Locked Out of wp-admin? How to Reset Your WordPress Password (4 Ways)

← Back to all WordPress fixes

Introduction

You go to log in to wp-admin and your password just doesn’t work anymore — or you’ve genuinely forgotten it. Frustrating, but never fatal: WordPress stores passwords in a way that always allows a reset, even if you’ve lost access to everything else. Below are four ways to get back in, from the everyday method to the ones that work when nothing else does.

Method 1: The “Lost Your Password?” Link (Try This First)

On your login page (yoursite.com/wp-login.php), click Lost your password?, enter your username or admin email, and submit. WordPress emails a reset link to the address on file.

• Check spam if the email doesn’t arrive within a few minutes.
• If it never arrives at all, your site likely can’t send email — see our guide to why WordPress isn’t sending emails. That’s the single most common reason this method fails.
• If you’re not sure which email is on file, or you’ve lost access to that inbox too, skip to Method 2.

Method 2: Reset via phpMyAdmin (Works Almost Always)

Every WordPress password is stored in the database, so you can reset it directly — even with zero access to wp-admin or email. Most hosts include phpMyAdmin in their control panel (cPanel, Plesk, or a custom dashboard).

1. Open phpMyAdmin and select your WordPress database.
2. Open the wp_users table (the prefix may differ, e.g. wp7x_users — check wp-config.php if unsure) and find your row.
3. Click Edit on your user row.
4. In the user_pass field, delete the existing value and type your new password.
5. In the dropdown next to that field, change the function from None to MD5. This is essential — WordPress expects the password hashed this way, and it re-hashes it securely on your next login.
6. Click Go to save, then log in at wp-admin with your new password.

No phpMyAdmin? Some hosts offer Adminer instead — the same steps apply.

Method 3: Reset via WP-CLI

If you have SSH access to your server, this is the fastest method of all:

wp user list
wp user update <user_id_or_login> --user_pass=your-new-password

The first command shows your users and their IDs if you’re not sure which account to target. No manual hashing needed — WP-CLI handles it correctly. See our full WP-CLI guide if you’re new to managing WordPress from the terminal.

Method 4: Temporary functions.php Fallback

If you don’t have phpMyAdmin or SSH access, you can force a password change with a few lines of code, using only FTP or your host’s File Manager:

1. Open your active theme’s functions.php (via FTP or File Manager).
2. Add this line at the very top, right after the opening <?php:

   wp_set_password( 'your-new-password', 1 );

   1 is the user ID — change it if your admin account isn’t user ID 1.

3. Save the file, then load any page on your site once (this runs the code).
4. Log in with your new password.
5. Immediately remove that line and save again — otherwise your password silently resets to the same value on every page load, and anyone who finds that line of code can log in too.

Because this method involves editing a live PHP file, a typo can trigger a critical error on your site — double-check the syntax before saving, and keep a backup handy just in case.

Prevention: Don’t Get Locked Out Again

• Use a password manager so you’re never relying on memory.
• Keep your admin email current and confirm it can actually receive mail.
• Create a second administrator account as a backup login path.
• Save your database credentials somewhere safe — you’ll need them for Method 2 if it ever happens again.

Frequently Asked Questions

I got locked out after too many failed login attempts — is that different?
Yes — that’s a security plugin (or your host) temporarily blocking your IP, not a lost password. Wait the cooldown period, or check your security plugin’s settings for an unlock option. If you’re not sure which plugin is blocking you, deactivating plugins via FTP (rename the plugins folder) rules it out.

Is editing user_pass directly in phpMyAdmin safe?
Yes, as long as you set the field type to MD5 in the dropdown before saving. WordPress automatically upgrades it to a more secure hash the moment you log in successfully.

What if I don’t know my username either?
Check the wp_users table in phpMyAdmin — the user_login column lists every account. You can reset the password for any of them using Method 2.

Could this mean my site was hacked?
Not necessarily — forgotten passwords are far more common. But if your password suddenly stops working with no explanation and you didn’t change it, it’s worth a quick check against our hacked WordPress site guide.

Conclusion

A lost WordPress password is never permanent — you always have a way back in, whether it’s the email link, a quick edit in phpMyAdmin, WP-CLI, or a temporary line of code. Once you’re back in, set up a password manager and a second admin account so the next lockout, if it ever happens, takes thirty seconds instead of thirty minutes.