What to do when you can't log in to WordPress

When you can’t log in, the cause is fairly well determined by the symptom. Find yours in the list below.

You don’t know the admin URL

https://example.com/wp-login.php    ← the login screen
https://example.com/wp-admin/       ← redirects to the login screen when logged out

In a subdirectory install it’s something like https://example.com/blog/wp-login.php. If a security plugin has changed the login URL, only that custom URL works (see “You changed the login URL and can’t remember it” below).

You forgot your password

1. Try the normal reset first

Use “Lost your password?” on the login screen and enter your email address (or username) to receive a reset link.

2. When the email doesn’t arrive

WordPress mail is sent through the server’s PHP mail function, so server-side restrictions often stop it from arriving. After checking your spam folder, recover with one of these.

Method A: fix it in the database

1. Open phpMyAdmin (or another DB tool) from your host’s control panel
2. Open the wp_users table and edit your user’s row
3. Rewrite the user_pass value, choosing the MD5 function, enter a new password and save
4. Log in with that password (after logging in, it’s automatically re-saved in a safer format)

Method B: create an administrator with temporary code

Over FTP or a file manager, add this near the top of the active theme’s functions.php.

add_action('init', function () {
  $user = 'temp_admin';
  $pass = 'a long and complex password here';
  if (!username_exists($user)) {
    $id = wp_create_user($user, $pass, '[email protected]');
    (new WP_User($id))->set_role('administrator');
  }
});

Once you can log in, always delete this code and change the password. Leave it in place and anyone who can read the code can create an administrator.

”Cookies are blocked or not supported by your browser”

Try these in order.

1. Allow cookies in your browser / try a private window
2. Clear the cache and cookies and reload
3. Try another browser (to narrow it down)
4. If it persists, suspect a site URL mismatch (next section)

The login works but you’re bounced back (redirect loop)

The number one cause is a mismatch in the site URL setting. It happens when the two URLs under “Settings” → “General” (WordPress Address and Site Address) don’t match the URL you’re actually visiting exactly—including https vs http and the presence of www.

Since you can’t reach the admin screen, pin them in wp-config.php.

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

Once you’re logged in, decide whether to remove those two lines after fixing the cause—or leave them. On a site that’s always on SSL, leaving them is the safer option.

If that still doesn’t fix it, narrow it down by deactivating every plugin.

• Over FTP, rename wp-content/plugins to plugins-off → try logging in
• Once you’re in, restore the name and activate plugins one by one to identify the culprit

You changed the login URL and can’t remember it

When a security plugin has set a custom URL like /login-xxxx, wp-login.php returns a 403 or 404. Here’s how to recover.

1. Over FTP, rename wp-content/plugins/that-plugin to deactivate it
2. wp-login.php works again
3. Restore the plugin name in the admin screen and check the setting

You lost your two-factor device

Reinstalling the authenticator app won’t recover it. Deactivate the plugin by renaming it over FTP, then reconfigure after logging in. If the plugin can issue backup codes, always keep a copy when you set it up.

”Too many failed login attempts”

That’s a lock from a login-attempt-limiting plugin or a server feature.

• Wait and retry (most release after a few dozen minutes)
• If you’re in a hurry, rename the plugin over FTP to deactivate it
• If it’s a server feature, unlock it or allowlist your IP in the control panel

Making logins safer (once you’ve recovered)

Ways to prevent a repeat and strengthen security, ordered by impact.

1. Don’t use admin as a username—avoid a name that’s assumed to be targeted
2. Use a long password—length beats mixing in symbols (a password manager is recommended)
3. Add login attempt limits—this effectively stops brute-force attacks
4. Two-factor authentication—always keep the backup codes
5. Delete unnecessary administrator accounts—don’t leave permissions with people who’ve moved on

Summary

1. The login screen is /wp-login.php. If it’s a custom URL, renaming the plugin gets you back
2. When reset emails don’t arrive, rewrite user_pass in the DB with MD5 or create an administrator with temporary code
3. Cookie errors and redirect loops usually mean a site URL mismatch. Pin WP_HOME and WP_SITEURL
4. Once recovered, use a long password plus login attempt limits—more effective than changing the URL

Even when you’re locked out, there’s always a way back. Just don’t skip the backup before you start.