You go to wp-admin and the password doesn't work. You try resetting through email, but no message arrives. The site sits there like a dead weight: you can't publish a post, update a plugin, or respond to a comment.

A familiar scenario for anyone who has been administering WordPress for more than a month. But it's not a dead end: WordPress stores credentials in several places, and each one can be accessed without going through the standard login. You just need to know the route.

Below are five working methods to reset the admin password. From the simplest (email) to the most radical (direct database editing). At least one will work, even if you've lost access to both your email and hosting.

💡 Quick overview:

• Standard reset via email from the login page takes a minute if the server's mail delivery is working
• Direct hash editing in the wp_users table through phpMyAdmin, no emails, no codes, no old password needed
• Temporary insertion of wp_set_password() into the theme's functions.php via FTP when phpMyAdmin is unavailable
• A single WP-CLI command in the terminal, the fastest method, thirty seconds via SSH
• Changing the password through the standard admin panel features, for when your session is still active

1. Standard reset via email

The most obvious path. Go to the login page, usually https://yoursite.com/wp-admin. Below the login form, click the "Lost your password?" link.

The system will request a username or email. Enter the one linked to the account and click "Get New Password". WordPress will generate a one-time reset link and send it to the admin's email.

The email arrives within a minute or two. If five minutes have passed, check your Spam folder. That didn't help? Then the email most likely never left the server at all. The cause is almost always unconfigured mail delivery: by default, WordPress uses wp_mail(), which attempts to send email through the hosting's local mail server. On cheap plans, such outgoing mail is often blocked, and no SMTP plugin is installed. Move on to the next method.

2. Reset through phpMyAdmin

The most reliable fallback method. phpMyAdmin is a web interface for working with MySQL, accessible from the hosting panel (cPanel, DirectAdmin, ISPmanager). It allows you to directly overwrite the user_pass field in the wp_users table, without emails, without confirmation codes, and without the old password.

Step-by-step instructions.

Log into your hosting panel, find the "Databases" section, and launch phpMyAdmin. Before making any changes, create a backup of the current state: "Export" tab → "Quick" method → SQL format → "Go" button. Download the file to your computer as insurance in case of an error.

Now in the left menu, select your site's database and go to the "Structure" tab. Find the wp_users table (the wp_ prefix may differ if you changed it during installation). Click on the table name to open the list of users.

Next to the account you need, click "Edit" (the pencil icon). You'll see all user fields. You need the user_pass row, which contains the password hash, not the password itself.

In the "Value" column, enter your new password in plain text. In the "Function" dropdown, select MD5. Click "Go". phpMyAdmin will calculate the MD5 hash of the entered string and write it to the database.

Note: starting with WordPress 6.8 (2025), passwords are hashed by default using the bcrypt algorithm via wp_hash_password(). However, WordPress maintains backward compatibility: during login, it checks the password sequentially through bcrypt, phpass, and MD5, so the MD5 hash from phpMyAdmin will work regardless of version. But this is a temporary solution: as soon as you log in, immediately change the password through the standard method (method 5) so WordPress rehashes it with a modern algorithm.

Close phpMyAdmin, go to the login page, and enter your username with the new password.

3. Reset via FTP using the functions.php file

If phpMyAdmin is unavailable but you have FTP access or the hosting file manager, this method is for you. The idea is simple: temporarily insert a call to the wp_set_password() function into the active theme's functions.php, which will forcibly change the password the first time any site page loads.

Connect to the server via FTP (using FileZilla, WinSCP, or the hosting panel's file manager). Navigate to the /wp-content/themes/your-theme/ directory and find the functions.php file. Download a copy to your computer in case you need to roll back.

Open functions.php in an editor. Right after the opening <?php tag, add the line:

1
wp_set_password('new_password', 1);

Here's what this means: new_password is the password you want to set (replace it with your own); 1 is the user ID. This is usually the administrator with ID = 1. If you have a different ID, check it in phpMyAdmin in the wp_users table.

Save the file and upload it back to the server. Now visit https://yoursite.com/wp-admin once. When the page loads, functions.php will execute and the password will change. You'll be able to log in with the new password.

Critically important: immediately after logging in, go back to functions.php and delete the line you added. If you leave it, the password will reset every time any page loads, making it impossible to log in. After removing the line, go to the admin panel → "Users" → "Your Profile" and set a permanent password through the standard interface.

4. Reset via WP-CLI

The fastest method, just one console command. WP-CLI (WordPress Command Line Interface) is installed on most modern hosting services and gives you full control over the site through the terminal. If you work with the server via SSH, this method takes exactly thirty seconds.

Connect to the server via SSH and navigate to the WordPress root directory:

1
cd /home/user/public_html

First, list the users to find the ID of the account you need:

1
wp user list --fields=ID,user_login,user_email,roles

The output will show all registered users with their identifiers and roles. Note the admin ID, which in most cases is 1.

Now one command to reset the password:

1
wp user update 1 --user_pass=new_password

Substitute your ID instead of 1 and your password instead of new_password. The command updates the password directly in the database and makes it work immediately, no emails, no intermediate steps.

Bonus: if you don't want to leave the password in the terminal history, use the --prompt flag. WP-CLI will request the password interactively and won't save it in the logs.

Why WP-CLI beats phpMyAdmin: it calls the standard WordPress function wp_update_user(), which applies the current hashing algorithm (bcrypt starting with WP 6.8), rather than writing a raw MD5 hash to the database manually.

5. Reset through the WordPress admin panel

A method for the fortunate case: your admin session is still alive, but you don't remember the old password or want to change it to something stronger. The simplest method of all, everything is done in the familiar interface.

In the admin sidebar menu, navigate to: Users → Your Profile. Scroll down to the "Account Management" section.

Click "Set New Password". WordPress will suggest a random strong combination. You can accept it or enter your own. The indicator below the field will show the strength: aim for the green bar. If you intentionally set a weak password, check the "Confirm use of weak password" checkbox.

Click "Update Profile" at the bottom of the page. A notification "Profile updated" will appear at the top, and the password is changed. Log out and log back in to verify.

The video provides a visual demonstration of four reset methods: via email, phpMyAdmin, hosting panel, and file manager. All steps are shown on a real server with explanations at each stage.

⁉️🤔 Frequently asked questions

Why doesn't the password reset email arrive?

Eight times out of ten, the problem is unconfigured mail delivery on the server. WordPress uses wp_mail() by default, which tries to send email through the hosting's local mail server, and many hosts block such outgoing mail. The solution: install an SMTP plugin (FluentSMTP or Post SMTP) and configure delivery through an external service such as Gmail SMTP, Mailgun, or SendGrid. The email may go to spam, especially if the domain is new and SPF, DKIM, and DMARC aren't configured. Before diving into the database, always check your Spam folder. We've seen cases where the email arrived there within thirty seconds of the request.

Can I reset the password if I have access to neither email nor hosting?

There's no direct way: the password is stored either in the database (access through hosting) or changed via email (access through mail). If both are lost, the only option is to contact hosting support with proof of account ownership. Support can manually reset the admin password. An alternative workaround: if a backup plugin (UpdraftPlus, Duplicator) is active on the site and backups go to Google Drive or Dropbox, restore the site from a copy on new hosting where you'll have full database access. It's labor-intensive, but it works.

Which method is safest? Will I break my site?

The safest is the standard email reset (method 1): it's built-in, doesn't break anything, and WordPress generates the password itself. Among manual methods, the least risky is phpMyAdmin (method 2): you change exactly one field in one table and make a backup beforehand. The functions.php method via FTP is safe as long as the code is deleted immediately after logging in, but forgetfulness here is costly: a leftover line breaks login for all users on every page load. WP-CLI is technically the "cleanest": it calls a standard WordPress function and applies the current hashing algorithm (bcrypt) rather than manually writing MD5 to the database. However, WP-CLI access requires SSH, which isn't available on all hosting plans.

Do I need to change the password after resetting through phpMyAdmin or FTP?

Absolutely. Methods 2 (phpMyAdmin) and 3 (FTP) set the password bypassing WordPress's standard mechanism. Immediately after logging in, go to the admin panel, open "Users → Your Profile", and set the password again through the standard method. WordPress will rehash it with a modern algorithm (bcrypt) and update the salt. A password set via an MD5 hash through phpMyAdmin is technically functional but less secure than one generated through the standard process.

What to do if none of the methods worked

Go through the list again, methodically, step by step. In the vast majority of cases, the problem isn't with the method but with a missed detail: the table prefix changed (wp_users → xyz_users), the user ID was mixed up, there's a typo in the WP-CLI command, or a forgotten line in functions.php from a previous attempt.

If you've tried everything, contact hosting support. Describe the situation honestly: which method you tried, which step you got stuck on. Support is more willing to help those who've already tried to solve the problem themselves rather than asking to "fix the site" in the abstract.

And one last thing: after successfully logging in, set up two-factor authentication. The Wordfence plugin includes 2FA in its free version. You can forget a password, but you almost never lose a phone with an authenticator app. Start with this right now while the admin panel is open.