Option 1: Do it yourself
Follow the steps in this guide. Free, and typically 30 minutes to a few hours of careful work.
Option 2: Just contact us
Skip every step below. $49/mo and it is sorted, or WhatsApp us right now.
Last updated: August 2026
Route 1: The password reset actually works more than people think
Click "Lost your password?" on the login page. If the email never arrives, check spam, then remember that WordPress email delivery breaks constantly; the reset may have been sent into the void. That is a fixable problem on its own, covered in our contact form email guide, but for right now, move to route 2.
Route 2: Reset the password in the database
Open phpMyAdmin from your hosting panel, select your site's database, and open the table ending in _users. Find your username, click Edit, and in the user_pass field choose MD5 from the function dropdown, type a new password, and save. Log in with it immediately and change it again from inside WordPress. Total time: three minutes, and no code required.
Route 3: Create a brand new admin user
If your account was deleted or demoted, sometimes by malware, sometimes by a colleague's misclick, insert a fresh admin through phpMyAdmin: add a row to _users (username, MD5 password, email), note its ID, then add two rows to _usermeta for that ID: wp_capabilities with the value a:1:{s:13:"administrator";b:1;} and wp_user_level with the value 10. If an unknown admin already exists in that table, stop and treat this as a hacked site, because attackers create admins exactly this way.
Route 4: A plugin is blocking the login page
Security plugins cause a huge share of lockouts: too many failed attempts, a changed login URL you forgot, an IP block, or two-factor tied to a phone you replaced. Via the file manager, rename that plugin's folder inside /wp-content/plugins to deactivate it, log in, then reconfigure it properly. If a plugin changed your login URL, check your setup emails for the custom address before assuming the worst.
Route 5: The error-message decoder
"Incorrect password" means the account exists: routes 1 and 2. "Not registered on this site" on multisite means your user belongs to another subsite. A blank page or redirect loop at login is usually a plugin or cookie conflict: clear cookies, then route 4. "You do not have sufficient permissions" after logging in means your role was demoted: route 3 territory, and worth a malware scan.
The prevention list
A password manager for the business, not one person's memory. Two admin accounts held by different people, so one lockout is never total. Two-factor with backup codes stored somewhere real. And an access audit twice a year, because the scariest lockout is discovering the only admin left the company in March. All of this is part of onboarding on our maintenance plans, precisely because we get the "locked out and the developer vanished" call every month.
FAQ
I never had the hosting login either. Am I stuck? The hosting account can be recovered through the host's own support with billing verification. Domain, hosting and WordPress are three separate doors; recover them in that order.
Could the lockout mean I was hacked? Sometimes. Changed passwords you did not change, unknown admin users, or a login page redirecting somewhere strange are hack signals. Regain access via the database, then run the full security checks.
Is editing the database safe? The two edits above are routine and low-risk, but take a database backup first from phpMyAdmin's export tab; sixty seconds of caution covers every mistake.
Can you just do this for me? Yes. Lockout recovery is a standard flat-rate fix, usually resolved within the hour with hosting access.
You do not have to do any of this yourself
Skip the steps above. Our engineers handle security, updates, speed, backups and fixes for you, with a 12-minute average response and a 99.99% uptime target.