Locked out of wp-admin

The short answer

Start by working out which kind of lockout you have: the password is rejected, the login page keeps sending you back to itself, a security plugin or firewall is blocking you, or the login page itself shows an error or a blank screen. Each has a different fix.

For a forgotten password use the Lost your password? link. For a block, wait out the lockout period or disable the security plugin by renaming its folder over SFTP. For a loop, check the site address settings. If you have no working admin account at all, create a new one with WP-CLI or phpMyAdmin.

What it means

The WordPress admin area at yoursite.com/wp-admin is protected by a username and password, and often by extra layers: two-factor authentication (a code from your phone), a security plugin that counts failed attempts, and a firewall in front of the whole site. Any one of those can refuse you.

Logging in also depends on cookies, small files the site stores in your browser to remember that you are signed in. If the address WordPress believes it lives at does not match the address in your browser (for example http versus https, or with and without www), the cookie never sticks and the login page simply reloads.

Finally, the login page is a WordPress page like any other. If a plugin or theme has crashed the site, wp-login.php crashes too, and you see a critical error or a white screen rather than a form.

Common causes

• Wrong username or password. Your username is not necessarily your email, although WordPress accepts either. Browser-saved passwords go stale after a reset.
• Locked out by brute force protection. A security plugin or the host firewall has seen too many failed attempts from your address and blocked it for a while.
• A site address mismatch. After adding SSL, changing domain, or migrating, WordPress Address and Site Address under Settings > General no longer match reality, causing a redirect loop or a “Cookies are blocked” message.
• A plugin or theme crashing the login page.
• A lost or replaced phone with your two-factor authentication app on it.
• A hacked site. An attacker changed your password, demoted your account or deleted it.

How to fix it

1. Try the basics. Open yoursite.com/wp-login.php directly in a private browsing window, type the password rather than relying on the browser’s saved one, and try your email address as the username. Click Lost your password? and check spam for the reset email.
2. Reset email never arrives? Use one of these host-independent routes. Over SSH run wp user update yourusername --user_pass='NewStrongPassword'. Or open phpMyAdmin from the management console (Plesk with WP Toolkit), find the wp_users table (the prefix may differ), edit your row, and in the user_pass field choose MD5 from the function dropdown and type the new password. WordPress accepts it and upgrades it to a stronger hash on first login.
3. Skip the password entirely. In WP Toolkit each site has a Log in button that opens the dashboard as an administrator without a password. Once in, go to Users > Profile and set a new one.
4. Blocked by a security plugin? Wait for the lockout to expire (the message usually says how long), or connect over SFTP and rename that plugin’s folder inside wp-content/plugins to switch it off. Rename it back after you log in and whitelist your own address in its settings. If the block comes from the host firewall rather than a plugin, contact support.
5. Login page loops or says cookies are blocked? Clear cookies for the site in your browser. Then edit wp-config.php and add define('WP_HOME', 'https://yoursite.com'); and define('WP_SITEURL', 'https://yoursite.com'); above “That’s all, stop editing!”, using your real address. Clear any caching plugin and Cloudflare cache as well.
6. Login page shows a critical error or white screen? Rename the plugins folder to plugins.off over SFTP, log in, rename it back, and reactivate plugins one at a time. Our critical error and white screen articles walk through this.
7. Lost your two-factor device? Use one of the backup codes you saved when you set it up. If you have none, rename the two-factor plugin’s folder over SFTP to disable it, log in, then set it up again on your new phone.
8. No admin account left? Over SSH run wp user create newadmin you@example.com --role=administrator --user_pass='NewStrongPassword'. If you are not comfortable with that, ask support to create one.
9. Once you are back in, change every admin password, review Users > All Users for accounts you do not recognise, run a malware scan, and apply any pending updates.

On WP Alpha

A business grade web application firewall with brute force protection sits in front of every WP Alpha site. It is part of why repeated wrong passwords can lock you out for a while, and it is also what stops attackers guessing their way in. If you are blocked and cannot wait, support can lift the block: live chat and tickets are available 24/7, with an urgent escalation form.

Every site has phpMyAdmin, SSH and WP-CLI available, so the password reset and new-admin steps above work as written. If a lockout turns out to be a hack, daily malware scans by Imunify with cleanup are included on every plan, and backups taken every two hours and kept for 30 days can be restored from the management console (Plesk with WP Toolkit), from a single file up to the whole site.