Locked Out of Joomla Administrator After a Hack

By Glenn Lyvers · Updated September 21, 2026 · 4 min read

Your password has stopped working, the reset email is not arriving, and the account you have used for years no longer exists. Being locked out of your own site is a horrible feeling, and it is also a strong signal: an attacker who bothers to lock you out is trying to buy time. The good news is that every route back in runs outside the login form, and at least one of them will work.

Why you are locked out

There are a few possibilities and they suggest slightly different responses. Your Super User account was deleted outright. Its password was changed. Its user group was demoted so it no longer has administrator rights. Or the account still works but the reset email never arrives because mail from the site is broken or the account's email address was changed.

That last one is worth checking first, because if your address was quietly swapped for theirs, the reset link is going to them. Any of these means someone had substantial access, so treat the lockout as one symptom of a compromise rather than the whole problem.

Route one: create a Super User in the database

With database access through phpMyAdmin or similar, you can insert a new user into the users table and map it to the Super Users group in the user-group mapping table. Joomla's password column accepts a standard hash, and the documented approach is to insert a known hash value and then change the password properly once you are back in.

This is the most reliable route and the one I use most. Take a database backup first, because you are writing directly to the user tables, and getting the group mapping wrong leaves you with an account that exists but can do nothing.

Route two: Joomla's own recovery tools

Recent Joomla versions ship a command-line tool that can create a Super User or reset a password without touching the database by hand, which is considerably safer if you have shell access. It runs from the site root and handles the group mapping correctly for you.

There is also a documented file-based method involving a temporary configuration file placed in the site root, which Joomla reads on the next request to create an account. Both are legitimate recovery mechanisms. Whichever you use, remove any temporary file the moment you are back in, because a file that creates administrator accounts is exactly what you do not want left lying around.

Route three: fix the account you still have

If your account exists but has been demoted, you do not need a new one — you need its group mapping corrected. That is a single row in the user-group mapping table pointing your user id at the Super Users group, and it is a smaller and safer change than creating a user from scratch.

Similarly, if the account's email was changed, correcting that row restores your ability to use the normal password reset. Check both before doing anything more invasive.

Getting back in is the start, not the end

The moment you have access, audit the user list. Delete Super User accounts you did not create, check for accounts sitting in privileged groups that should not be, and reset passwords on everything legitimate. Then look at the group definitions themselves, because a permission quietly added to an ordinary group is easy to miss.

Then do the actual cleanup: check the images and tmp directories for executable files, check your template files, replace core and extensions from clean sources, sweep the database, and rotate the database password and the secret value in your configuration. My guide on hacked Joomla sites covers the full sweep.

Preventing the repeat

Update to a supported Joomla version, which is frequently the actual reason this happened, and remove extensions you no longer use. Enable Joomla's built-in two-factor authentication on every Super User account — that single measure makes a stolen password insufficient and would have prevented a good share of the lockouts I see.

Keep a second Super User account with its own strong credentials, stored somewhere you can reach in an emergency, so a single compromised account does not lock you out of your own site again. And if you are back in but not confident the site is genuinely clean, that is exactly what I do — see the platforms I clean.

Common questions

How do I create a Joomla Super User without logging in?

Either insert a user row in the database and map it to the Super Users group in the user-group mapping table, or use Joomla's command-line tool if you have shell access, which handles the mapping for you. There is also a documented temporary configuration file method that creates an account on the next page load.

Why is the password reset email not arriving?

Either mail from the site is broken, or the email address on your account was changed so the reset link is going to somebody else. Check the address stored against your user record in the database before assuming it is a mail delivery problem.

My account exists but has no admin rights. What happened?

It was demoted — your user was moved out of the Super Users group. The fix is smaller than creating a new account: correct the row in the user-group mapping table so your user id points at the Super Users group again.

Is it safe to edit the Joomla user tables directly?

Yes, provided you take a database backup first and get the group mapping right. The common mistake is creating a user record without the corresponding user-group mapping entry, which produces an account that can log in but cannot do anything.

What should I do immediately after getting back in?

Audit the user list and delete Super User accounts you did not create, check for privileged accounts in unexpected groups, and review group permissions. Then run the full site cleanup, because the lockout is a symptom of a compromise rather than the whole of it.