Nothing is more frustrating than being locked out of your own WordPress website. Login issues can appear suddenly — after a plugin update, a failed migration, or a session expiring at the wrong moment. Almost every WordPress login problem has a clear fix, and none of them require a developer. The most common causes are wrong or forgotten passwords, redirect loops that send you in circles, and accounts locked out after too many failed attempts.
Before anything else: clear the browser cache and try an incognito window. Many apparent login problems are just cached redirects or stale cookies, and a clean session fixes them instantly — worth ruling out before assuming something’s actually broken server-side.
Why This Happens
Most login issues trace back to one of four causes. A plugin conflict is the most common — security plugins, caching plugins, and custom login-redirect plugins can interfere with authentication, especially right after an update; if a plugin is the culprit, troubleshooting WordPress plugin conflicts covers isolating which one systematically. A corrupted .htaccess file can block the login page outright. A URL mismatch between the WordPress and Site addresses creates a redirect loop. And database issues can prevent credential validation even when the password entered is genuinely correct.
Resetting a Password
Start with the standard route: click Lost your password? on the login page, enter the email address, and check the inbox (and spam folder) for the reset link. Full detail in WordPress’s own documentation if anything about the flow looks unfamiliar.
If no reset email arrives at all, that points to an email delivery problem rather than the password itself, and the fallback is resetting directly in the database via phpMyAdmin. This is where it’s worth knowing something that’s changed recently: WordPress 6.8 switched its password hashing algorithm from the older phpass system to bcrypt, a meaningfully stronger standard. The old trick of setting user_pass to an MD5 hash via phpMyAdmin’s function dropdown still generally works as a stopgap — WordPress recognises the weaker hash and upgrades it to the current algorithm automatically on next login — but it’s genuinely outdated practice now rather than the recommended method. The more correct current approach: generate a real bcrypt hash directly (a quick PHP snippet running password_hash('newpassword', PASSWORD_BCRYPT) on the server, or a WordPress-specific hash generator tool, produces the right format), then paste that resulting hash straight into the user_pass field in phpMyAdmin — no MD5 intermediate step, no relying on WordPress’s auto-upgrade to catch up on next login.
Fixing a Redirect Loop
A redirect loop — clicking Log In just refreshes the login page without ever logging in — is almost always a URL mismatch or a cookie problem. Try an incognito window first; if login works there, it’s a cached redirect, clearable through the browser and whatever caching plugin the site runs. If not, check Settings → General and confirm the WordPress Address and Site Address use the identical protocol (http vs https) and domain format (with or without www) — even a trailing-slash difference here causes an infinite loop.
If the admin panel is unreachable to even check those settings, override them directly in wp-config.php, above the “That’s all, stop editing!” line:
define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');Replace with the real domain — this overrides the database values and is usually the fastest way back in. Remove these two lines again once the URLs are corrected properly through Settings → General; leaving them in place silently overrides any future change made through the dashboard, which is a confusing bug to chase down months later if forgotten.
Recovering a Fully Locked-Out Admin Account
If a security plugin has blocked the IP or suspended the account after too many failed attempts, the fastest route back in is deactivating everything via FTP: connect to the site, navigate to wp-content/plugins/, rename the entire plugins folder to something like plugins-disabled. WordPress deactivates every plugin automatically, which usually restores access immediately — log in, identify the actual offending plugin, rename the folder back, and reactivate the rest one at a time to confirm which one caused it.
If a brand-new admin account is genuinely needed, it’s created the same way as any user in wp_users (with a properly-generated bcrypt user_pass, per above) plus two rows in wp_usermeta for that user’s ID: wp_capabilities set to a:1:{s:13:"administrator";b:1;}, and wp_user_level set to 10. To prevent this scenario recurring, limiting login attempts sets a threshold that stops bots without catching legitimate users first.
Once back in, a few minutes of prevention pays off: changing the login URL removes the default path bots target, and confirming the admin email is current matters more than it sounds — a stale address turns a simple password reset into a full database recovery job. Never delete a locked-out admin account instead of resetting it; deleting orphans every post assigned to that user. Between having FTP credentials saved and phpMyAdmin access bookmarked, even a complete admin lockout is never more than a few steps from being sorted — part of the same setup discipline covered in the step-by-step guide to building a WordPress website.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.