I'm locked out of WordPress admin

Forgot your WordPress admin password, or got locked out for some other reason? You have multiple paths back in.

Easiest: portal auto-login

If you're managing WordPress through the Flashcloud portal, you don't need the WordPress password at all.

1. Go to Services → click hosting → WordPress tab.
2. Find your site card.
3. Click Open admin (or the auto-login button).

The portal mints a single-use sign-in URL and opens it in a new tab. You're in WordPress admin, no password typed.

This works regardless of whether you remember the password or even know it. It's the recommended path for any portal-managed site.

Standard WordPress password reset

If you need to actually reset the password (not just sign in once):

1. Visit https://yourdomain.com/wp-login.php.
2. Click Lost your password?
3. Enter your username or email.
4. WordPress emails a reset link to your admin email.
5. Click the link, set a new password.

Works as long as:

• Your admin email is one you can access.
• WordPress can send email from your hosting (usually fine; see below if not).

Reset password via phpMyAdmin

If the email reset doesn't work, you can change the password directly in the database:

1. Open phpMyAdmin from your hosting service in the portal.
2. Navigate to the WordPress database.
3. Open the wp_users table.
4. Find your user row.
5. Edit user_pass. Set:
   • Function: MD5
   • Value: your new password (in plain text — phpMyAdmin will hash with MD5).
6. Save.

WordPress will accept the MD5 hash on first login and re-hash to its modern format automatically. After this, your new password works at the login page.

Reset password via wp-cli (advanced)

On hosting plans with SSH access:

cd /home/your-user/public_html
wp user update yourusername --user_pass=newpassword

Replace yourusername and newpassword. The wp command is wp-cli, available on most modern WordPress hosting (definitely on ours).

Create a new admin user

If your existing user is corrupted or you want a fresh admin account:

Via phpMyAdmin

1. Open phpMyAdmin → WordPress database → wp_users.
2. Insert a new row:
   • user_login: newadmin
   • user_pass: your password (MD5'd)
   • user_email: your email
   • user_registered: today's date
   • user_status: 0
3. Note the new user's ID.
4. In wp_usermeta, insert two rows:
   • user_id: the new ID, meta_key: wp_capabilities, meta_value: a:1:{s:13:"administrator";s:1:"1";}
   • user_id: the new ID, meta_key: wp_user_level, meta_value: 10

Now you have a new admin user. Log in.

Via wp-cli

wp user create newadmin admin@yourdomain.com --role=administrator --user_pass=password

Same effect, one line.

"I'm getting redirected to login on every admin page"

If you log in successfully but immediately get bounced back to the login page:

• Plugin conflict — disable all plugins via FTP (rename /wp-content/plugins/ to /wp-content/plugins.bak/); try logging in. If it works, re-enable plugins one at a time.
• Theme conflict — switch to a default theme (Twenty Twenty-Four) via FTP or wp-cli.
• Cookie issues — set up WP_SITEURL and WP_HOME in wp-config.php to match your actual site URL.
• Session storage — clear browser cookies for the domain and try again.

"Two-factor on WordPress is locking me out"

If you've installed a 2FA plugin on WordPress and lost your code:

• Disable the 2FA plugin via FTP — rename its folder under /wp-content/plugins/ to disable it. WordPress falls back to password-only login.
• wp-cli alternative: wp plugin deactivate two-factor-plugin-name.

Once back in, regenerate 2FA codes and re-enable.

(Different from Flashcloud's portal-level 2FA, which doesn't lock you out of WordPress.)

"I'm locked out by a security plugin"

Some plugins (Wordfence, iThemes Security) lock IPs after failed login attempts. If you're locked out of your own site:

• Wait — most lockouts are temporary (15–60 minutes).
• Disable the security plugin via FTP — rename its folder under /wp-content/plugins/. The plugin's lockout list is bypassed when the plugin isn't running.
• Check .htaccess for IP blocks the plugin may have written.

After regaining access

Worth doing right after:

1. Change the password to something strong and unique.
2. Check active users — wp-admin → Users — make sure no unauthorized accounts were added.
3. Review recent activity — many security plugins log login attempts; review for suspicious patterns.
4. Update WordPress core, plugins, and themes if any are outdated. Out-of-date software is the #1 cause of compromised admin accounts.

Power-user note

For sites where you've completely lost access (no FTP, no wp-cli, no portal access), open a ticket. We can verify identity and reset credentials at the server level. Identity verification involves checking ownership through invoice records and contact details — may take a few hours, but is reliable.