Recover a WordPress Administrator Password Safely

Recover a WordPress account through a route you are authorized to use, starting with its normal password-reset flow. A lost password, broken reset email and a compromised site are different problems; changing one password does not resolve every intrusion.

If you can still sign in

Open Users > Profile, or edit the intended user through an authorized administrator account. Generate a long unique password, save it in a password manager and update the profile. Confirm the account and site before changing anything. Do not assume user ID 1 is your administrator.

If you cannot sign in

1. Open the site’s known HTTPS login page and choose Lost your password.
2. Enter the username or account email address requested by the form. WordPress normally sends a reset link, not your existing password.
3. Open the trusted link privately, set a unique password and test login. Do not forward reset links or publish them in screenshots.
4. If no message arrives, check spam, the account address and mail delivery with an authorized administrator. Do not repeatedly change unrelated database users or restore the whole site merely to recover one login.

Authorized alternatives

A trusted administrator with access to the correct installation can use WordPress’s user-management tools or WP-CLI. Select the intended user and site explicitly, including multisite context where relevant. Avoid putting a new password directly in shell history, process arguments, logs or shared terminal recordings. Inspect any prompt’s behavior before entering a secret.

Direct database recovery is a last-resort procedure with different risks; use the separately scoped database guide and an appropriate backup. Modern WordPress password handling should normally remain under WordPress’s own API.

Do not publish an emergency reset endpoint

The older emergency.php article is consolidated here. Leaving a public reset script or a hardcoded password call in a theme can allow takeover or repeatedly reset an account. Those are not routine recovery instructions. If such a file already exists, have an authorized administrator remove the unintended access path after preserving necessary incident evidence and inspect whether it was used.

If compromise is suspected, review administrators, sessions, application passwords, plugins and mail/recovery accounts as part of incident response. Use strong unique credentials and 2FA where available; a routine monthly password change is not a substitute for that review.

References: WordPress login and recovery guidance; WP-CLI user management.

Reviewed October 15, 2026. Documentation review; no account password, reset email or session was changed.