Locked Out of Your Own WordPress Site
You type the password you have used for years and WordPress says it is wrong. You click “Lost your password?” and the reset email never arrives. Or you get in, open the Users screen, and find your own account demoted to Subscriber while two administrators you have never heard of sit at the top of the list.
Each of these is a different situation, and each needs a slightly different fix. Being locked out is not always a hack. Sometimes a plugin update breaks the login page, or the site’s email stops sending so reset links vanish. But when a password has changed without you, or an admin has appeared that nobody created, you should treat the whole site as compromised. For a full incident, from first contact to final report, see how we repair hacked websites. This page is about the narrower job of getting you back in control of the dashboard and making sure you are the only one holding the keys.
Why Attackers Take Over Admin Accounts
An administrator account in WordPress can do almost anything: install plugins, edit theme files from the built-in editor, create more users, export content and change the site address. That makes it the most useful thing an attacker can hold. With it they can upload a plugin that is really a file manager, plant code in the theme, and come back whenever they like.
Attackers usually get there in one of a few ways:
- A reused or guessed password. If the same password was leaked from another service, it gets tried against your login page. Our post on brute-force login attacks covers how that guessing works and how to slow it down.
- A vulnerable plugin that allows privilege escalation. Some plugin flaws let a low-level user, or even a visitor with no account, give themselves the administrator role.
- Stolen session cookies or a compromised computer. Malware on an office laptop can capture logins as they are typed.
- An old developer or agency account that was never removed. If someone else built the site years ago, their login may still exist with a weak password.
Knowing which route was used matters, because closing the dashboard door while the plugin hole stays open just means the attacker creates a new admin next week.
How We Get You Back In
We do not need your old password to restore access. WordPress keeps its users in the database, so with hosting access (a control panel login, SFTP, or SSH) we can work underneath the login screen.
Step one: confirm what kind of lockout it is
Before changing anything we look at why the login is failing. A login page that loops back to itself often points to a cookie, caching or site-address problem rather than an attacker. A “wrong password” message on an account you know is right, combined with a changed admin email address in the settings, points the other way. We check the users table, the user roles stored alongside it, and the site’s general settings, because attackers often change the administration email address so password resets go to them instead of you.
Step two: take a backup first
Even a site you cannot log in to has files and a database worth preserving. We copy both before touching anything. If something we change has an unexpected side effect, we can step back, and the copy also keeps evidence of what the attacker did.
Step three: restore one trusted administrator
Using WP-CLI or the database directly, we set a new temporary password on your real account and put its role back to administrator if it was demoted. If your account was deleted, we create a fresh one for you. You then log in, set your own strong password, and we confirm the account’s email address is one you control.
Step four: deal with every other account
This is the part people skip. We list every user with elevated roles, not only administrators but editors and shop managers too, and go through them with you one by one. Accounts you do not recognise are not deleted straight away; we first note when they were registered and what content is attributed to them, then remove them and reassign any of their posts to you. Our blog post on finding an admin you did not create goes into what those accounts can tell you.
Step five: end every live session
Changing a password does not always throw out someone who is already logged in. We replace the security keys and salts in the site’s configuration, which signs out every user everywhere, including the attacker. You will need to log in again afterwards, and so will your staff.
Hidden Ways Attackers Keep Admin Access
Removing a rogue user is often not enough, because experienced attackers plan for it. These are the tricks we specifically look for once you are back in:
- Admins hidden from the Users screen. A few lines of code in a plugin or theme can stop a particular account from appearing in the list, even though it still exists in the database. We compare what the dashboard shows with what the database holds.
- Open registration with an admin default role. Under Settings, General, WordPress has an “Anyone can register” option and a default role for new users. If an attacker ticks the first and sets the second to Administrator, anyone can create an admin account at will. We put both back.
- Code that recreates a user. Some injected snippets check on every page load whether a certain username exists and quietly add it back if you removed it.
- A password reset path that does not need email. Fake “login helper” plugins can provide a secret URL that logs a visitor straight in as an administrator.
- Application passwords. WordPress lets each user create application passwords for tools that connect through its REST API. An attacker can add one to an admin account and keep API access after the main password is changed. We check each privileged user’s profile for any you did not create.
If we find code like this, the job is no longer just access recovery. It means the attacker had enough control to change files, and the site needs a proper file and database cleanup through our WordPress malware removal service, often alongside backdoor removal to find the scripts that let them back in. Where the attacker also wrote spam or scripts into posts and settings, a hacked database cleanup deals with that side.
What You Can Do Right Now
While you wait for us, or if you want to try a few things yourself, these steps are safe and useful:
- Do not delete the site or reinstall WordPress over it. That can destroy the evidence of how they got in, and it will not remove a backdoor sitting in your uploads folder.
- Log in to your hosting account and change that password first. If the attacker has your hosting login, nothing done inside WordPress will hold.
- Check the email account that receives WordPress reset messages. If someone controls that inbox, they can reset any password you set. Change its password and look at its forwarding rules.
- Write down what you saw. Usernames you did not recognise, the time you first noticed, any emails from WordPress about a changed password or email address. These help us build a timeline.
- Tell anyone else who logs in to the site. Staff, freelancers and agencies should stop logging in until access is sorted, so their sessions are not mixed up with the attacker’s.
If you think this started on a shared hosting account with several sites, mention that. One compromised site can give access to the others; we cover why neighbouring sites on one account get infected in a separate blog post.
When the Problem Is Not a Hack
Not every lockout means an attacker. Quite often the real cause is more ordinary:
- A security plugin has locked the account after several failed attempts, or has blocked the owner’s own IP address.
- A login-page plugin has moved the login address and nobody wrote down the new one.
- Password reset emails are being sent but land in spam, or the site cannot send mail at all.
- The site address in the settings was changed during a migration, so logging in redirects to the wrong domain.
We tell you plainly when that is what we find. You will not be pushed into a full malware cleanup for a lockout that turns out to be a misconfigured plugin.
Keeping the Dashboard Yours
Once you are back in, a few changes make a repeat much less likely. Each person who needs access should have their own named account, with the lowest role that lets them do their job. A content writer does not need to be an administrator. Old accounts for past developers should be removed rather than left dormant.
Adding a second login step is one of the most effective things you can do; our guide to setting up two-factor authentication in WordPress walks through it. Keeping plugins updated closes the privilege escalation flaws that let attackers create admins without a password at all. If you would rather not track that yourself, ongoing security maintenance covers it.
Reaching Us When You Are Locked Out
A lockout caused by an attacker goes ahead of our routine jobs. On WhatsApp, open your message with the word HACKED, add the site address and describe what the login screen does when you try. The form and phone reach us too. After a first look we give you a straight account of what probably happened and a realistic start time, and progress messages follow on WhatsApp.
To restore access we will need your hosting login or a temporary user from your host. If you do not have hosting access either, because a former developer set it up in their own name, tell us that too. It is a common situation, and we can guide you through getting it back from the host before we start on WordPress itself.