Being locked out of WordPress admin is a special kind of stressful, because the door you’d normally use to fix things is the door that won’t open. The cause matters: are you seeing a “wrong password” message, a blank login page, an endless redirect loop, or a “too many attempts” lockout? Each one has a different fix, and most of them get you back in within a few minutes. Let’s match your symptom to the fix.
One reassuring note up front: being locked out almost never means your content is gone. It’s an access problem, not a data problem. Your site is still there behind the door.
“Wrong password” — reset it properly
If your password genuinely isn’t working, try the “Lost your password?” link first — it emails you a reset. But this is exactly where the trouble often compounds: if your site isn’t sending email, that reset never arrives. When that happens, reset the password directly in the database using your host’s phpMyAdmin: open the wp_users table, find your user, and set a new password (choose the MD5 function when you save it so WordPress can read it). If that’s more than you want to touch, it’s a fine moment to call for help rather than risk a wrong edit.
A safer alternative some prefer: drop a small snippet into your theme’s functions.php over SFTP (a secure way to connect to your site’s files) that resets the password on the next page load, then remove it immediately after. Either way, never post the new password into a chat, email, or forum.
Blank login page or a redirect loop
If the login page is blank, or logging in bounces you straight back to the login screen forever, a plugin or theme is usually interfering. Deactivate all plugins over SFTP by renaming wp-content/plugins to plugins-off, then try logging in. If it works, rename the folder back and re-enable plugins one at a time to find the offender. If plugins aren’t it, rename your active theme’s folder in wp-content/themes to force a default theme and try again.
A redirect loop can also come from your Site Address settings being wrong (for example, pointing at the wrong domain or the wrong http/https). You can correct those directly in wp-config.php (WordPress’s main settings file) by adding:
define('WP_HOME','https://yoursite.com');
define('WP_SITEURL','https://yoursite.com');
“Too many failed attempts” — a security lockout
If you see a message saying you’ve been locked out for too many login attempts, that’s a security plugin or your host’s brute-force protection doing its job — it just can’t tell you apart from an attacker. The lockout is usually time-based, so waiting 15 to 60 minutes often clears it. To get in sooner, you can temporarily disable the security plugin using the SFTP folder-rename trick above, log in, and add your own IP to its allow-list. Don’t leave the protection off — it’s the thing stopping the real attackers.
Can’t even reach /wp-admin (white screen or error)
If the login page won’t load at all, you’re not really locked out — the site itself is broken, and fixing that brings the login back. Turn on the error log in wp-config.php to find the cause:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);
Then read wp-content/debug.log. This overlaps with the “there has been a critical error” page — same underlying fault, and the same plugin/theme deactivation steps apply.
The account itself is gone or changed
If your admin account vanished or its role was downgraded, that’s a red flag for a compromise — attackers sometimes create their own admin and demote yours. Get back in via a database reset as above, then check the users list for accounts you don’t recognize and remove them. Our WordPress security checklist covers locking the site back down afterward, and it’s worth changing passwords and enabling two-factor once you’re in.
How to stop it happening again
Most lockouts trace back to two things: email that doesn’t deliver reset links, and security settings you can’t easily override when they turn on you. Both are hosting-shaped problems. A platform that’s actually managed keeps mail delivering, keeps a copy of your site you can roll back to, and — crucially — has someone you can call who can get you back in without you touching a database.
That’s the everyday value of managed WordPress hosting. If you’re locked out, support is there any hour, with a first reply within 15 minutes, and can restore access safely instead of leaving you to edit live database tables under pressure. Every plan keeps off-site backups 3 times a day that are monitored and locked for 90 days against changes or deletion, even by ransomware, so if a lockout came from a broken site, there’s always a clean copy to fall back on. Same flat price whether it’s one site or a whole portfolio — the help is included, not metered.
A quick recap
- Wrong password: reset via email, or via the database / a temporary snippet.
- Blank page or redirect loop: deactivate plugins and theme over SFTP; check Site URL.
- Too many attempts: wait it out, or allow-list your IP — don’t disable protection for good.
- Can’t load wp-admin at all: turn on the error log and fix the underlying crash.
- Account missing or changed: reset access, remove unknown users, lock it down.
If you’d rather not be editing database tables while you’re locked out and anxious, that’s exactly the kind of thing our US-based support team handles as routine. And if the lockout turned out to be a broken site rather than a bad password, our guide to restoring from a backup is the fastest way back to normal.