Being locked out usually means one of three things: the reset email is not being delivered, the account has lost its administrator role, or a security plugin is blocking the login. None of them require touching your content, and all of them are fixable from outside the admin — which is exactly why this can be done without the access you cannot get to.
Before you buy, two quick checks
Both are read-only and take a minute.
Check the reset email properly. Request a reset, then look in spam, and search your whole mailbox for the site name rather than scanning the inbox. Site email often lands in a filtered folder rather than nowhere.
Try a private window. Open the login page in a private or incognito window. If it works there, the problem is a stale cookie rather than your account, and clearing your browser data fixes it for free.
If neither helps, the fault is on the site and this is what fixes it.
Locked out of wp-admin - access recovery
You cannot log into wp-admin and the password reset email never arrives. We restore access safely at database level, without touching your content.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
This or something else?
| Login page loads, password rejected or reset never arrives | This fix covers it |
| Login page redirects in a loop and never settles | Login redirect loop fix |
| wp-admin is completely blank | White screen of death |
| You can log in but the menus are missing | User role and capability repair |
| Site shows content you did not put there | Security remediation, not this |
What you are seeing
- The password is rejected, or the reset email never arrives
- You may be locked out after too many attempts by a security plugin
- Your account may log in but land somewhere without admin menus
- A developer or agency may have left and taken the only admin account with them
Common causes
- Site email is not being delivered at all, so no reset can reach you
- A security plugin has locked your IP after failed attempts
- The account lost its administrator role, often after a bad migration or a role plugin
- The only admin account belongs to someone who is no longer available
- Session or cookie settings are misconfigured after a domain or SSL change
What we do
- Take a full backup before touching anything
- Confirm your identity as the site owner through the hosting account
- Create or restore an administrator account for you at database level
- Clear any security lockout that is blocking your IP or account
- Check why the reset email failed, and fix it if it is a simple configuration issue
- Confirm you can log in, then remove any temporary access we created
What is included
- Working administrator access under your own account
- Any security lockout on your IP or account cleared
- A check of why site email failed, with the cause named
- An audit of every other administrator account on the site, so you know who else has access
- The pre-fix backup, kept for 30 days
Not included
- Restoring access to a site you cannot demonstrate ownership of
- Full email deliverability setup, which is a separate service if the cause runs deeper
- Investigating or cleaning up a compromise, if the lockout turns out to be an intrusion
- Recovering a lost hosting account, which only your host can do
Questions about this fix
How do you prove I am the owner before letting me back in?
Through the hosting account. Anyone who controls the hosting controls the site, so hosting access is the proof. We do not restore admin access on the strength of an email asking us to, and we will decline politely if that is all there is.
Does clearing the security lockout make my site less protected?
No — we clear the specific block on your IP or account, not the plugin's protection itself. It keeps working exactly as before for everyone else.
An old developer is the only admin. Can you remove them?
We can, once you have shown ownership through hosting. The included account audit exists for exactly this — you get a list of every administrator on the site, and you decide which ones stay.
Why did the reset email never arrive?
Usually because the site sends mail through PHP rather than an authenticated service, so it is filtered before reaching you. We name the cause as part of this fix. Setting up proper delivery is a separate service, but you will know whether you need it.
Could this be a hack rather than a lockout?
Occasionally, and we look. If we find signs of an intrusion we stop and tell you before doing anything else, because restoring access to a compromised site without cleaning it first helps nobody. That work is quoted separately.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.