Your site works fine for visitors. You just can't get into it.
That's a different kind of panic from a site being down — less urgent, more maddening, and the fixes depend entirely on how you're locked out. A redirect loop needs a completely different response from a security plugin ban, and trying the wrong one wastes time you'll spend staring at a login screen.
Six routes back in, ordered from safest to last resort. Work down and stop when you're in.
The short version
| What you're seeing | Likely cause | Route |
|---|---|---|
| Wrong password, reset email never arrives | Site can't send mail | Route 2 or 3 |
| Login page reloads endlessly | URL mismatch or cookies | Route 4 |
| "Too many login attempts" | Security plugin lockout | Route 5 |
| Logged in but no admin menu | Role or permissions damage | Route 6 |
| White screen at wp-admin | Plugin conflict, not a lockout | P11 |
Before anything: back up. Yes, even for a lockout. Several routes below involve editing the database directly.
Route 1 — The obvious ones, quickly
Thirty seconds each, and they resolve more cases than people expect.
Clear cookies for your site, or try a private window. WordPress authentication is cookie-based, and a stale cookie causes several lockout symptoms.
Try a different browser. Distinguishes a browser problem from a site problem instantly.
Check you're using the right URL — /wp-admin or /wp-login.php, and whether your site enforces https or www.
Confirm it's the right site. If you manage several, staging and live look identical at the login screen.
Route 2 — Password reset, properly
The standard reset relies on your site sending email — which is exactly what often doesn't work.
Click "Lost your password?" and wait a few minutes, checking spam.
If nothing arrives, that's diagnostic in itself: your site can't send mail. That's a common WordPress problem with its own fix, and it affects your order confirmations and form notifications too. The SMTP fix.
Meanwhile, reset the password directly through Route 3.
Route 3 — Reset the password in the database
The reliable route when email is broken. It sounds intimidating and takes about three minutes.
Via phpMyAdmin (in your hosting control panel):
- Select your WordPress database
- Open the
wp_userstable — your prefix may differ, e.g.wp_abc123_users - Find your user row and click Edit
- In the
user_passrow, set the Function dropdown to MD5 - Type your new password in the Value field
- Click Go
The MD5 dropdown is the part people miss. WordPress stores hashed passwords, so typing a plain password without selecting a hash function stores it literally and login still fails.
Note: WordPress will silently upgrade that MD5 hash to its stronger modern format the first time you log in with it, so this is safe as a recovery step.
If your host doesn't offer phpMyAdmin or you have WP-CLI access:
wp user update your-username --user_pass="NewPassword123"
Route 4 — Redirect loops
The login page reloads forever, or bounces between wp-admin and wp-login without ever letting you in.
Almost always a URL mismatch. WordPress stores your site address in the database, and if it doesn't match what you're actually visiting — www versus non-www, http versus https — WordPress redirects you to the "correct" address, which redirects you back.
The fix, in wp-config.php via FTP, above the "stop editing" line:
define( 'WP_HOME', 'https://yoursite.com' );
define( 'WP_SITEURL', 'https://yoursite.com' );
Use the exact form you're visiting, including https and www if applicable. These constants override the database values, so they take effect immediately.
If that doesn't fix it, the other causes are a plugin — often security, caching, or a membership plugin — or a corrupted .htaccess. Disable plugins via FTP by renaming /wp-content/plugins, and try renaming .htaccess to .htaccess-old.
Once you're in, set the URLs properly in Settings → General and remove the wp-config.php constants, since leaving them hard-coded causes confusion during future migrations.
Route 5 — A security plugin locked you out
If you're seeing "too many failed login attempts," "your IP has been blocked," or a plugin-branded block page, this is a deliberate lockout rather than a fault.
Wait it out. Most lockouts expire — commonly 15 to 60 minutes depending on configuration. Genuinely the easiest option if you're not in a hurry.
Change your IP. Use mobile data instead of wifi, or a VPN. Lockouts are usually IP-based, so a different address bypasses it entirely.
Disable the plugin via FTP. Rename its folder inside /wp-content/plugins — wordfence to wordfence-off, for instance. That deactivates it and clears the block. Reactivate once you're in and add your IP to its allowlist.
Check for a config file. Some security plugins write blocklists to .htaccess or their own config files, which survive deactivation. If renaming the folder doesn't work, check .htaccess for deny rules containing your IP.
Worth doing once you're back in: allowlist your own IP if it's static, and make sure your recovery email address is one you can actually access. Locking yourself out of your own site is a rite of passage, but twice is careless.
Route 6 — You can log in but have no admin access
You're logged in, and the dashboard is nearly empty. Your role has been damaged or changed.
This happens through a botched plugin update, a corrupted user meta record, or — worth taking seriously — a compromise.
Create a fresh admin user via functions.php in your active theme, added temporarily at the top:
add_action( 'init', function() {
$user = wp_create_user( 'tempadmin', 'StrongPasswordHere', '[email protected]' );
if ( ! is_wp_error( $user ) ) {
$u = new WP_User( $user );
$u->set_role( 'administrator' );
}
});
Load any page on the site once, then delete those lines immediately. Leaving that code in place means anyone who can read your theme files knows a set of admin credentials.
Log in as tempadmin, restore your original account's administrator role in Users, then delete the temporary account.
If you didn't cause this, treat it as a possible security incident. Unknown admin users, changed roles, or content you didn't write is a compromise, not a bug. Triage.
Preventing the next one
Keep a second administrator account with a separate email — ideally a different provider from your main one. This alone converts most lockouts into a minor annoyance.
Fix your site's email. If password resets never arrive, that's a problem waiting for a bad day. SMTP setup.
Use a password manager, so "I've forgotten it" stops being a category.
Allowlist your IP in your security plugin if it's static.
Note your database credentials and FTP details somewhere you can reach without logging into WordPress. The whole point is that you can't get in.
Frequently asked questions
How do I reset my password without email access?
Reset it directly in the database via phpMyAdmin. Open the wp_users table, edit your user row, set the user_pass field's Function dropdown to MD5, type your new password in the Value field, and save. The MD5 step is essential — WordPress stores hashed passwords, so a plain string won't work. WordPress upgrades that hash to its modern format automatically on your first login. With WP-CLI, wp user update username --user_pass="..." does the same thing.
Why does login keep redirecting?
Almost always a mismatch between the site URL stored in your database and the address you're actually visiting — www versus non-www, or http versus https. WordPress redirects you to what it considers correct, which sends you back, forever. Define WP_HOME and WP_SITEURL in wp-config.php using the exact URL form you're using. If that doesn't resolve it, a security, caching, or membership plugin is the next suspect.
Can a security plugin lock me out?
Yes, routinely — it's what they're built to do. Failed login attempts, an IP-based rule, or a country block will lock out a legitimate administrator as readily as an attacker. Most lockouts expire within an hour. Faster options are switching to mobile data or a VPN to change your IP, or renaming the plugin's folder via FTP to deactivate it. Check .htaccess too, since some plugins write blocks there and those survive deactivation.
What to do next
Try a private browsing window first. It costs ten seconds and resolves a genuine share of lockouts caused by stale cookies.
If that fails and password resets aren't arriving, go straight to the phpMyAdmin reset — don't keep clicking the reset link hoping the email appears. It isn't going to.
Free: The WordPress maintenance checklist.
Related guides
- When WordPress breaks: a diagnostic order — if wp-admin is white rather than blocked
- WordPress emails not sending — why reset emails never arrive
- WordPress security — hardening login without locking yourself out
- My WordPress site is hacked — if the lockout wasn't your doing
Join the Newsletter
Get practical marketing tactics delivered straight to your inbox.
Written by
Muhammad Basim
Related Articles
Transactional Email Services Compared for WordPress
Every one of these services will deliver your password resets. That's not the differentiator. What differs is setup difficulty, what the free tier covers, how good the logs are when something goes wrong, and — the one people never consider until it bites them — whether the service also handles marketing mail, and whether you […]
Contact Form Notifications Not Arriving: Every Cause
Here's the version of this problem that costs the most: it's been happening for months and you don't know. The form says "thank you." The visitor believes they've reached you. You believe nobody's been in touch. There's no error, no bounce, no alert — just an absence, and absences are invisible. Most of the time […]
WooCommerce Order Emails Going to Spam: The Fix
"I never got a confirmation. Did my order go through?" Every store owner gets this message. And when it arrives often enough, you stop treating it as customer confusion and start realising your receipts genuinely aren't landing. This costs more than most email problems, because a missing order confirmation doesn't just annoy someone — it […]