the database; it needs a row in wp_users and one in wp_usermeta carrying the role. What matters afterwards is how someone obtained those rights: without an answer to that, the new account disappears just as quickly.
More guides
Update failed: site stuck in maintenance mode
Read article →WordPress shows a white screen – what to do?
Read article →Have a project in mind?
Get in touch
WP Bitty
WordPress assistant
AI assistant — may make mistakes. Not legally binding.