How to Add a WordPress Admin User via phpMyAdmin

Before you start: export the database. A mistyped INSERT is easy to undo with a backup and tedious without one — how to back up a WordPress site covers the quickest way to get a copy.

Two tables are involved. Inserting into wp_users alone creates an account that can log in and do nothing; the role lives in wp_usermeta.

Step 1: find the table prefix

Open wp-config.php and read:

<?php
$table_prefix = 'wp_';

Many hosts randomise this. Every statement below must use the real prefix, including inside the meta key names.

Step 2: insert the user

In phpMyAdmin, select the database, open the SQL tab and run:

INSERT INTO wp_users
    (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
VALUES
    ('rescue', MD5('a-long-unique-passphrase'), 'rescue', 'you@example.com', NOW(), 0, 'Rescue Admin');

Note the new row's ID. If phpMyAdmin does not show it, find it:

SELECT ID FROM wp_users WHERE user_login = 'rescue';

You can also do this through the interface: open wp_users, choose Insert, fill in the fields, and select MD5 in the Function column beside user_pass.

Step 3: grant the administrator role

Replace [ID] with the number from the previous step:

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES ([ID], 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES ([ID], 'wp_user_level', '10');

Two details matter:

• The meta_value for capabilities is a serialised PHP array. Copy it exactly — the numbers in a:1: and s:13: are lengths, and changing a character breaks it.
• The meta keys are prefixed. On a site with prefix xy_, they are xy_capabilities and xy_user_level, even though the table is xy_usermeta.

wp_user_level is legacy but some older code still reads it, so it costs nothing to include.

Step 4: log in and tidy up

Go to /wp-login.php and sign in with the new credentials. If the account works:

1. Change the password from within WordPress so it is hashed with the current algorithm.
2. Fill in the profile — first name, display name — so the account is identifiable later.
3. Check Users for accounts you do not recognise.
4. Delete the rescue account when the real one is restored, and reassign its content rather than deleting it.

If the login fails

Easier alternatives when you have them

WP-CLI, if SSH is available:

wp user create rescue you@example.com --role=administrator --user_pass='a-long-unique-passphrase'

A must-use plugin, if you have file access but no database access. Create wp-content/mu-plugins/rescue.php:

<?php
add_action('init', function () {
    if (username_exists('rescue')) {
        return;
    }

    $id = wp_create_user('rescue', 'a-long-unique-passphrase', 'you@example.com');

    if (! is_wp_error($id)) {
        (new WP_User($id))->set_role('administrator');
    }
});

Load one page, then delete the file. Leaving it in place means anyone who reads it has your credentials.

If you only need to get back into an existing account rather than create a new one, resetting the admin password is less invasive.

A note on why you were locked out

Creating an emergency administrator is a symptom, not a cure. Work out which it was: a forgotten password, a broken email pipeline, a plugin that removed your capabilities, or someone else changing your account. That last case needs the full response in how to fix a hacked WordPress site — an attacker who can edit the users table can also do everything else.