You Cannot Log In and the Reset Email Never Arrives

Being locked out with no working email is uncomfortable but not serious, provided you have filesystem or database access. There are three routes back in, in order of preference.

Route 1: WP-CLI

# list users
wp user list

# set a new password
wp user update admin --user_pass='a-long-passphrase-you-choose'

# or create a new administrator
wp user create recovery [email protected] --role=administrator --user_pass='another-long-passphrase'

This is the cleanest route because WordPress hashes the password correctly and fires the usual hooks.

Route 2: the database

In phpMyAdmin, open wp_users, find your row, and edit user_pass. Set the function to MD5 and type your new password as the value.

WordPress accepts an MD5 hash on login and transparently upgrades it to its own stronger hash. It is safe as a recovery step, which is the only thing it should be used for.

-- or by query
UPDATE wp_users
SET user_pass = MD5('a-long-passphrase-you-choose')
WHERE user_login = 'admin';

Route 3: a temporary function

If you can edit files but have no database or SSH access, add this to your theme’s functions.php, load any page once, then delete it immediately:

add_action( 'init', function () {
    $user = get_user_by( 'login', 'admin' );
    if ( $user ) {
        wp_set_password( 'a-long-passphrase-you-choose', $user->ID );
    }
} );

If you can log in but are bounced straight back

That is a different problem — a cookie or redirect loop rather than a password failure. The symptom is a page reload with no error message. See the wp-admin redirect loop post.

If the account has lost its administrator role

wp user list --role=administrator
wp user add-role your-username administrator

An account that exists but cannot see the admin menus has had its capabilities changed. This can happen through a plugin, and occasionally through a compromise — worth checking the user list for accounts you did not create.

Then fix the email

The reset email not arriving is the underlying problem. WordPress sends through PHP mail by default, which modern providers reject. Set up SMTP through a real sending service, and verify it by requesting a reset deliberately.

Prevention

• Keep a second administrator account with a different email address, at a different provider.
• Use a password manager so a reset is never routine.
• Set up SMTP before you need it.
• Make sure you can reach SFTP or SSH — all three routes above depend on it.

Common questions

Is the MD5 method safe?

As a temporary recovery step, yes. WordPress upgrades the hash on your first login. Do not leave it as the stored password.

What if I do not know my username?

wp user list over SSH, or browse wp_users in phpMyAdmin.

Could I have been hacked?

Check the user list for accounts you did not create and look at recent file modification times. A sudden lockout is occasionally the first sign.