Account Recovery
Locked Out? How to Reset a WordPress Password Three Ways
Whether the reset email never arrives or the only admin account's credentials are gone entirely, there's a way back into the dashboard. Here are three routes, from simplest to last resort.
24/7
Human support for account recovery
Daily
Automatic backups before database changes
Free
Migration support if starting fresh
30-Day
Money-back guarantee
In short
To reset a WordPress password, use the 'Lost your password?' link on the login screen, which emails a reset link to the account's registered address. If that email never arrives, reset the password directly through phpMyAdmin by updating the user_pass field with MD5 encryption, or as a last resort, add a temporary password-reset function to functions.php and remove it immediately after logging in.
A lost WordPress password is rarely a real emergency, since WordPress core includes a built-in recovery path for exactly this situation. It becomes stressful only when the recovery email itself doesn't show up, which happens more often than it should when a site's outgoing mail isn't configured properly or the registered address is out of date.
The three methods below start with the simplest, the standard email reset link, and move toward database-level fixes for situations where email isn't an option at all, such as inheriting a site with no working admin access or losing the only account with a valid email address on file.
Method 1: The Standard Email Reset Link
Click 'Lost your password?' on the wp-login.php screen and enter either the username or the registered email address. WordPress sends a reset link to that address, valid for a limited time, that leads to a page for setting a new password directly, with no database access needed.
If the email doesn't arrive within a few minutes, check the spam folder first, then confirm the site's outgoing mail is actually working, since the same delivery problems that block contact form notifications also block password reset emails. A site relying on PHP's default mail function often loses these messages before they ever leave the server.
Method 2: Resetting the Password Through phpMyAdmin
When email delivery isn't an option, phpMyAdmin, available through the hosting control panel, allows a direct edit to the account's stored password. Open the wp_users table, find the row matching the admin account, and click Edit on the user_pass field.
Enter the new password, but critically, set the Function dropdown next to that field to MD5 rather than leaving it as plain text, since WordPress stores passwords as an MD5 hash and a plain-text entry won't match on login. Save the change, then log in with the new password immediately to confirm it took effect.
Method 3: A Temporary functions.php Reset
If phpMyAdmin access isn't available either, adding a short snippet to the active theme's functions.php file can reset a password through code that runs once the site loads. A line such as wp_set_password('newpassword', 1); (with 1 being the user ID to reset) changes the password the next time any page on the site is visited.
This method needs to be temporary: the line must be removed from functions.php immediately after confirming the login works, since leaving it in place resets that account's password back every single time the site loads, which locks the account right back out the next time anyone tries to change it again.
Preventing This From Happening Again
Once back in, add a second admin account with its own valid, checked email address, so a single lost password or bad email address never locks out the entire site again. A password manager removes the guesswork of remembering a long, unique password in the first place.
Confirming that outgoing email actually works, using an SMTP setup, means the standard reset link will work the next time it's needed, without ever having to fall back to a database edit.
Recovery Support When a Reset Doesn't Go as Planned
A password reset that goes wrong, whether it's a typo in a phpMyAdmin edit or a functions.php snippet left in by mistake, is easy to undo with a recent backup rather than something that needs to be fixed by hand under pressure.
24/7 human support means a locked-out admin isn't stuck waiting until a convenient hour to get a second pair of eyes on the database or file in question.
- Daily backups to restore from before any risky database edit
- cPanel-style panel with phpMyAdmin access included
- 24/7 human support for account recovery situations
- Free managed migration if inheriting a site with no working credentials
Why Hosting Cheap
What you get
Daily Backups
A backup taken before any phpMyAdmin edit means a mistake is a quick restore, not a rebuild.
24/7 Human Support
Get a second pair of eyes on a database or functions.php edit any hour of the day.
cPanel-Style Panel
phpMyAdmin and file access are included and straightforward to reach when email recovery isn't working.
Free Managed Migration
Inheriting or moving a site with unclear admin access is handled as part of the migration process.
Free Auto-Renewing SSL
Keeps the login page and password reset process encrypted throughout.
30-Day Money-Back Guarantee
Get account and site access sorted out with room to test before committing.
How It Works
Get set up in a few steps
Try the email reset link first
Use 'Lost your password?' on the login screen and check spam if the email doesn't appear within a few minutes.
Edit the password via phpMyAdmin
Update the user_pass field in wp_users, setting the Function dropdown to MD5 before saving.
Use a temporary functions.php snippet as a last resort
Add a one-time wp_set_password() call, log in, then remove the snippet immediately.
Included
Everything you need, on every plan
- Try the standard 'Lost your password?' email link first
- Check spam and junk folders for the reset email
- Confirm the site's outgoing email is actually working
- Back up the database before any phpMyAdmin edit
- Set the Function dropdown to MD5 when editing user_pass directly
- Remove any functions.php reset snippet immediately after logging in
- Add a second admin account with a verified email once back in
- Set up SMTP so future email resets work reliably
FAQ
Frequently asked questions
Why isn't the WordPress password reset email arriving?
Most often the site's outgoing email is relying on PHP's default mail function, which many spam filters reject or silently drop. Setting up SMTP fixes reset emails along with every other automated message the site sends.
Is it safe to edit the password directly in phpMyAdmin?
Yes, as long as the Function dropdown is set to MD5 before saving, since WordPress stores passwords hashed and a plain-text entry won't match on login. Taking a quick backup first is good practice before any direct database edit.
What does the functions.php password reset method actually do?
It runs a line of code that forces a specific user's password to a new value the next time any page loads. It must be removed right after logging in, or it will keep resetting that same password every time the site is visited.
Can I reset a password without database or file access at all?
Not directly through WordPress itself. The email reset link is the only route that doesn't require server-level access, which is why keeping outgoing email working is worth confirming before it's ever needed.
What if I don't know the username, only the email address?
The 'Lost your password?' field on the login screen accepts either the username or the registered email address, so either one is enough to trigger the reset link.
How do I stop this from happening again?
Add a second administrator account with its own verified email, use a password manager to avoid weak or forgotten passwords, and confirm SMTP email delivery is working so the standard reset link never fails.
Never Get Locked Out for Long
Get cPanel-style database access, daily backups, and 24/7 support for whenever an account needs recovering.
Get Started