Guide

Locked out of wp-admin? Here's how to regain control safely.

by Ken Armitt, Founder · updated 31 July 2026

If your admin account was changed or deleted, regain access through your host — reset the password in the database or create a fresh admin via phpMyAdmin or WP-CLI — then immediately audit the users table for accounts the attacker added. Regaining access is only step one: the backdoor that let them in is still there, so rotate every credential and find the entry point.

Getting back in

You don't need the stolen login. Through your hosting control panel you can reset your user's password directly in the database (the wp_users table, password field, via phpMyAdmin) or, more cleanly, create a new administrator with WP-CLI (wp user create) or by adding a user in the database and elevating them. If a rogue plugin is blocking access, rename the plugins folder over SFTP to disable them all, then log in.

Find the accounts they added

Attackers routinely add their own administrator so that "changing your password" doesn't lock them out. Review every user with an admin role, check for accounts you don't recognise or odd registration dates, and remove them. Check the roles too — a hidden admin sometimes hides as a subscriber with elevated capabilities set in the database.

Now lock it down

Rotate the passwords for WordPress, hosting, database, SFTP and email. Update or replace outdated plugins and themes — the way in was very likely one of them or a reused password. Then confirm there are no backdoors left seeding new admins, because if there are, you'll be locked out again by the weekend.