If you're locked out of your WordPress admin after a hack, you can regain access by resetting your credentials directly through your database or hosting tools — no working login is required. Hackers commonly change admin passwords, delete admin accounts, or alter email addresses to maintain control of your site. This guide walks you through every proven recovery method in plain language, then shows you how to lock things down so it never happens again.
Why Hackers Lock You Out of WordPress
Understanding the attacker's goal helps you respond correctly. When a hacker gains access to your WordPress site, locking you out is a deliberate step to buy time. Common tactics include:
- Changing your admin password so your credentials stop working
- Changing the admin email address so password-reset emails go to them
- Deleting your administrator account entirely
- Adding a rogue admin account they control while leaving yours intact
- Modifying
wp-login.phpor.htaccessto block the login page for everyone but themselves - Installing a backdoor so they can re-enter even after you regain access
Knowing which of these happened guides which recovery method you use first.
Before You Start: Safety Checks
Do not attempt to log in repeatedly
Repeated failed login attempts can trigger lockout plugins the hacker may have configured, or alert them that you are active.
Contact your web host immediately
Your hosting provider can confirm whether your site files have been altered, restore a recent backup, and help you access phpMyAdmin or file management tools. Many hosts have a dedicated security or abuse team. Call or live-chat — do not rely solely on email if your site email is also compromised.
Check whether a backup exists
Before making any changes, ask your host if they hold automated backups. Restoring a clean backup from before the hack is always the fastest and safest recovery path if one is available and recent enough.
Method 1: Reset Your Password via the WordPress Login Page
This is the first thing to try and takes 30 seconds.
- Go to
https://yoursite.com/wp-login.php - Click "Lost your password?"
- Enter your admin username or the email address registered to that account
- Check your email inbox (and spam folder) for the reset link
- Follow the link and set a new, strong password
Why this may fail after a hack: The attacker likely changed the email address on your account, so the reset email goes to them, not you. If you do not receive the email within a few minutes, move to Method 2.
Method 2: Reset the Admin Password via phpMyAdmin
phpMyAdmin gives you direct access to your WordPress database, where all user credentials are stored. This method works even if the attacker changed your email address.
Step 1: Access phpMyAdmin
Log in to your hosting control panel (cPanel, Plesk, or your host's custom panel). Look for phpMyAdmin under the Databases section and open it.
Step 2: Select your WordPress database
In the left panel, click on your WordPress database. If you are unsure of the name, open your wp-config.php file — the database name is on the line:
define( 'DB_NAME', 'your_database_name' );
Step 3: Open the users table
Click on the wp_users table (your prefix may differ — it could be mywp_users if a custom prefix was set). You will see a row for each WordPress user.
Step 4: Edit your admin account
Find your admin username in the user_login column. Click Edit on that row.
Step 5: Set a new password
Find the user_pass field. In the Function dropdown next to it, select MD5. Then type your new password in the Value field and click Go.
Why MD5 here? WordPress actually uses a stronger hashing scheme (phpass), but phpMyAdmin's MD5 selection triggers WordPress to recognise and then upgrade the hash automatically on first login. This is the standard, safe method.
Step 6: Update the email address
While still in the edit view, correct the user_email field to your real email address so future password resets reach you.
Step 7: Log in
Return to wp-login.php and log in with your username and the new password.
Method 3: Reset the Admin Password via WP-CLI
If your hosting plan includes SSH access and WP-CLI is installed (common on managed WordPress hosts and many VPS plans), this is the fastest method.
bash wp user update YOUR_USERNAME --user_pass="NewStr0ngP@ssword!" --allow-root
Replace YOUR_USERNAME with your actual admin username. To find your username if you are unsure:
bash wp user list --role=administrator --allow-root
To update the email address at the same time:
bash wp user update YOUR_USERNAME --user_email="you@yourdomain.com" --allow-root
WP-CLI commands run directly against the database and take effect immediately.
Method 4: Create a New Admin Account via phpMyAdmin
If your admin account has been deleted entirely, you need to create a new one. This requires two steps in the database.
Step 1: Insert a new user into wp_users
In phpMyAdmin, click on your wp_users table, then click the Insert tab. Fill in:
| Field | Value |
|---|---|
user_login |
your chosen username |
user_pass |
your password (set Function to MD5) |
user_email |
your real email address |
user_registered |
current date/time in format 2024-01-15 10:00:00 |
user_status |
0 |
display_name |
your display name |
Click Go. Note the ID number assigned to this new row.
Step 2: Insert capabilities into wp_usermeta
Click on the wp_usermeta table, then Insert. Add two rows:
Row 1:
| Field | Value |
|---|---|
user_id |
the ID from Step 1 |
meta_key |
wp_capabilities |
meta_value |
a:1:{s:13:"administrator";b:1;} |
Row 2:
| Field | Value |
|---|---|
user_id |
the ID from Step 1 |
meta_key |
wp_user_level |
meta_value |
10 |
Note: If your database uses a custom prefix (e.g.,
mywp_), the meta_key values should bemywp_capabilitiesandmywp_user_level.
Click Go, then log in with your new account.
Method 5: Create a New Admin Account via FTP and a PHP File
If you have FTP access but not database access, you can create a new admin account by temporarily adding a PHP file to your site.
Step 1: Create the file locally
Open a text editor and paste this code. Replace the placeholder values:
php
set_role( 'administrator' ); echo 'Recovery admin created successfully.'; ?>Save the file as recovery-admin.php.
Step 2: Upload via FTP
Connect to your site via FTP (using FileZilla or your preferred client) and upload recovery-admin.php to the root WordPress directory — the same folder that contains wp-config.php.
Step 3: Run the file
In your browser, visit: https://yoursite.com/recovery-admin.php
You should see the success message.
Step 4: Delete the file immediately
This is critical. Return to your FTP client and delete recovery-admin.php right away. Leaving this file on your server is a serious security risk — anyone who knows or guesses the URL could run it.
Step 5: Log in
Go to wp-login.php and log in with recovery_admin and the password you set.
Method 6: Restore from a Clean Backup
If your host maintains automated backups and you have one from before the hack occurred:
- Confirm the backup date predates the attack (check your server access logs or Google Search Console for the first signs of compromise)
- Ask your host to restore to that backup, or use your hosting panel's backup restore feature
- Change all passwords immediately after restoration — your old credentials may have been the attack vector
- Apply any WordPress core, theme, and plugin updates that were pending at the time of the backup
Restoring a backup removes malware that was injected post-compromise, but does not close the vulnerability that allowed the breach. You must still investigate and fix the root cause.
After Regaining Access: Securing Your Site
Regaining entry is only half the job. If you stop here, you will likely be locked out again within hours or days.
Audit all user accounts
In WordPress, go to Users → All Users. Look for:
- Accounts you do not recognise
- Legitimate-looking usernames with slight spelling variations
- Accounts with Administrator role that should not have it
Delete any suspicious accounts. Change passwords on all remaining admin accounts.
Scan for malware and backdoors
Hackers almost always install backdoors — hidden files or code that let them re-enter even after you change your password. Use a reputable scanner:
- Wordfence Security (free tier available) — scans core files, themes, and plugins against known-good versions
- Sucuri SiteCheck (
sitecheck.sucuri.net) — free remote scanner - Your host's built-in malware scanner if available
CISA (the Cybersecurity and Infrastructure Security Agency) recommends assuming that any compromised system contains persistent access mechanisms until proven otherwise. Treat your site the same way.
Check and clean wp-config.php and .htaccess
Open these files via FTP or your host's file manager and look for:
- Unfamiliar code blocks, especially obfuscated strings with
base64_decode,eval, orgzinflate - Redirects you did not add
- Unfamiliar
FilesMatchorRewriteRuledirectives in.htaccess
Compare your wp-config.php against a clean copy from the WordPress GitHub repository if in doubt.
Update everything immediately
According to Google Search Central, the majority of WordPress compromises exploit known vulnerabilities in outdated plugins, themes, or WordPress core. After recovery:
- Dashboard → Updates — apply all available updates
- Remove plugins and themes you are not actively using
- Download plugins only from the official WordPress.org repository or trusted commercial sources
Change all access credentials
After a breach, change every password associated with your site:
- WordPress admin accounts
- Hosting control panel (cPanel, Plesk, etc.)
- FTP/SFTP credentials
- Database password (and update
wp-config.phpto match) - Email accounts used for WordPress notifications
Enable two-factor authentication
Install a 2FA plugin such as WP 2FA or enable 2FA through your security plugin. This means even if a hacker obtains your password in future, they cannot log in without your second factor.
Implement a Web Application Firewall (WAF)
A WAF sits in front of your site and blocks malicious requests before they reach WordPress. Options include Cloudflare's free plan, Wordfence's built-in firewall, or Sucuri's WAF service. OWASP (the Open Web Application Security Project) classifies WAFs as an important layer of defence-in-depth for web applications.
Notify relevant parties if needed
If your site collected or processed user data and you are subject to GDPR or similar regulations, a breach that exposed user data may trigger mandatory notification obligations. Consult a legal professional if this applies to you.
Frequently Asked Questions
How do I know if my WordPress site has actually been hacked versus just a forgotten password?
Signs that point to a hack rather than a simple forgotten password include: your password reset email never arrives (email address was changed), you see unfamiliar admin accounts, Google flags your site as dangerous in search results, your host has suspended your account for malware, or your site is redirecting visitors to other websites. A forgotten password is solved by the standard reset email; if that fails, assume a compromise.
Will changing my password be enough to remove a hacker from my site?
No. Changing your password stops the attacker from using your credentials, but it does not remove backdoors, malicious files, or rogue admin accounts they have already planted. You must scan for malware, audit all user accounts, and update all software after regaining access.
Can my host recover my WordPress site for me?
Many managed WordPress hosting providers offer malware removal as part of their service or as a paid add-on. Hosts running cPanel or Plesk typically have access to automated backups they can restore on request. Contact your host's support team as your very first step — they have server-level access you do not have from the WordPress dashboard.
How did the hacker get in if my password was strong?
Strong passwords help but do not guarantee security. Common entry points identified by OWASP include: vulnerable or outdated plugins and themes, compromised FTP credentials, brute-force attacks against accounts without 2FA, SQL injection through insecure plugins, cross-site scripting (XSS) attacks, and compromised themes or plugins downloaded from unofficial sources. After recovery, an audit of your installed plugins and their versions usually reveals the likely culprit.
How can I prevent being locked out again in the future?
Key preventive measures include: keeping WordPress core, plugins, and themes updated at all times; enabling two-factor authentication on all admin accounts; using a Web Application Firewall; limiting login attempts with a plugin; taking regular automated backups stored off-site; and using a security plugin that monitors file changes. Google Search Console also provides early warnings of security issues — connect your site and monitor its alerts.