Before you start

• ✓ Know the site’s address and, if you have it, the admin user name or email.
• ✓ For WP-CLI: SSH access to the hosting account, and the path to the WordPress folder.
• ✓ For cPanel methods: a cPanel login for the account that hosts the site.
• ✓ A recent backup, if you plan to change anything else at the same time.

Method 1: the reset email

1. Open https://your-site.com/wp-login.php?action=lostpassword.
2. Enter the admin user name or email address.
3. Open the email from WordPress and follow the link to set a new password.

If no email arrives, check spam, then check that the site can send email. Many sites need an SMTP plugin to send reliably. If email still fails, use one of the methods below.

Method 2: WP-CLI over SSH (fastest)

WP-CLI is the command-line tool for WordPress. It is available on most cPanel servers. Go to the WordPress folder first:

cd ~/public_html            # or the folder where WordPress is installed

# List admin users
wp user list --role=administrator --fields=ID,user_login,user_email

# Set a new password. WP-CLI asks for it, so it is not saved in your shell history
wp user update admin --prompt=user_pass

Replace admin with the user name from the list. To send the user a reset email instead, run wp user reset-password admin.

If you do not know any admin user

Create a new administrator, log in, then remove or fix the old account:

wp user create newadmin you@example.com --role=administrator --prompt=user_pass

Method 3: cPanel tools (no SSH needed)

If the site was installed with an installer in cPanel, you can change the admin password there:

• WordPress Toolkit: open WordPress Toolkit, choose the site, and use the admin login or password option for that installation.
• Softaculous: open Softaculous, go to All Installations, edit the site, and enter a new admin password.

Both tools change the password through WordPress itself, so the new password is stored securely.

Locked out by two-factor authentication

If you know the password but lost the phone or app that gives you the login code, use the backup codes you saved when you set up two-factor authentication. Without them, turn off the two-factor plugin over SSH, log in, and set it up again on your new device:

wp plugin list --status=active          # find the two-factor plugin name
wp plugin deactivate two-factor          # replace with the plugin name from the list

Without SSH, rename the plugin folder in wp-content/plugins with the cPanel File Manager. WordPress then turns the plugin off. Rename it back after you log in, and turn two-factor authentication on again straight away.

Why not edit the password in phpMyAdmin?

Old guides tell you to paste an MD5 value into the wp_users table. That is no longer good advice. Since WordPress 6.8, passwords are stored with bcrypt, a much stronger method. Editing hashes by hand is easy to get wrong, it can lock you out further, and it bypasses the checks WordPress runs. Use WP-CLI or the cPanel tools instead.

How WordPress stores passwords

WordPress never stores your password itself. It stores a hash: a one-way scramble that can be checked against what you type but cannot be turned back into the password. Since version 6.8, WordPress uses bcrypt for this. Older hashes are upgraded the next time each user logs in. The secret keys and salts in wp-config.php protect login cookies, which is why changing them logs everyone out.

WordPress multisite

On a multisite network, users are shared across all sites, so the WP-CLI commands above work for the whole network. To see who can manage the network, list the super admins:

wp super-admin list

Reset a super admin’s password the same way, with wp user update USERNAME --prompt=user_pass.

After you are back in

If you lost access because something was wrong, not just a forgotten password, check these straight away:

1. Look at the user list. Remove any administrator you do not recognise.
2. Change passwords for every admin, and for the cPanel and database accounts if you think they leaked.
3. Change the security keys in wp-config.php. With WP-CLI: wp config shuffle-salts. This logs everyone out.
4. Update WordPress, themes and plugins, and remove any you do not use.
5. Turn on two-factor authentication for admin accounts.
6. Scan for malware if anything looks unusual, such as new files or redirects.

See our WordPress backdoor alert for signs of a compromised site, and our short password reset checklist for a quick reference.

Useful WP-CLI user commands

Avoid the next lockout

• Store the password in a password manager, so it is never lost or reused on other sites.
• Keep a second administrator account for a trusted person, with its own strong password.
• Make sure the site can send email, so reset emails arrive. An SMTP plugin with a proper mail service is the most reliable option.
• Save the two-factor backup codes when you turn on two-factor authentication, somewhere safe and offline.
• Limit login attempts with a security plugin or server firewall, so password-guessing bots are blocked.

Troubleshooting