Forgot It? How to Reset Your WordPress Password

You sit down to update the website, type the password you are fairly sure is right, and WordPress says it is not. Maybe it was saved in an old browser. Maybe someone else set it up years ago and you never knew it. Either way you need to get in today, and you would rather not start by calling anyone.

There are several ways to reset your WordPress password, and the first one usually takes a few minutes. They are listed below in the order to try them, from the self-service link to the hosting route that works even when email does not. Stop as soon as you are in.

First, rule out the simple things

Quite often a “forgotten” password turns out to be one of these:

• The wrong account. WordPress accepts either your username or your email address on the login form. If you have used several addresses over the years, try each one.
• Caps Lock, or a keyboard set to another language. Type the password into a notes app first to see what you are actually typing.
• A saved password from a different site. Your browser may be filling in the login for your staging site or an old copy. Check the address bar.
• A security plugin lockout. After several wrong attempts, some plugins block your address for a while and the message can look like a password error. Waiting, or trying from your phone on mobile data, tells you which it is.

If the login page reloads without any error, or you see messages about cookies or redirects, the password is probably fine and something else is wrong. That is a login fault rather than a forgotten password, and our WordPress login problem fix page covers those.

Route 1: reset your WordPress password with the “Lost your password?” link

1. Go to your login page, usually your website address followed by /wp-login.php or /wp-admin/. If your site uses a custom login address, use that.
2. Click Lost your password? under the form.
3. Enter your Username or Email Address and click Get New Password.
4. Open the email from your site and click the reset link in it.
5. WordPress suggests a strong new password. Keep it or type your own, then click Save Password.
6. Log in with the new password, and save it in a password manager this time.

Two details help. The link is valid for a day by default, so use it promptly. And only the newest link works: if you requested three emails, use the last one, because each request replaces the one before.

When the reset email does not arrive

Give it ten minutes, then work through this:

• Check spam, junk and any “promotions” or “updates” tabs in your inbox.
• Search your mailbox for your site’s name. The email often comes from an address such as wordpress@ followed by your domain, which some filters treat with suspicion.
• Make sure the address on the account is one you can still read. If the account was set up with an old work address or the developer’s email, the link is going there. Changing it needs someone who can already log in; see updating a user’s email address.
• Ask whether the site sends any email at all. If contact form enquiries have also gone quiet, the problem is the site’s outgoing mail, not your account. Our guide to fixing WordPress email delivery explains the usual cause.

If the email is not coming, move on to the next routes rather than requesting it again and again.

Route 2: ask another administrator

If anyone else has an administrator account on the site, they can sort this out from the dashboard without any technical steps. Send them these instructions:

1. Go to Users → All Users and hover over the person’s name.
2. Click Send password reset. This emails the person a fresh reset link, the same as Route 1, so it only helps if their email works.
3. If email is the problem, click the name to open the profile instead. In the Account Management section, click Set New Password, enter a strong password and click Update User.
4. Pass the new password on by a safe route, such as a password manager’s sharing feature or a phone call, and ask the person to change it after logging in.

A lockout like this is the main reason to keep a second trusted administrator on a business site.

Route 3: your hosting control panel

When there is no other administrator and email is not arriving, the way in is through your hosting account, which sits underneath WordPress. Some hosting panels include a WordPress management tool, often in a section for WordPress or installed applications, that can set a new administrator password directly. If your host offers one, that is the easiest option at this stage. Your host’s support team can also tell you where it is.

If you or your developer use the command line on the server, WP-CLI can do the same job with wp user update followed by the username and –user_pass= with the new password. Only use this if you are comfortable with that tool.

Route 4: phpMyAdmin, carefully

This is the manual route, and the one to treat with most respect, because you are editing the site’s database by hand. A wrong click in the wrong row can lock out a different person or damage the table. Back up first, every time.

1. In your hosting panel, open phpMyAdmin.
2. Choose your site’s database on the left. If there are several, the right one is named in the wp-config.php file in your site’s main folder, on the line containing DB_NAME.
3. Click Export and download a copy of the whole database before you change anything.
4. Open the users table. Its name ends in _users. It is often wp_users, but many sites use a different prefix, so go by the ending.
5. Find your row by looking in the user_login column, and click Edit on that row only.
6. In the user_pass row, open the Function dropdown and choose MD5. In the value box, replace the existing text with your new password.
7. Click Go to save, then log in with the new password.

MD5 on its own is weak, but WordPress still accepts it as a starting point and replaces it with its own stronger format the first time you log in, so the weak version does not stay in the database. If you are not confident doing any of this, stop and ask your host or a developer. A short delay is better than a damaged users table.

When there is no working administrator at all

Sometimes the reset works but you find your account has been demoted, or an administrator you do not recognise is in the list, or the account’s email has been changed to an address you have never seen. That is no longer a forgotten password. Treat it as a possible break-in, and read about recovering admin access after a takeover before you do anything else.

After you are back in

Take two minutes to make the next time easier. Check that the email on your profile is current. Save the password in a password manager. If you can, add two-factor login. And if you simply want to change a password you already know, that is a different, simpler job described in changing your WordPress password.

Passwords are one part of looking after accounts; the rest of that topic is in the hub on managing WordPress users, and the site as a whole in the WordPress site owner’s handbook.

Frequently asked questions

Does resetting my password log me out on other devices?

When you save a new password, WordPress ends your existing login sessions, so you will need to sign in again on your other computers and phone with the new password. That is useful if you suspect someone else knew the old one, because their session ends too.

Can I reset the password if I have forgotten my username as well?

Yes. The reset form accepts your email address instead of a username, and the reset email tells you the username on the account. If you do not know which email was used either, another administrator or your hosting account is the way forward.

Why does my reset link say it is invalid?

Usually because it has expired or a newer link replaced it. Request one more reset and use only that email, the same day. If it still fails, copy the whole link and paste it into your browser, because some email programs break long links across lines.

Will changing my password through phpMyAdmin break anything else?

Not if you edit only the password field in your own row. Your posts, role and settings are stored separately and stay as they were. The risk comes from editing the wrong row or another column, which is why exporting the database first matters.

The database route is where many owners reasonably decide to stop. Our WordPress bug fixing team can take the hosting side from there with you, starting from a backup.

Next in this series: How to Change Your WordPress Username When It’s Locked