How to Reset a Lost WordPress Password

Losing access to your WordPress account can feel frustrating and overwhelming. Without the right guidance, the recovery process might seem daunting. This guide simplifies the steps to help you regain control quickly and securely.

Recovering a password or username is essential for keeping your website safe and running smoothly. This article provides practical solutions, from resolving a lost WordPress password to troubleshooting common recovery problems. It also explains preventive measures to avoid similar issues in the future.

Whether the reset email isn't arriving or a forgotten username is the problem, there is a way back in. The methods below run from the simplest to the most technical, and every one of them keeps your site secure while it restores your access.

If the site is a business you cannot afford to have offline while you work through this, our urgent WordPress support team can take it off your hands the same day. Otherwise, start at the top and work down.

Step-by-Step Password Recovery for WordPress

Losing access to your WordPress account can feel stressful. Fortunately, several recovery methods are available, and which one you reach for depends on what you can still get into: your email, your hosting panel, or the server itself.

Using the 'Lost Your Password?' Feature

This built-in tool is the quickest way to recover access.

• Steps to Use the Recovery Link:
  • Go to your WordPress login page (e.g., yourdomain.com/wp-login.php).
  • Click on the 'Lost your password?' link below the login form.
  • Enter your username or email associated with the account.
  • Press the "Get New Password" button.
• WordPress sends a password reset email if the username or email matches a registered account.
• Common Errors and Fixes:
  • Incorrect Email or Username: Double-check for typos before submitting the form.
  • Spam Folder Issues: Password reset emails sometimes land in spam folders. Check there if you don't see it in your inbox.
  • Not Receiving Any Email: If you're not receiving emails, the issue may involve your hosting server or WordPress email settings (covered below).

Pro Tip: Use a strong password after resetting. Password managers can help generate secure options.

Troubleshooting WordPress Not Sending Password Reset Emails

If the reset email isn't arriving, the problem is almost never WordPress itself. It is one of the handful of places a message can be dropped between your site and your inbox.

Here's how to work through it:

• 1. Check Your Spam Folder:
  Emails from WordPress might be flagged as spam. If you find one in your spam or junk folder, mark it as "Not Spam."
• 2. Verify Your Email Address:
  Please ensure the email address you entered is correct. A typo will prevent the system from sending the reset email. If you're unsure, use different addresses you've used with WordPress in the past.
• 3. Use an Email Plugin for Better Deliverability:
  WordPress relies on PHP mail to send emails. The emails might fail if your hosting provider doesn't support this well. Installing a plugin like WP Mail SMTP can resolve this issue:
  • Install and activate the plugin.
  • Set up the plugin with your preferred SMTP service (e.g., Gmail, SendGrid).
  • Send a test email to ensure functionality.

This method improves reliability for all WordPress-related emails, including password resets.

What to Do If You Can't Log Into WordPress

Sometimes, the recovery link doesn't work, or emails still don't arrive. Here are alternative recovery options:

Accessing WordPress via Database

If the usual methods fail, you can reset the password directly in the database. Take a database backup before you touch anything, and if you have not opened phpMyAdmin before, our guide to cPanel for WordPress shows you where to find it.

1. Log in to your hosting control panel and open phpMyAdmin.
2. Locate your WordPress database from the list. If several are shown, the right one is named in the DB_NAME line of your wp-config.php file.
3. Find the wp_users table and click "Browse."
4. Search for your username, then select "Edit."
5. In the user_pass row, set the Function dropdown to MD5, then type your new password into the Value box.
6. Click "Go", then log in with that password straight away.

That MD5 step is the part almost everybody misses, and skipping it is why this method so often appears not to work.

Resetting the Password with WP-CLI

If your host gives you SSH access, this is the fastest route by a wide margin and the one we reach for first. WP-CLI is the official command line tool for WordPress, and most decent hosts have it installed already.

Connect over SSH, change into the folder holding your wp-config.php file, and list the accounts:

wp user list --fields=ID,user_login,user_email,roles

Once you can see which account you need, set a new password on it:

wp user update admin --user_pass='a-long-new-password'

Replace admin with your username, your email address, or the numeric ID from the first command. WP-CLI hashes the password correctly on the way in, so there is no MD5 step to remember and nothing to tidy up afterwards. If the command is not found, ask your host whether WP-CLI is available on your plan, as some of the cheaper shared plans disable it.

A note on the old emergency script: older tutorials suggest downloading an emergency.php file and uploading it to your web root. WordPress retired that script a long time ago, and an unmaintained PHP file sitting in your root that resets the administrator password is exactly what an attacker goes looking for. Use one of the methods above instead.

Modify the functions.php File

If you have access to your site files via FTP:

1. Navigate to your active theme's folder under /wp-content/themes/.

Open the functions.php file and add this at the very end:

add_action( 'init', function () {
    wp_set_password( 'your-new-password', 1 );
} );

1. Replace your-new-password with the password you want.
2. The 1 is a user ID, not a placeholder. It is usually the first account created on the site, which is often but not always yours. Confirm the right ID in the wp_users table first.
3. Save and upload the file, then load any page on the site once.
4. Log in, then delete the code immediately.

That last step matters more than it sounds. The snippet runs on every single request, so while it sits there your password is reset to the same value over and over, and anyone who can read that file can read the password in plain text. The wp_set_password reference covers the function in full.

When you can't log into WordPress, it's important to stay calm and follow these steps methodically. Whether you use the built-in recovery feature, troubleshoot email issues, or explore advanced recovery methods, the right approach will securely get you back into your account.

Pro Tip: Always back up your website and regularly test your password recovery system to prevent future disruptions.

Why You Were Locked Out in the First Place

It is worth knowing which of these you are dealing with, because two of them mean the password was never the real problem.

• You genuinely forgot it. The most common case, and the easiest. Any method above will fix it.
• A security plugin locked you out. Wordfence, Solid Security and similar plugins block an IP address after a handful of failed attempts. The password is fine; your address is banned. Waiting out the lockout usually clears it, or you can rename the plugin's folder in /wp-content/plugins/ over FTP to switch it off temporarily.
• You are on the wrong login URL. Plenty of sites move wp-login.php somewhere else for security. If /wp-login.php now returns a 404 rather than a login form, the address has been changed rather than broken.
• The admin email was changed. If reset emails arrive nowhere and the address on the account is not one you own, somebody else has been in the account. Do not simply reset the password and carry on. Read the section below, and treat the site as compromised until you have checked it.
• The site cannot send mail at all. Covered above, and by some distance the most frequent cause of "the reset link never arrives".

Recovering Your WordPress Username

Forgetting your WordPress username can be frustrating. Without it, logging in becomes impossible. Thankfully, several ways exist to recover it and regain access to your site.

When You Forget Your WordPress Username

Finding your username is often straightforward if you know where to look.

• Check Your Database:
  1. Log into your hosting control panel and open phpMyAdmin.
  2. Locate your WordPress database in the list.
  3. Find the wp_users table. This stores all user information.
  4. Look for your email address or ID. The username will be listed in the user_login column.
• Search Past Emails:
  If your database access is limited, look through old emails sent by WordPress. These might include account details, including the username. Search your inbox for terms like "WordPress login" or "Your account has been created."
• Use Hosting Tools:
  Many hosting providers offer user management options in their control panels. Navigate to the user section or check for logs containing account information. This can help retrieve your username quickly.

Pro Tip: Save usernames securely to avoid future recovery attempts.

Resetting the Username

WordPress gives you no way to change a username from the profile screen, but the username itself is not fixed. You can edit user_login directly in the wp_users table, run wp user update 1 --user_login=newname in WP-CLI, or take the route below.

• Create a New Admin User:
  1. Access your WordPress database via phpMyAdmin.
  2. Open the wp_users table. Click "Insert" to add a new row.
  3. Fill in user_login, user_email and user_pass, setting the Function dropdown on user_pass to MD5 as described above. Leave the ID field empty so the database assigns one.
  4. Note the ID the new row is given, then open the wp_usermeta table and insert two rows against that ID: wp_capabilities with the value a:1:{s:13:"administrator";b:1;}, and wp_user_level with the value 10.

  That second table is the one that actually grants the role. Older guides tell you to set user_level in wp_users instead, but that column has been deprecated since WordPress 3.0, and setting it on its own leaves you with an account that can log in and do nothing.

• Use an FTP Method:
  Another option involves editing the functions.php file in your active theme:
  1. Open the file via FTP.
  2. Add a code snippet to create a new admin user.
  3. Save changes and log in with the newly created credentials.
  4. Remove the code immediately to secure the file.

Recovering a WordPress username doesn't have to be complicated. With these steps, you can retrieve it or create a new one safely. Understanding how to reset WordPress username alternatives keeps your site accessible and secure.

What to Do Once You Are Back In

Getting the password reset is the visible half of the job. If you were locked out because somebody else got in, resetting it and moving on leaves them exactly where they were. Spend ten minutes on the following before you consider it closed.

Check the Administrator List

Open Users in the dashboard and filter by Administrator. Every account there should be a person you can name. Attackers routinely add a second administrator so that resetting the first one changes nothing, and they tend to give it a plausible name like "wpsupport" or "backup". Delete anything you do not recognise, and reassign its content rather than deleting it.

Change the Salts to Sign Everybody Out

Resetting your password does not end anyone else's session. WordPress keeps people logged in with cookies signed by eight secret keys in your wp-config.php file, and until those keys change, an existing session stays valid.

Visit the official salt generator, copy the eight lines it produces, and replace the matching block in wp-config.php. Every session on the site ends the moment you save it, including your own, so keep your new password to hand.

Confirm the Admin Email Address

Check both Settings, then General for the site address, and your own profile for the account address. Changing one of these is the quietest way to keep control of an account, because every future reset link goes somewhere you cannot read. WordPress emails the old address when this is changed, so it is worth searching your inbox for that notice too.

Look for What Let Them In

If there were accounts you did not create, the password was a symptom. Something gave them the access in the first place, usually an outdated plugin, and there is often a file left behind so they can return. A password change closes neither. Our WordPress security audit walkthrough covers what to check, and if you would rather not do it yourself, our malware recovery service cleans the site and tells you how they got in.

Preventive Measures for Password Security

Protecting your WordPress account starts with smart practices. Avoid the frustration of a forgotten password or somebody else getting in by putting a few things in place before you need them.

Enable Two-Factor Authentication

Adding an extra layer of security ensures that only authorised users can log in.

• How to Set Up 2FA:
  1. Install a two-factor authentication plugin like Google Authenticator or Wordfence Login Security.
  2. Configure the plugin and pair it with an app like Google Authenticator or Authy on your phone.
  3. After setup, you'll need your password and a code from the app to log in.
• Why It's Important:
  Two-factor authentication stops hackers even if they guess or steal your password. The additional code is time-sensitive and unique to your device, making unauthorised access nearly impossible.

Use Strong Passwords and Password Managers

Weak passwords are an open door to cyberattacks. Create stronger credentials and keep them secure.

• Tips for Strong Passwords:
  Use a mix of upper and lowercase letters, numbers, and symbols. Avoid predictable words like "password" or your name. Length adds strength, so aim for 12 or more characters.
• Use a Password Manager:
  Tools like LastPass or 1Password store and generate secure passwords. These tools eliminate the need to remember complex combinations and keep credentials encrypted.

Pro Tip: If you ever forget a WordPress password, these tools make resetting it much easier.

Keep a Second Administrator Account

Almost every situation in this article becomes a two minute fix if there is another administrator you can log in as. Create a second account with its own password and its own email address, ideally on a different provider to the first, so that a problem with one mailbox does not lock you out of the site.

Keep it to people who genuinely need it, though. Every administrator account is another way in, and an old one belonging to a developer who finished the job two years ago is a liability rather than a safety net. Reviewing the user list is part of what we do on every site under a WordPress maintenance plan, precisely because it is the sort of thing nobody remembers to do on their own.

Regularly Test Password Recovery Systems

Password recovery systems often go unchecked until something breaks. Testing them ensures smooth recovery when needed.

• Check Email Deliverability:
  WordPress relies on email for password resets. Send a test reset email to confirm that it has reached your inbox.
• Optimise Email Configuration:
  Ensure your hosting server has SPF, DKIM, and DMARC records. These prevent emails from being flagged as spam. To enhance email functionality, use plugins like WP Mail SMTP.

Pro Tip: Regular tests reduce downtime if you need to know how to reset a WordPress password quickly.

Back-Up Your Credentials

Losing access due to misplaced credentials is avoidable. Secure your information properly.

• Secure Storage Options:
  Use encrypted storage like Bitwarden or keep an offline record securely. Avoid saving passwords in plain text files or sticky notes.
• Update Regularly:
  Whenever you update passwords or add users, ensure backups reflect these changes.

Following these steps will strengthen your WordPress account and reduce the risk of security breaches. A little effort now can save you time and stress later.

Conclusion

Recovering your WordPress account doesn't have to feel overwhelming. Whether it's resetting passwords, fixing email issues, or securing login details, the right steps make the process simple. Taking proactive measures like enabling 2FA and using strong passwords ensures fewer problems in the future.

Managing a site has its challenges, and password recovery is only one of them. If you would rather somebody else handled the locked out mornings, the updates and the security checks, that is the whole of what we do on a WordPress maintenance plan.

If you are locked out right now and the site earns you money while it is up, get in touch and an engineer will pick it up today.

Frequently asked questions