WordPress Login URL and Recovery Guide 2026

#What to do when locked out of WordPress

Being locked out of your own WordPress website is a rite of passage for every developer, site manager, and business owner. The feeling is visceral: you navigate to your login page, and it’s gone. Or you type your password, and the screen just shakes. Or worse, you’re greeted by a cold, white screen of death.

In 2026, the WordPress ecosystem has evolved. Security is tighter, caching is more aggressive, and the complexity of the average stack has increased. Access issues are rarely just “I forgot my password” anymore. They are often complex collisions between security plugins, server-side caching, database corruption, and deprecated PHP versions.

This guide is not a list of basic tips. It is a comprehensive, technical manual for regaining access to your property. I will bypass the front door, pick the lock, and if necessary, take the door off its hinges using database access and command-line tools.

Short answer: start with wp-login.php and wp-admin/. If those fail, check for a hidden login slug, then move to password reset and database recovery methods such as phpMyAdmin, WP-CLI, or temporary plugin deactivation over FTP.

#How WordPress login works step by step

Before I troubleshoot, I must understand how WordPress handles authentication. When you visit wp-login.php, WordPress fires a sequence of events:

1. Cookie Check: It checks your browser for valid authentication cookies.
2. Nonce Verification: It ensures the login request is genuine and not a CSRF attack.
3. Database Lookup: It queries the wp_users table for the username.
4. Password Hashing: It salts and hashes your input and compares it to the user_pass string in the database.
5. Capability Check: It queries wp_usermeta to verify you have the administrator (or equivalent) role.
6. Redirect: It generates a new session cookie and sends you to wp-admin/.

An error at ANY of these stages results in a lockout.

#Where is my WordPress login URL

By default, WordPress listens on specific standard routes. You should know these by heart:

• your-site.com/wp-login.php (The physical file handling logic).
• your-site.com/wp-admin/ (A directory that triggers a redirect to login if not authenticated).
• your-site.com/login and your-site.com/admin (shorthand redirects built into core).

The shorthand URLs come from the core function wp_redirect_admin_locations(), added in WordPress 3.4. It sends /admin and /dashboard to wp-admin/, and /login and /login.php to the login URL. It only fires when the request would otherwise end in a 404 and pretty permalinks are enabled. On a site with plain permalinks (?p=123), /login does nothing, so test wp-login.php directly before concluding that the login page has been moved.

#Scenario 1: The “404 Not Found”

If these URLs return a 404 error, the file isn’t missing - it’s hidden. A plugin or custom code may have changed the login slug to something custom like /portal, /entry, or /my-secret-login.

The Fix: If you inherited a site and don’t know the custom slug, you cannot guess it. You must disable the plugin enforcing the rule.

1. FTP/SFTP Access: Connect to your server using FileZilla or your hosting file manager.
2. Navigate: Go to /wp-content/plugins/.
3. Identify: Look for folders such as wps-hide-login (WPS Hide Login) or better-wp-security (the wordpress.org slug of Kadence Security), or any other security plugin that offers a custom login URL.
4. Neutralize: Rename the folder. For example, change wps-hide-login to __wps-hide-login_DISABLED.
5. Test: WordPress will immediately stop loading that plugin. The custom routing rule will vanish, and the default /wp-login.php will work again.

#Scenario 2: The infinite redirect loop

You enter your credentials, the page refreshes, and you are back at the login screen. No error message. Just a loop. This is usually caused by a cookie mismatch or SSL conflict.

The Fix:

1. Clear Browser Cookies: Delete the cookies for your domain and log in again before you touch any file.
2. Check wp-config.php: Ensure your site URLs are hardcoded correctly.

   // Add these to wp-config.php
   define('WP_HOME', 'https://your-domain.com');
   define('WP_SITEURL', 'https://your-domain.com');

   Note: Ensure you use https if you have an SSL certificate. Using http here when the server forces HTTPS will cause a loop.

#Reset WordPress password without email access

The “Lost your password?” link depends on two fragile things:

1. Your server’s ability to send emails (SMTP).
2. You having access to the email address on file.

If the site was built by a previous developer, the admin email might be [email protected]. You will never get that link. Here are the Developer Methods to override authentication.

#Reset WordPress password in phpMyAdmin

This is the universal method. It works on every host (Kinsta, WP Engine, SiteGround, OVH).

1. Access the Database: Log in to your hosting panel and open phpMyAdmin.
2. Locate the Table: Find wp_users. (Note: The prefix wp_ might be different, e.g., wp_823_users).
3. Find the User: Locate your username (user_login) or email.
4. Edit the Row: Click “Edit”.
5. The Password Field: Look for user_pass. You will see a long string of random characters (e.g., $P$B55D6Ljf...). This is a hashed password. You cannot just type “password123” here because WordPress won’t recognize it.
6. The Magic Trick:
   • In the Function dropdown menu next to user_pass, select MD5.
   • In the Value field, delete the hash and type your new password in plain text (e.g., NewStrongPass2026!).
   • Click Go (Save).
   • What happens? MySQL applies MD5 to your string before saving it. wp_check_password() treats any stored hash of 32 characters or fewer as a plain MD5 hash and compares it directly. After a successful login, core calls wp_password_needs_rehash() and stores a fresh hash. Since WordPress 6.8 that hash is bcrypt by default, saved with a $wp prefix (for example $wp$2y$10$...). Older $P$ hashes from phpass are still accepted and get rehashed the same way on the next login.

#Reset WordPress password from the MySQL command line

With SSH access but no phpMyAdmin, the official reset guide on wordpress.org uses the mysql client directly:

1. Log in: mysql -u root -p, then select the database with use your_database;.
2. Find the users table with show tables;. It ends in users and carries your table prefix.
3. Check what is there: SELECT ID, user_login, user_pass FROM wp_users;
4. Set the new password and let MySQL compute the MD5 hash:

   UPDATE wp_users SET user_pass = MD5('new-password') WHERE ID = 1;

5. Run the SELECT again to confirm that the row changed, then exit with Control-D.

The same guide notes that this works even when the existing passwords are salted $P$ hashes.

#Reset WordPress password with WP-CLI

If you have SSH access, using the graphical interface is a waste of time. WP-CLI is faster, safer, and leaves an audit trail in your shell history.

1. Login: ssh user@ip-address
2. Navigate: cd /var/www/html (or your site path).
3. List Users: You need to know exactly who the admins are.

   wp user list

   Output:

   +----+------------+--------------+--------------------------+
   | ID | user_login | display_name | user_email               |
   +----+------------+--------------+--------------------------+
   | 1  | admin      | administrator| [email protected]    |
   | 4  | mariusz    | Mariusz      | [email protected]     |
   +----+------------+--------------+--------------------------+

4. Change Password:

   wp user update 1 --user_pass="CorrectHorseBatteryStaple2026"

5. Alternative: Create a New Admin: Sometimes the existing admin account is corrupted or you don’t want to touch it. Create a backdoor admin for yourself.

   wp user create recovery_admin [email protected] --role=administrator --user_pass="MySecretEntryKey"

   This grants you entry without alerting the existing users.

#Reset WordPress password with wp user reset-password

wp user update --user_pass puts the new password in your shell history. The command wp user reset-password generates a random password instead:

# Generate a new password and email the user that it changed
wp user reset-password admin

# Show the new password in the terminal and send no email
wp user reset-password admin --skip-email --show-password

# Print only the password, handy in scripts
wp user reset-password admin --skip-email --porcelain

By default the command emails the affected user. --skip-email suppresses that, and --show-password and --porcelain were added in WP-CLI 2.8.0, so an older WP-CLI changes the password without ever showing it to you. Update WP-CLI first if you need to read the result.

After a suspected break-in, reset every administrator in one go:

wp user reset-password $(wp user list --format=ids --role=administrator)

wp user update accepts --skip-email too, when you want to set a known password without notifying the account owner.

#Reset WordPress password via functions.php

Warning: Use this only as a last resort. It involves modifying code on a live server.

1. FTP into /wp-content/themes/your-active-theme/.
2. Download functions.php.
3. Add this line immediately after the opening PHP tag on the first line of the file:

   wp_set_password('EmergencyReset2026!', 1);

   (Replace 1 with the User ID you want to reset).
4. Upload the file.
5. Refresh the login page. The password is now reset.
6. CRITICAL STEP: Delete that line from functions.php immediately.
   • Why? The line runs on every page load, so WordPress resets the password again on every request. The wp_set_password() reference warns that the function is meant for single-time application and that leaving it in place causes an endless loop of password resets, which sends you back to the login screen each time.

#Emergency password reset script

When none of the methods above is available, the wordpress.org reset guide points to the Emergency Password Reset Script. It is a standalone PHP file, not a plugin:

1. Copy the script from the page linked in that guide into a file called emergency.php.
2. Upload it to the root of the installation, the same directory that holds wp-config.php, never to the plugins directory.
3. Open https://example.com/emergency.php, enter the administrator username and the new password, and submit the form.
4. The script changes the password and emails the administrator address. The password changes even if that email never arrives.
5. Delete emergency.php straight away. Anyone who finds it can use it to change your password.

The script needs the administrator username. If you do not know it, read it from the user_login column first with one of the database methods above.

#Change the WordPress admin email when the old inbox is gone

Two different addresses matter here, and a dead inbox usually means both need fixing:

• The account email (user_email in wp_users) receives the password reset link. Set it with wp user update 1 [email protected] --skip-email; both options are listed in the wp user update reference.
• The site admin email (the admin_email option) receives the recovery mode link described below. Changing it on the settings screen does not take effect at once: update_option_new_admin_email() sends a confirmation request to the new address, and the new address does not become active until it is confirmed. On a site whose mail does not go out, that confirmation never arrives.

With shell access, wp option update writes the option value directly:

wp option update admin_email [email protected]

Fix outgoing mail afterwards, otherwise the next password reset fails the same way.

#Can’t log in to WordPress with correct password

You have the password. You found the URL. But you still can’t get in. Now I enter the realm of advanced debugging.

#1. The “You do not have sufficient permissions” error

You log in successfully, but WordPress shows you a blank dashboard or says “Sorry, you are not allowed to access this page.”

Diagnosis: Your user exists, but your Capabilities are corrupted. This often happens after a bad database migration (search-and-replace gone wrong on serialized data).

The Fix (Database):

1. Go to wp_usermeta table in phpMyAdmin.
2. Search for user_id matching your ID (e.g., 1).
3. Look for the meta_key named wp_capabilities (or wp_xyz_capabilities).
4. The meta_value should look like this serialized array:

   a:1:{s:13:"administrator";b:1;}

5. If it looks completely different, empty, or corrupted, replace it with the string above. This manually forces the Database to recognize you as an Administrator.

#2. How to log in to WordPress without a 2FA code

You enabled Two-Factor Authentication (Google Authenticator), but you lost your phone. Now you are effectively locked out by your own security.

The Fix: You cannot “guess” the 2FA code. You must disable the plugin enforcing it.

1. FTP to /wp-content/plugins/.
2. Find the 2FA plugin (e.g., google-authenticator, two-factor).
3. Rename the folder to _disabled_google-authenticator.
4. Log in. WordPress will complain that the plugin is missing, but it will let you in without the code.
5. Re-enable the folder name, go to plugins, and re-configure.

#3. White screen (WSOD) when logging in to WordPress

You submit the form, and the screen goes blank. This is a PHP Fatal Error occurring during the authentication handshake.

Diagnosis: To see the ghost, you must give it a form. I need logs.

1. Open wp-config.php.
2. Look for define('WP_DEBUG', false);.
3. Replace it with this “Verbose Logging” block:

   // Enable Debugging
   define( 'WP_DEBUG', true );
   
   // Save logs to /wp-content/debug.log
   define( 'WP_DEBUG_LOG', true );
   
   // Do NOT show errors on the screen (security risk)
   define( 'WP_DEBUG_DISPLAY', false );
   @ini_set( 'display_errors', 0 );

4. Trigger the error again (try to login).
5. Open /wp-content/debug.log.
6. You will see a line like: PHP Fatal error: Uncaught Error: Call to undefined function... in /.../wp-content/plugins/bad-plugin/index.php:45
7. Now you know exactly which plugin is the traitor. Delete it via FTP.

#WordPress recovery mode email after a fatal error

Since WordPress 5.2, core catches fatal errors caused by a plugin or theme instead of only showing a blank screen. The machinery lives in the WP_Recovery_Mode class, and it is often the quickest way back into a site that breaks the moment you log in.

How it works, according to the core reference:

• The email: when a fatal error happens, WordPress sends a link to the address in the RECOVERY_MODE_EMAIL constant if it is defined and valid, and to the site’s admin email otherwise (get_recovery_mode_email_address()).
• The rate limit: a new email goes out at most once per day by default (filter recovery_mode_email_rate_limit). If you missed or deleted the first one, triggering the error again will not send another until that window passes.
• The link lifetime: the link stays valid at least as long as the rate limit, so one day by default (filter recovery_mode_email_link_ttl).
• Paused extensions: in recovery mode the plugin or theme that caused the error is paused (WP_Recovery_Mode::store_error), so the dashboard loads and you can deactivate or update it.
• Leaving recovery mode: logging out ends the recovery mode session.

The weak spot is the same as with “Lost your password?”: the email goes to the admin address. If that inbox is dead, define a working address in wp-config.php before the next incident:

define( 'RECOVERY_MODE_EMAIL', '[email protected]' );

The opposite switch also exists. wp_is_fatal_error_handler_enabled() returns false when WP_DISABLE_FATAL_ERROR_HANDLER is set to true in wp-config.php, which turns the whole mechanism off. That helps on a development machine where you want the raw PHP error. On production it removes the recovery email, so leave it undefined. The matching filter wp_fatal_error_handler_enabled runs before plugins load, so a plugin, mu-plugin or theme cannot use it.

#WordPress stuck in maintenance mode after an update

A failed or interrupted update can leave the message “Briefly unavailable for scheduled maintenance” on every URL, including wp-login.php. The cause is a file called .maintenance in the WordPress root. wp_is_maintenance_mode() reads the $upgrading timestamp stored in that file and keeps the site in maintenance mode only while the file is less than 10 minutes old.

If the message stays longer than that, or you cannot wait:

1. Connect over FTP or SFTP and open the directory that contains wp-config.php.
2. Enable hidden files in your client, because the name starts with a dot.
3. Delete .maintenance.
4. Reload wp-login.php and check Dashboard > Updates, because the update that created the file may not have finished.

A file called maintenance.php in wp-content is a different thing: it is an optional drop-in that replaces the default maintenance message. Do not confuse the two.

#How to reinstall WordPress core and reset salts

If you are dealing with a hacked site, or a completely broken installation, surgical fixes might not work. Here are the nuclear options.

#1. How to replace WordPress core files

Sometimes, the core files themselves (wp-login.php, wp-admin files) are corrupted or infected with malware.

1. Download a fresh copy of WordPress from wordpress.org.
2. Unzip it on your computer.
3. Delete the wp-content folder from this fresh copy (you don’t want to overwrite your own content!).
4. Delete the wp-config-sample.php file.
5. Upload EVERYTHING else to your server, overwriting the existing files.
   • This replaces all logic files with fresh, clean code.
   • It does not touch your database, your images, or your theme.

#2. How to log out all users (new salts)

If you suspect a session hijacking or want to ensure nobody else is logged in while you work:

1. Open https://api.wordpress.org/secret-key/1.1/salt/
2. Copy the generated keys.
3. Open wp-config.php. Refer to WordPress Developer Resources on Editing wp-config.php for standard constant definitions.
4. Replace the existing Authentication Unique Keys and Salts with the new ones.
5. Effect: Every valid login cookie on the planet for your site is instantly invalidated. Everyone (including you) is logged out.

#3. How to check for exposed wp-config backups

Automated scanners and attackers search with queries like inurl:wp-config "secret" to discover misconfigured servers where backup files (such as wp-config.php.bak, wp-config.php~, or .env) were left in the public document root. According to guidelines from the OWASP Top 10 Security Risks, preventing security misconfiguration requires web server rules (Nginx or Apache) that return 403 or 404 responses for any request attempting to access configuration files directly.

#How to prevent WordPress login lockouts

Recovering access is stressful. The goal should be to never lose it again. Here is your checklist for hardening your login door.

#Least privilege for WordPress user roles

Never give separate accounts “Administrator” access unless they are technically capable of managing the server.

• Editor: Can write and publish posts.
• Shop Manager: Can manage WooCommerce orders.
• Administrator: Can break the site. If you have a client, give them Editor access. Only give Administrator access if they sign a waiver.

#Hardware keys and passkeys for WordPress login

In 2026, passwords are considered insecure. The industry has moved to Passkeys (FIDO2 authentication).

• Use a hardware key like YubiKey or Titan Key.
• Install a plugin capable of WebAuthn.
• Google and Apple now support Passkeys natively. This means you can log in to WordPress using your Face ID or Touch ID. It is unphishable.

#How to limit login attempts in WordPress

Brute Force attacks are robots trying thousands of passwords per second.

• Install Limit Login Attempts Security (wordpress.org slug limit-login-attempts-reloaded).
• Set it to lock out an IP after 3 failed attempts for 24 hours.
• On the sites where I have done this, it takes most of the automated login traffic off the server. The exact drop depends on how much of your traffic is bots in the first place.

#How to log out of other WordPress sessions

If you log in from a public café or a friend’s computer, you might forget to log out.

• Go to Users > Profile.
• Scroll down to the “Sessions” section.
• Click Log Out Everywhere Else. This is a core feature often overlooked.

#Summary checklist

Regaining access to WordPress is a logical process of elimination methods.

1. Is the URL correct? (Check for hidden login plugins via FTP).
2. Is the Password correct? (Reset via WP-CLI or DB MD5 hash).
3. Is the User Role correct? (Check wp_capabilities serialization).
4. Is code blocking you? (Rename plugins folder, enable WP_DEBUG).
5. Is the Core corrupted? (Re-upload fresh wp-admin/includes).

Once you are back in, do not just sigh in relief. Secure the breach. Install a passkey solution, set up a redundant admin account, and verify your backup schedule. Access recovery is a battle you should only have to fight once.

Read Next: Complete WordPress Security Hardening Guide (2026 Edition)