How to reset a WordPress admin password: 6 methods that work when you're locked out

TL;DR: Try the "Lost your password?" email link first, because it is the safest. If the email never arrives or you no longer have access to that address, reset the password with WP-CLI, edit the user row in phpMyAdmin, use your hosting panel's WordPress tool, or add a one-line temporary snippet to your theme's functions.php. If you do not know which accounts are administrators, create a new one from the command line. After any reset, remove temporary code, check for unknown admin users, and turn on two-factor authentication.

Before you start

Two minutes of preparation saves a bad day.

• Take a backup if you plan to touch the database or files. See how to back up a WordPress site properly.
• Work out whether you simply forgot the password or whether the account was changed. If you did not change the password and the email on the account is not yours, treat it as a possible break-in and read what to do in the first 60 minutes of a hack before you do anything else.
• Know your table prefix. The default is wp_, so the users table is wp_users. If your prefix differs, you will see it in wp-config.php as $table_prefix.

Method 1: the Lost your password link

This is the official first step and needs no technical skill.

1. Go to yoursite.com/wp-login.php.
2. Click Lost your password?
3. Enter your username or the email address on the account.
4. Open the email and follow the reset link.
5. Choose a new password and log in.

If the email never arrives, the cause is usually mail delivery, not the reset itself. WordPress sends this message with its default mail function, which many servers and inboxes treat with suspicion. Check spam first. If the problem is recurring, see why OTP and transactional emails land in spam. For this lockout, move to a method below.

Method 2: WP-CLI

If you have SSH access, this is the fastest and cleanest method. Run it from the WordPress directory.

wp user list
wp user update 1 --user_pass='NewStrongPassword!'

Replace 1 with the ID of the user from the list. To avoid leaving the password in your shell history, ask WP-CLI to prompt for it instead:

wp user update 1 --prompt=user_pass

If you are not sure WP-CLI is installed, run wp --info. Many VPS plans and managed hosts include it. Key-based SSH access is covered in SSH hardening.

Method 3: phpMyAdmin

Use this when you have database access but no shell. WordPress's own documentation warns to use phpMyAdmin at your own risk, so keep the backup handy.

1. Open phpMyAdmin from your hosting panel and select your WordPress database.
2. Open the wp_users table (adjust the name if your prefix differs).
3. Click Browse, find your username in the user_login column and click Edit.
4. In the user_pass row, delete the old value and type the new password.
5. In the Function dropdown on that row, choose MD5.
6. Click Go, then log in.

WordPress accepts the MD5 value and upgrades it to its stronger hashing on your next login, so you are not left with a weak hash. Do not skip choosing MD5, or the plain text you typed will not work as a password and will sit in the table.

Method 4: your hosting panel

Many hosting control panels include a WordPress management tool that can reset a user's password or log you in directly. It is often the easiest option on shared hosting, because you do not need SSH or database knowledge. Look for a WordPress manager or an installed-applications section in your panel, and check your host's help pages for the exact steps.

If your host offers staging, apply the fix there first if you want to test it. The staging approach is covered in how to set up a proper staging environment.

Method 5: a temporary line in functions.php

This works if you can edit files by FTP or the panel's file manager, and you know the administrator's user ID, which is usually 1.

1. Open your active theme's functions.php.
2. Add this line immediately after the opening <?php:

wp_set_password( 'my_new_password', 1 );

3. Save the file, then load any page on your site once.
4. Log in with the new password.
5. Remove the line straight away.

The password is reset on every page load while the line is there. If you leave it in, anyone who has access to see your file or the password you wrote there is exposed, and every future change to your password will be overwritten. If you are using a child theme, edit that file so a theme update does not erase your work, as explained in child themes explained.

Method 6: create a new administrator

If you cannot remember which account is the administrator, or the old one seems compromised, add a fresh one with WP-CLI:

wp user create recovery [email protected] --role=administrator --prompt=user_pass

Log in with it, review the existing users, then fix or remove accounts as needed. Delete the recovery account when you are done if you do not need it. If you did not create an administrator you find in the list, assume someone else did.

Which method to choose

Situation	Best method
You can receive email at the account address	Method 1, the reset link
You have SSH	Method 2, WP-CLI
Database access only	Method 3, phpMyAdmin
Shared hosting with a WordPress tool	Method 4, hosting panel
FTP or file manager only	Method 5, functions.php
Unsure which account is admin	Method 6, new administrator
You suspect a hack	Stop. Follow the hack response guide first

After you get back in

Getting access back is the start of the job, not the end.

1. Remove any temporary code. Check functions.php and any other file you touched.
2. Review the user list. Delete or demote any administrator you do not recognise.
3. Change related passwords. If the same password is used elsewhere, such as email, hosting or database, change those too.
4. Check the email on your account. Make sure the address is one you control, or you will be locked out of the reset link next time.
5. Turn on two-factor authentication. The choices are compared in two-factor authentication for WordPress.
6. Limit login attempts. Reduce brute-force exposure with the wp-admin login protections.
7. Use a password manager. A unique password per site stops a single leak from opening everything.

FAQs

I never received the password reset email. What now?

Check spam, confirm the address on the account is correct and try again. If it still does not arrive, use WP-CLI, phpMyAdmin, your hosting panel or the functions.php method, none of which depend on email.

Is it safe to reset a password in phpMyAdmin?

It is safe if you follow the steps exactly and take a backup first. The key detail is to select MD5 in the Function dropdown for the password field. WordPress upgrades the hash to a stronger one when you next log in.

Why must I remove the functions.php line?

Because the password is reset on every page load while the line is present. Leaving it in means your normal password changes are overwritten and the new password sits in a file.

What if I do not know my username?

Use WP-CLI's wp user list, or browse the wp_users table in phpMyAdmin, to see usernames. If you are still stuck, create a new administrator as in Method 6.

I changed the password but still cannot log in.

Clear your browser cookies, or try a private window. Also check whether a security or login plugin is blocking you, or whether a caching layer is serving a stale login page. A redirect loop at login has its own causes, covered in too many redirects on WordPress.

Could someone else have reset my password?

Possibly. If you did not request it, treat it as a security incident. Reset from a clean device, review users and recent file changes, and scan the site as described in malware scanning tools for WordPress.

Should I keep the default admin username?

No. A predictable username makes brute-force attacks easier. Create a differently named administrator and remove or demote the old one.

Can I reset the password on a WooCommerce store without losing orders?

Yes. Resetting a password changes only the user record, not orders or products. Take a backup first, as you would before any database change.

Conclusion

Start with the email link, and if that fails use WP-CLI, phpMyAdmin, your hosting panel or a temporary snippet. Whatever you use, clean up afterwards and add two-factor authentication so you are not locked out again. If you suspect that anyone but you changed the password, deal with security before convenience.

HostCloud's hosting includes the access tools and support that make recovery quick. See our plans at https://hostcloud.in.

Sources:

• Reset your password, WordPress.org documentation