Fast turnaround. No long contracts.
Locked Out of WordPress Admin — How to Get Back In
Forgot password? Lost 2FA? Got hacked? I’ll get you back into your admin fast — without losing your site.
Being locked out of wp-admin looks alarming but is usually one of a handful of recoverable causes — and it's rarely a hack. The trick is matching your exact symptom to the right recovery, because a redirect loop, a missing reset email, and a security lockout each need a different fix.
Sound Familiar?
What I'll Do
Match your symptom to the fix
- 1
Password reset email never arrives
The most common case, and it's usually not the password — it's that the site can't send mail. The reset genuinely generates but never leaves the server. You reset the password directly (via the database or WP-CLI) and then fix the underlying mail problem. Related: email not sending.
- 2
"Too many failed attempts" lockout
A security plugin has locked your own IP after failed logins. The fix is clearing that block over SFTP or the database (or waiting out the lockout), then whitelisting yourself.
- 3
Login page reloads or redirect-loops
You submit correct details and land back on the login page. Usually a stale cookie/session issue, a wrong site URL setting, or a caching layer on the login page. Clearing the relevant setting or cache resolves it.
- 4
"You do not have sufficient permissions"
Your user role or capabilities got corrupted — often after a failed update or a database issue. The role is repaired directly in the database.
- 5
White screen on wp-admin specifically
That's a PHP fatal in a plugin, not a login problem — see the white screen fix.
Ways back in when you have no admin access
- Reset the password in the database (phpMyAdmin or the host's DB tool) or with WP-CLI if you have shell access.
- Deactivate a blocking plugin by renaming its folder over SFTP — this clears security-plugin lockouts and login-related conflicts.
- Create a fresh admin user directly in the database if the existing account is corrupted.
- Correct the site URL in the database if a redirect loop is caused by a wrong `siteurl`/`home` value.
Lockout questions
Does being locked out mean I was hacked?
Usually not. Far more often it's a mail configuration that can't send the reset, a security plugin blocking your IP, or a corrupted setting. A hack normally shows other signs too, like redirects for search visitors — see malware removal if you suspect one.
The reset email won't arrive. Now what?
Reset the password directly in the database or via WP-CLI to get back in, then fix why the site can't send email — otherwise every future reset fails the same way.
Will I lose anything getting back in?
No. These are access problems, not data problems. Your content is safe in the database throughout.
Can you get me back in remotely?
Yes — with SFTP or hosting access I can restore your login quickly without touching your content. Send the details.
Related articles
Deep-dive guides on the same topic.
Locked Out of WordPress Admin? Here’s How to Get Back In
Can’t log in to your WordPress admin? Here are the 7 most common causes and how to regain access — even without email.
Hacked WordPress Site? The Cleanup Playbook — Clear, Update, De-Obfuscate, Harden
Your WordPress site got infected with malware. Before you nuke the whole thing, there's a 4-step recovery playbook that fixes most infections: clear the active malware, update plugins + core, hunt obfuscated code, and harden against reinfection.
My WordPress Site Was Hacked — What to Do Right Now
If your WordPress site is redirecting to spam, showing strange content, or flagged by Google, here's your step-by-step recovery plan.
Ready to Get This Fixed?
Send me a message and tell me what's going on. I'll take a look and let you know how I can help.