Locked Out of WordPress After a Hack: How to Get Back In
By Glenn Lyvers · Updated · 9 min read
Losing the keys to your own dashboard is the moment most people pick up the phone. The reassuring part is that you can almost always get back in without a developer, because WordPress keeps everything that matters in a database you still control, underneath the login screen the attacker is standing on. The uncomfortable part is that getting back in is the easy half. If someone locked you out, they had enough access to rewrite your account — so the way back in only helps if you also close the door they walked through.
The order I work in is always the same: figure out which kind of lockout this actually is, regain access at a layer the attacker doesn't control, and treat the site as compromised until I've proven otherwise.
Which kind of locked out are you?
All of these look identical from the login screen and none of them have the same fix. Two minutes spent identifying yours will save you an afternoon.
Your password stopped working. The page reloads with an error about an incorrect password. Either your password was changed or your username was.
Your account no longer exists. WordPress tells you the username is unknown. The user row was deleted outright.
You log in fine, but the dashboard is nearly empty. No Plugins menu, no Users, no Settings. You weren't locked out; you were demoted to a lower role, which is quieter and buys the attacker more time.
You log in and get thrown straight back to the login page. Usually a redirect planted in the theme or in a must-use plugin, or a cookie problem caused by someone changing the site URL.
You never get the reset email. Nine times out of ten the address on the account was changed, not that mail is broken.
You're blocked before the login form even loads — a 403, a firewall block page, or a message saying your IP is banned. This one is frequently not the attacker at all. More on that below, because people waste hours here.
Try the password reset first, but know why it fails
Always worth thirty seconds. If it works, the attacker changed your password but not your email address, which tells you something useful about how thorough they were.
When no email arrives, the usual reason is that your account's email address was quietly swapped for one of theirs. That's the standard playbook: change the address first so every future reset lands in their inbox, then change the password. It's also worth knowing that WordPress stores a pending email change separately from the live one, so an address change that was started but never confirmed can leave the account in a strange half-state.
The other reasons are duller and worth ruling out: the site can't send mail at all, the reset message is sitting in your spam folder, or a security plugin has disabled password resets for administrators on purpose. If other site email still works, assume the address was changed.
Getting back in through the database
This is the reliable route, because it goes underneath WordPress entirely. Open phpMyAdmin from your hosting control panel and find the wp_users table. Your table prefix may not be wp_, which is worth noticing on its own — if the prefix is unfamiliar, make sure you're looking at the right site's database.
Before you change a single thing, read the table. This is the step people skip and later wish they hadn't. Look at every row: how many administrators are there, what email addresses are attached, and what do the registration dates say? An account registered at 3 a.m. six weeks ago is telling you roughly when you were breached, which shapes everything from which backup is safe to restore to how far back you need to look. Write down what you find, then change things. I go into detail on what these rogue accounts look like in my guide to hidden admin users, including the ones deliberately made invisible in the WordPress user list.
To retake your own account, edit your row and set a new value for user_pass, choosing the MD5 function from the dropdown next to the field. Modern WordPress doesn't store passwords that way any more, but it still accepts the older format at login and immediately upgrades it to a current hash, which is exactly what makes this trick keep working. While you're in the row, confirm user_email is genuinely yours.
If your account was deleted rather than modified, don't rebuild it by hand — the user role lives in a separate wp_usermeta row that's easy to get wrong. Make a fresh account instead, using one of the two methods below, then clean up afterwards.
Creating a new administrator when yours is gone
If your host gives you terminal access, WP-CLI is the cleanest path. wp user list --role=administrator shows you exactly who holds the keys right now, and wp user create gives you a fresh account with the role wired up correctly. It's also the fastest way to audit a site you've just inherited.
Without shell access, you can add a few lines to your active theme's functions.php through your host's file manager that create an administrator on the next page load. It works, and I'll use it when there's no alternative, but treat it as a live wire: it runs on every request until you take it out, and any code that creates admin accounts is precisely what an attacker would love to find left behind. Load the site once, confirm you can log in, then delete those lines immediately. Not later that day. Immediately.
When it's your own security plugin, not the hacker
I'd guess a third of the "I've been hacked and locked out" messages I get are a firewall doing its job slightly too well. Wordfence, iThemes and the rest will ban an IP after repeated failed logins — and someone frantically trying six variations of their own password looks identical to a brute-force attempt. If you're seeing a block page rather than a normal WordPress login error, this is the likely explanation.
You can usually tell them apart by the wording. A plugin block page names the plugin or mentions your IP. A hack looks like ordinary WordPress being unhelpful.
The fix is to disable plugins from outside WordPress: rename the plugin's folder inside wp-content/plugins over FTP or in the file manager, and WordPress silently stops loading it. Renaming the entire plugins folder disables everything at once, which is the sledgehammer version and useful when you don't know which plugin is responsible. Rename it back afterwards and your settings are still there. If your IP is simply banned, connecting through a phone's mobile data will often get you in immediately, which is a quick way to confirm the diagnosis before you touch any files.
The mistake that costs people the site
Here's where I watch good recoveries fall apart. Someone gets back in, feels the relief, changes their password, deletes the suspicious admin account, and calls it done. A week later they're locked out again and genuinely baffled.
The rogue admin account was never the way in. It was a convenience the attacker created after getting in, using something else — an outdated plugin, a stolen hosting password, a backdoor file sitting in your uploads folder. Delete the account without finding that route and you've done the equivalent of changing the locks while leaving a window open. That's the whole mechanism behind sites that keep getting reinfected, and it's the single most common reason a do-it-yourself cleanup fails.
There's a second reason to slow down. The moment you start deleting things, you destroy the evidence that tells you how far the breach went. That rogue account's email address and creation date, the file timestamps, the access logs — that's how you scope the damage. Take a full backup of the site as it stands, infected and all, before you clean anything. You can always throw it away. You can't get it back.
What to do the hour you're back in
Assume every credential connected to the site is in someone else's hands, because credentials are the first thing anyone takes.
Change your WordPress password, then your hosting control panel password, then your FTP and database passwords. Rotate the authentication salts in wp-config.php — this is the step almost everyone misses, and it matters because those values sign your login cookies. Anyone holding them can forge a valid session for any account without needing a password at all, which means an attacker who copied them earlier still has a working key even after you've changed every password on the site. Rotating the salts logs everyone out at once, including whoever else was in there. I've written up the full wp-config checklist separately.
Then look at the accounts themselves. Remove administrators you can't personally account for, and demote anyone who doesn't genuinely need the role. Check whether new user registration got switched on and whether the default role for new users was quietly set to administrator — that's a favourite, because it turns your own signup form into a permanent back door that survives every file cleanup you do.
Being back in doesn't mean being clean
Access is a symptom, not the disease. If you were locked out, something else got in first, and it's very unlikely that the account change was the only thing done to your site while it was open. Spam pages, injected redirects and backdoors can all sit there for months without affecting anything you'd notice from the dashboard.
Search for your own domain in Google and look for pages you never wrote. Check Search Console for security issues. Look at your site on a phone, not just a desktop, because plenty of redirect infections only fire for mobile visitors and stay invisible to the logged-in owner. Or run the free scan and let it tell you where you stand.
And if you'd rather not spend your weekend reading file timestamps — the lockout, the backdoor hunt, the rotation, the clean bill of health — that's exactly the job my cleanup service exists for. Getting people back into their own dashboards is most of what I do, and by now the odd ones stop being surprising.
Common questions
How do I get back into WordPress if the hacker changed my password?
Reset it directly in the database. Open phpMyAdmin from your hosting control panel, find your row in the wp_users table, and set a new user_pass value using the MD5 function in the dropdown. WordPress still accepts that older format at login and upgrades it to a modern hash automatically. Check that the user_email on the row is still yours while you are in there, because attackers usually change the address before they change the password.
Why am I not receiving the WordPress password reset email?
Usually because the email address on your account was changed to one belonging to the attacker, so every reset you request goes to them. That is standard practice for whoever locked you out. Rule out the boring causes first, though: check your spam folder, confirm the site can send mail at all, and check whether a security plugin has disabled resets for administrators.
The hacker deleted my admin account. Can I create a new one?
Yes. If you have terminal access, WP-CLI creates a properly configured account in one command. Otherwise you can add a short snippet to your active theme functions.php through your host file manager that creates an administrator on the next page load, then delete those lines the moment you are logged in. Do not leave that code in place, and do not rebuild a deleted user by hand in the database, because the role is stored in a separate wp_usermeta row that is easy to get wrong.
Am I locked out because of a hack or because of my security plugin?
Look at what the screen actually says. A plugin lockout usually names the plugin or mentions your IP address being blocked, and often appears before the login form loads at all. A hack looks like ordinary WordPress rejecting your password. Trying to reach the site over mobile data will confirm it in seconds: if you get straight through, your IP was banned. To clear it, rename the plugin folder inside wp-content/plugins over FTP and WordPress stops loading it.
I got back into my site, so is the hack over?
No. Regaining access does not remove whatever let the attacker in, and the account they created was something they made after arriving, not the way they arrived. If you change your password and delete the rogue admin without finding the backdoor or the vulnerable plugin behind it, you will very likely be locked out again. Take a full backup before deleting anything, rotate the salts in wp-config.php as well as every password, then scan the site properly.