So you’re locked out of your WordPress admin panel. Maybe you forgot the password, maybe a client fired you and changed the credentials, or maybe you just inherited a site with no documentation. Whatever the reason, you need to change the WordPress admin password without accessing the admin panel, and you need to do it now. Good news: WordPress gives you at least three solid ways to pull this off, and none of them require touching that login screen you can’t get past.
The email reset link is the obvious first move, but it only works if your site’s mail server is actually sending emails. On cheap shared hosting, that’s a coin flip. Let me walk you through the real options, ranked by how likely they are to actually work when you’re stuck.
Option 1: The WordPress password reset email (start here)
This is the official method and it’s built right into WordPress core. Go to yoursite.com/wp-login.php or /wp-admin and hit the «Lost your password?» link under the login form.
Enter the email tied to your administrator account. WordPress sends a reset link valid for 24 hours by default. Click it, set a new password, done. This is the cleanest way to reset a WordPress admin password when everything else is working.
But here’s the catch nobody mentions: if your host blocks PHP mail or your domain has no SPF/DKIM records, that email never arrives. Check spam first, then check your hosting’s mail logs. If nothing shows up within five minutes, move to option 2.
Option 2: Reset the password via phpMyAdmin (the nuclear option that always works)
This is my go-to when email fails. You need access to your hosting control panel (cPanel, Plesk, DirectAdmin) or a database tool like phpMyAdmin. Log in, find the database WordPress is using, and open the wp_users table. If your site uses a custom prefix, it’ll be something like xyz_users instead.
Find the row with your admin username. Click Edit. Now look for the user_pass column. Delete whatever’s in there and type your new password in plain text. Then — and this is the part people forget — change the dropdown labeled «Function» from whatever it says to MD5. Hit Go or Save.
WordPress stores passwords as MD5 hashes, so if you skip the Function change, you’ll just save a plain-text string that will never match anything. Log in with your new password, then immediately change it again from inside the dashboard so WordPress re-hashes it properly with bcrypt.
Why this method is the most reliable
Because it bypasses email, plugins, and the entire WordPress application layer. As long as your database server is up, this works. I’ve used it on sites where the admin email was a dead address and the SMTP plugin had been disabled. It’s never failed.
Option 3: WP-CLI if your host gives you SSH access
If you’re on a decent host like Kinsta, WP Engine, or a VPS, you probably have SSH. Navigate to your WordPress root and run:
wp user update admin –user_pass=»YourNewStrongPassword»
Replace admin with your actual username. That’s it. One command, no database spelunking. This is the fastest way to change the WordPress admin password if you’re comfortable with a terminal. Most managed hosts also have a WP-CLI button in their dashboard, so you don’t even need to SSH in.
What if you don’t have database or SSH access?
Then you’re stuck with the email method, or you contact your hosting provider. Most hosts will verify your identity through billing info and can reset the password for you. Some will even do it through their support panel without touching the database.
If you have cPanel but no phpMyAdmin visible, look for it under the «Databases» section — it’s almost always there, just hidden from the main menu. If it’s genuinely disabled, ask support to enable it. There’s no legitimate reason to block phpMyAdmin on a WordPress site.
Security rules you should not ignore after resetting
Once you’re back in, don’t just carry on like nothing happened. If someone else had access, assume they still do.
- Change the admin email if you don’t recognize it. A compromised account often means a changed recovery address.
- Kill all active sessions by changing the user’s password in the dashboard — WordPress invalidates all cookies when the password changes.
- Check for new admin users under Users. Attackers love to plant a backup account.
- Scan for malware with Wordfence or Sucuri. A password reset doesn’t remove a backdoor.
- Enable two-factor authentication immediately. Without it, your new password is one phishing email away from being useless.
And for the love of everything, don’t use «admin» as your username. WordPress stopped defaulting to it years ago for a reason. If you’re still running that, rename the account or create a new admin and delete the old one.
Password hygiene that actually matters in 2026
The old «8 characters with a number and symbol» advice is outdated. Length beats complexity every time. A 16-character passphrase like purple-hedgehog-laser-biscuit is stronger than P@ssw0rd1! and infinitely easier to remember. Pair that with a password manager and you’re already ahead of most site owners.
