How to Reset a WordPress Admin Password

Start with the simplest route you have access to. If site email works, the reset link at /wp-login.php?action=lostpassword takes thirty seconds. If it does not, use WP-CLI where you have SSH, phpMyAdmin where you have the hosting panel, and the code methods when you only have file access.

Method 1: the password reset email

Go to the login page, click Lost your password?, and enter the username or email address.

If nothing arrives:

• check spam, and wait a couple of minutes;
• confirm the address on the account is one you can read;
• remember that many sites simply cannot send mail — see WordPress not sending emails.

Do not repeat the request many times. Some hosts rate-limit outbound mail, which makes the situation worse.

Method 2: WP-CLI

The cleanest method when you have SSH access.

# List users to find the right ID or login.
wp user list --fields=ID,user_login,user_email,roles

# Set a new password.
wp user update 1 --user_pass='a-long-unique-passphrase'

# Or change the email first, then use the normal reset flow.
wp user update 1 --user_email='you@example.com'

WP-CLI hashes the password correctly and clears the relevant caches. Nothing else is needed.

Method 3: phpMyAdmin

1. Open phpMyAdmin from the hosting panel and select the site's database.
2. Open the wp_users table — the prefix may differ.
3. Find the user row and click Edit.
4. In user_pass, choose MD5 in the Function column and type the new password in the Value field.
5. Save.

WordPress still accepts MD5 hashes for login and upgrades them to its current algorithm on first use. If the Function dropdown is unavailable, generate a bcrypt-style hash elsewhere and paste it in — but never paste a plain-text password into that column, since it will not match anything.

While you are in the table, check user_email is correct and note whether any accounts you do not recognise exist. Unknown administrators are a sign of compromise — see how to fix a hacked WordPress site.

Method 4: a temporary must-use plugin

When you have file access but no database access. Create wp-content/mu-plugins/reset.php:

<?php
add_action('init', function () {
    $user = get_user_by('login', 'admin');   // change to your username

    if ($user) {
        wp_set_password('a-long-unique-passphrase', $user->ID);
    }
});

Load any page of the site once, then delete the file immediately. While it exists, the password is reset on every request and the credential is sitting in a readable file.

The same technique works in a theme's functions.php, but a must-use plugin survives a theme switch and is easier to remember to remove.

Method 5: create a new administrator instead

If the account is damaged rather than merely locked, it is often faster to create a fresh administrator:

wp user create rescue you@example.com --role=administrator --user_pass='a-long-unique-passphrase'

Without SSH, the same result can be achieved through the database — the full process is in how to add a WordPress admin user via phpMyAdmin.

When the new password still will not work

Once you are back in

• Set a long, unique password stored in a password manager rather than something you can type from memory.
• Fix email delivery so the ordinary reset route works next time.
• Enable two-factor authentication for administrator accounts.
• Remove any temporary file, snippet or rescue account you created.
• Check the user list for accounts that should not exist, and review recent login activity if your security plugin records it.