What to Do When Your WordPress Admin Account Is Locked Out
If you need to know how to fix WordPress admin account locked out, the fastest path depends on what caused the lockout.
This guide covers the most common causes, from forgotten passwords to security plugin restrictions, and shows how to restore access without making the problem worse.
Why WordPress Admin Lockouts Happen
A WordPress admin account can become inaccessible for several reasons, and the fix depends on identifying the trigger.
Common causes include plugin-based security blocks, too many failed login attempts, a changed email address, malware, a corrupted user role, or a hosting-level restriction.
- Incorrect password or username: The simplest cause, often paired with browser autofill mistakes.
- Security plugins: Tools such as Wordfence, iThemes Security, or All In One WP Security may block logins after repeated failures.
- Hosting security rules: Firewalls and login protection at the server level can block suspicious access.
- Role or database issues: A user may still exist but lose administrator capabilities.
- Hacked site: Attackers may change credentials, lock accounts, or inject redirects.
First Checks Before You Start Recovery
Before changing files or database entries, confirm that the problem is not simply a browser issue or a temporary security block.
Try logging in from a private browser window, clear cached credentials, and verify that you are using the correct wp-admin URL and email address.
If a security plugin is active, check whether you received a lockout notice by email.
Many plugins send an alert when they block an admin account, and that message often includes a recovery link or the reason for the restriction.
How to Fix WordPress Admin Account Locked Out Using Password Reset
The WordPress password reset flow is the safest recovery method when the account still exists and the email address is valid.
On the login screen, select the lost password option and request a reset link.
- Go to /wp-login.php or /wp-admin.
- Select Lost your password?.
- Enter your username or email address.
- Check the inbox associated with the admin account.
- Use the reset link to create a new password.
If no reset email arrives, check spam folders and confirm that your site can send email correctly.
On many hosting platforms, WordPress email delivery fails unless configured with SMTP or a transactional email service such as SendGrid, Mailgun, or Postmark.
Reset Access Through phpMyAdmin
If the password reset email does not work, you can restore access directly in the database through phpMyAdmin or a similar MySQL tool.
This method is especially useful when the account is still present but the credentials are unknown or the email address is outdated.
Open the wp_users table and locate the admin account.
Edit the password field, but be aware that WordPress stores passwords as hashed values, so you should use the built-in MD5 option only as a temporary bridge, then log in and change the password from the dashboard immediately.
- Back up the database before editing anything.
- Confirm the correct table prefix if your site does not use wp_.
- Update the password securely after regaining access.
Disable a Security Plugin That Is Blocking Login
Security plugins are a frequent reason an admin account gets locked out, especially after brute-force protection or country-based restrictions are enabled.
If you cannot access the dashboard, disable the plugin from the file system.
Using FTP, SFTP, or your hosting file manager, rename the plugin folder inside /wp-content/plugins/.
For example, renaming wordfence to wordfence-disabled will deactivate it.
After that, try logging in again.
Once back in, review the plugin’s lockout settings carefully.
Check login attempt limits, whitelist your IP address, and ensure administrators are excluded from overly aggressive rules.
Regain Access by Creating a Temporary Admin User
If the original account is damaged or unavailable, you can create a temporary administrator account using a database tool or a recovery plugin.
This is common when the username still exists but the account cannot authenticate properly.
In phpMyAdmin, insert a new user into the wp_users table and assign the administrator role through the wp_usermeta table.
This approach requires precision because a missing or incorrect meta value can prevent the new account from receiving full admin privileges.
Use this method only when other reset options fail, and remove the temporary account after you restore the original one.
Leaving extra admin accounts in place increases the risk of unauthorized access.
Check for Malware or a Compromised Site
If the lockout appeared suddenly, especially after suspicious redirects, unknown plugin changes, or spam content, treat it as a security incident.
A compromised WordPress installation may block the real admin account while creating new backdoors.
Review recent file changes, scan the site with a malware scanner, and inspect active users in the database.
Compare your core WordPress files against a clean installation of the same version if you suspect tampering.
- Look for unfamiliar administrator accounts.
- Check .htaccess and wp-config.php for injected code.
- Update all credentials, including hosting, database, and SMTP passwords.
- Remove unused plugins and themes that could be exploited.
How to Recover When You Lost Admin Role Instead of Password Access
Sometimes you can still log in, but the account no longer has administrator permissions.
In that case, the issue is not a classic lockout; it is a role corruption problem.
This often happens after a migration, plugin conflict, or database error.
Inspect the wp_usermeta table and verify that the account has the correct capabilities entry for your site’s table prefix.
The administrator role should be associated with a serialized value that grants full capabilities and the matching user level.
If you are unsure how to edit serialized data safely, restore from a known-good backup or use a trusted recovery plugin.
Manual edits to serialized strings can break the account further.
What Hosting Support Can Do for You
Your hosting provider can often help if the login failure is caused by server-side security, file permissions, or email delivery issues.
Managed WordPress hosts may also restore a recent backup or temporarily lift an IP block.
Ask support to check the following:
- IP-based firewall restrictions.
- Failed login logs.
- PHP or database errors affecting authentication.
- Email routing problems preventing password reset messages.
How to Prevent Future WordPress Admin Lockouts
After you regain access, harden the login process so the problem does not repeat.
Prevention is more efficient than recovery, especially for business sites that depend on constant access to the dashboard.
- Use a password manager and a unique admin password.
- Enable two-factor authentication with a trusted plugin.
- Create at least one backup administrator account stored securely.
- Limit login attempts without blocking trusted administrator IPs.
- Keep WordPress core, plugins, and themes updated.
- Use SMTP for reliable password reset email delivery.
- Schedule regular backups and verify that they can be restored.
When to Restore a Backup
If the site is compromised, badly misconfigured, or the database has been edited incorrectly, restoring a clean backup may be the quickest safe option.
This is especially true when login issues are part of a broader failure affecting pages, plugins, or site content.
Choose a backup created before the lockout occurred, then update all credentials immediately after the restore.
If possible, test the backup in a staging environment first so you do not overwrite recent content unnecessarily.
Quick Recovery Checklist
- Confirm the issue is not a browser or typo problem.
- Use the built-in password reset link.
- Check whether a security plugin blocked the login.
- Reset the password through phpMyAdmin if needed.
- Create a temporary admin only if recovery fails.
- Scan for malware and review user accounts.
- Strengthen login security after access is restored.