I Can't Log In to WordPress Admin: Fixing Passwords, Login Loops and Lockouts

If you can't get into the WordPress admin, first identify the symptom: did you forget the password, does the login page loop back even with the right password, or does the wp-admin address not open at all? If you forgot the password and the reset email doesn't arrive, you can set a new one from the WordPress tool in your hosting panel or from the database. Login loops usually come from cookie and site address settings; a login page that won't open usually means a security plugin changed the login address or locked you out. All of these can be fixed as long as you have access to the site's files or hosting panel.

We go by symptom below. Find yours and start from that section.

I forgot my password and the reset email doesn't arrive

The 'Lost your password?' link on the login page sends a reset link to the email address on the user account. If it doesn't arrive, there are three possibilities: it's in spam, the address on the account is out of date, or the site's email sending doesn't work at all. The last one is common and affects your forms too; the SMTP fix in contact form emails not arriving solves both.

If the email doesn't come, here are the ways to set a new password directly, easiest first:

1. Your hosting panel's WordPress tool. In tools like WP Toolkit or Softaculous on cPanel, or WordPress Toolkit on Plesk, you can select the installed site and change the admin password. It takes a few clicks.

2. phpMyAdmin. Open phpMyAdmin from the hosting panel, select the site's database and find the wp_users table (the prefix may differ, for example abc_users). Click 'Edit' on your user's row, choose MD5 in the Function column for the user_pass field, type the new password as the value and save. WordPress converts it to its own secure format on first login.

3. WP-CLI. If you have SSH access to the server, you can change the user's password with the wp user update command.

Once logged in, update the email address on your Profile page to a current one.

I log in with the right password but the page loops back

The password is accepted, the page reloads, and you're back at the login screen. Causes of this loop:

• Browser cookies. WordPress remembers logins with a cookie; if the browser blocks it or an old cookie conflicts, you get a loop. Try the site in a private window. If it works there, clear that site's cookies.
• Site address mismatch. The 'WordPress Address' and 'Site Address' fields in Settings must match the address the site actually opens on. If one is http and the other https, or one has www and the other doesn't, the login cookie is written to the wrong address. Since you can't get into the dashboard, fix this in phpMyAdmin in the siteurl and home rows of the wp_options table.
• A cache plugin has cached the login page. Temporarily rename the cache plugin's folder.

wp-admin returns 404 or redirects to the home page

Some security plugins hide the login address by closing wp-admin and wp-login.php and setting a custom address of your choice. When that address is forgotten, the dashboard seems to have vanished.

The fix is to disable the plugin. Using the hosting file manager or FTP, go to wp-content/plugins and rename the folder of the plugin that changed the login address (for example wps-hide-login to wps-hide-login-off). When WordPress can't find the plugin, it treats it as deactivated and wp-admin opens again. After logging in, rename the folder back and write down the new login address somewhere.

'Too many failed attempts' and lockouts

Plugins like Wordfence and Limit Login Attempts block your IP for a while after a number of failed attempts. You can wait for the lockout to expire, or rename the plugin's folder as above and restore it after logging in. Trying from another network (such as your phone's mobile data) also usually works, because the block is on your IP address.

If you use two-step verification and lost your phone, use one of the backup codes you were given during setup. Without backup codes, disable the two-step plugin the same way and set it up again after logging in.

'Sorry, you are not allowed to access this page'

If you can log in but see this message in the dashboard, your user has lost its administrator rights. Two common causes:

• The database table prefix was changed, but the rows storing user permissions kept the old prefix. This usually happens after a migration or a security plugin changing the prefix.
• The site was compromised, and the attacker downgraded your rights and created an admin account for themselves.

If you suspect the second, check the wp_users table in phpMyAdmin for users you don't recognise. If there are any, move on to the steps in your site got hacked: the first 24 hours.

If the login page shows a white screen or critical error

That isn't a login problem but a plugin or theme error. We cover the fix step by step in WordPress white screen error.

Making sure you don't get locked out again

• Use a password manager and keep the admin password there.
• Make sure the email address on your user profile is current and independent of the site's own domain.
• Turn on two-step verification, but keep the backup codes printed or in your password manager.
• If you changed the login address, write the new one down.
• Always keep access to the hosting panel and FTP details. When the dashboard door is locked, the files are your back door.

If the site's hosting and domain accounts are in someone else's hands and you can't do any of these steps, the problem isn't technical but access; my web designer won't hand over my site covers that situation. To keep dashboard access, updates and backups under regular watch, see our maintenance and support plan, and if you get stuck, write to us.