Locked out of WordPress admin? Reset the password from the server

1. Reset the password with WP-CLI (best)

WP-CLI is WordPress's command-line tool. Run it as the user PHP runs as, from the site's folder. First see who the admins are:

cd /var/www/example.com
sudo -u www-data wp user list --role=administrator --fields=ID,user_login,user_email

Then set a new password. With --prompt, WP-CLI asks for it, so the password doesn't end up in your shell history:

sudo -u www-data wp user update admin --prompt=user_pass

In our test, it said Success: Updated user 1., and the new password worked straight away. You can also write --user_pass="..." on the same line, but then the password is saved in ~/.bash_history.

If a broken plugin or theme stops WP-CLI from working, add --skip-plugins --skip-themes. In our test, WP-CLI still worked with them.

2. No WP-CLI? Use the database

Find the database name and table prefix in wp-config.php (DB_NAME and $table_prefix, usually wp_). Then:

sudo mysql wordpress

UPDATE wp_users SET user_pass = MD5('a-long-new-password') WHERE user_login = 'admin';

MD5 is an old, weak way to store passwords, so that may look wrong. But WordPress only uses it to recognise you once. In our test, the login worked, and right after it WordPress replaced the MD5 value with its normal strong one (it starts with $wp$2y$). Log in once right away, so the weak value doesn't stay in the database.

The SQL line is saved in ~/.mysql_history. Use a temporary password, log in, then change it in your profile.

3. Make a new admin instead

If you don't know which account is yours, or the old account was changed, make a fresh one:

sudo -u www-data wp user create rescue you@example.com --role=administrator --prompt=user_pass

Log in with it, sort things out, and then remove the one you don't need. When you delete a user, move their posts to someone else, or they're deleted too:

sudo -u www-data wp user delete rescue --reassign=1

4. A security plugin locked you out

Login limiters, firewalls and two-factor plugins can lock out the owner too, for example after a few wrong passwords, or when you lose the phone with your codes. In our test, a plugin like that showed "Too many failed attempts" even with the right password.

Turn it off with WP-CLI:

sudo -u www-data wp plugin list --status=active
sudo -u www-data wp plugin deactivate plugin-name

That worked in our test: the next login went through.

Without WP-CLI, rename its folder in wp-content/plugins. WordPress can't find the plugin, so it doesn't run:

sudo mv wp-content/plugins/plugin-name wp-content/plugins/plugin-name.off

One catch from our test: renaming only hides the plugin. WordPress still had it saved as "active", and when we renamed the folder back, it was on again and locked us out again. After you log in, open the Plugins page once (WordPress then notices the plugin is missing and turns it off). Rename the folder back only after that, then fix its settings or set up two-factor again.

5. The reset email never arrives

If "Lost your password?" says the email was sent but nothing comes, your server probably can't send email that inboxes trust. Reset the password as in step 1 for now, then fix email for good: see emails from your PHP site land in spam. Password resets, order emails and contact forms all depend on it.

6. After you're back in: check for strangers

Being locked out is sometimes a sign that someone else got in and changed things. Check:

• Admins you don't know. Run the wp user list --role=administrator command from step 1. In our test it also showed when each account was made, if you add user_registered to the fields. An admin made recently, by no one you know, is a bad sign.
• The email on your own account. An attacker may have changed it, to receive your reset emails.

If anything looks wrong, log everyone out, so that stolen login cookies stop working. This logged out all sessions in our test:

sudo -u www-data wp user list --field=ID | xargs -I{} sudo -u www-data wp user session destroy {} --all

Then change all admin passwords, and follow what to do when your site has been hacked.

Don't get locked out next time

• Keep your passwords in a password manager.
• When you set up two-factor login, save the backup codes somewhere safe.
• Make sure the site can send email, so password resets work.
• Install WP-CLI now, before you need it. See hardening WordPress for more.

Quick list

• New password: sudo -u www-data wp user update admin --prompt=user_pass.
• No WP-CLI: UPDATE wp_users SET user_pass = MD5('...') WHERE user_login = 'admin';, then log in right away.
• Plugin locked you out: wp plugin deactivate, or rename its folder and open the Plugins page before renaming it back.
• No reset email: reset from the server, then fix email sending.
• Afterwards: check the admin list, and log everyone out if anything looks wrong.

Official sources

• Resetting your password (WordPress.org)
• wp user update, wp user create and wp user session destroy (WP-CLI)
• wp plugin deactivate (WP-CLI)

Next steps: lock down the login page with rate limiting and Fail2ban, and go through the WordPress hardening guide.

ServerNest is being built to list each site's admin accounts and warn you about new ones. Join early access to try it first.

← Back to the security blog