Can’t Login to WordPress? Recover Admin Access Without a Plugin

If you can’t login to WordPress and don’t have a recovery plugin installed, you can still get back into your dashboard by resetting your password directly through your hosting control panel. The three main ways to do this without a plugin are editing the database with phpMyAdmin, adding a temporary line of code to your theme’s files, or running a command with WP-CLI if you have SSH access. All three work from outside the WordPress dashboard, which is exactly what you need when the login screen itself is the problem.

This guide walks through each method step by step, including a recent change in WordPress that affects how password resets behave.

Why you can’t login to WordPress in the first place

Before resetting anything, it helps to know what you’re dealing with. Common causes include:

• A forgotten password, with the “lost your password” email never arriving or going to an inbox you can no longer access
• No recovery plugin installed, so there’s no backup login path from inside WordPress
• A security lockout after too many failed login attempts
• An account that was accidentally deleted or had its role changed

In most of these cases, you still have access to your hosting account (control panel, FTP, or SSH) even though you can’t reach the WordPress dashboard. That access is what makes the methods below possible. If you haven’t tried the standard “lost password” link yet, it’s worth doing first — see WordPress Admin Dashboard Lockout? Here’s the Solution for that route. The methods in this article are for when that option isn’t available to you.

An important change: WordPress now uses bcrypt for passwords

WordPress 6.8 switched the way it hashes and stores passwords, moving from the older “phpass” system to bcrypt, a more modern and widely used hashing method. A hash is a scrambled, one-way version of your password that WordPress stores instead of the plain text, so that even someone with database access can’t simply read your password.

This change didn’t break anything for existing users. Passwords and login sessions saved before the update keep working after updating to 6.8, and nobody was logged out as a result. But it does affect one classic recovery trick, which is covered in the phpMyAdmin section below.

Method 1: Reset your password with phpMyAdmin

This is the most common way to reset a WordPress password without a plugin. phpMyAdmin is a database management tool included with almost every hosting control panel, such as cPanel or Plesk. It lets you view and edit the database that stores your WordPress content, settings, and user accounts.

Step-by-step

1. Log in to your hosting control panel and open phpMyAdmin.
2. In the left sidebar, select your WordPress database.
3. Open the wp_users table. Check the prefix first — the default is wp_, but many installs use a different one for security reasons. You’ll find the correct prefix in your site’s wp-config.php file, on the line starting with $table_prefix. The table you want is that prefix followed by “users” — don’t mix it up with “usermeta”, which sits right next to it in the table list.
4. Find your admin username in the list of rows and click the pencil icon to edit it.
5. Find the user_pass field. Clear the existing value and type your new password in plain text.
6. In the Function column next to that field, open the dropdown and select MD5. This tells phpMyAdmin to scramble (hash) the plain text you just typed before saving it, so WordPress can read it correctly.
7. Click Go to save the row.
8. Try logging in to WordPress with the new password.

If the MD5 method doesn’t work

Because of the bcrypt change mentioned above, newer WordPress installs sometimes reject a raw MD5-hashed password. WordPress has traditionally accepted an MD5 hash on login as a legacy fallback, then quietly upgraded it to a stronger hash afterwards — but this fallback isn’t guaranteed on every site running WordPress 6.x. If you select MD5, save the row, and still can’t log in, don’t keep retrying the same step. Move on to the WP-CLI method below, since it always produces a hash WordPress accepts.

If you’re comfortable running SQL directly, you can achieve the same result from the SQL tab in phpMyAdmin:

UPDATE wp_users SET user_pass = MD5('newpassword') WHERE user_login = 'your_admin_username';

Replace newpassword with your chosen password, your_admin_username with the actual username, and wp_users with your correct table prefix if it isn’t the default.

Common mistakes with this method

• Editing the wrong table because of a custom prefix
• Forgetting to select MD5 in the Function dropdown, which saves the password as unreadable plain text instead of a hash
• Editing the wrong row when there are several user accounts with similar names

Once you’re logged in, go to your profile in the WordPress dashboard and set the password again from there. This confirms the account is using the current, stronger hashing method rather than the temporary MD5 one.

Method 2: Reset your password by editing a theme file

If you don’t have phpMyAdmin access but can connect to the server with FTP, SFTP, or your host’s File Manager, you can reset the password by temporarily adding a line of code to your active theme.

Step-by-step

1. Connect to the server using FTP, SFTP, or File Manager, and open the WordPress installation folder.
2. Go into wp-content, then open the folder for the theme currently active on the site.
3. Before changing anything, download a copy of functions.php to your computer as a backup, in case you need to undo the edit.
4. Open functions.php in a plain text editor and add the following line immediately after the opening <?php tag:

   wp_set_password( 'newpassword', 3 );

   Replace newpassword with the password you want to set, and 3 with the correct user ID.

5. If this account was the original administrator created when WordPress was installed, its user ID is usually 1.
6. Save the file and upload it back to the theme folder, overwriting the original.
7. Log in to WordPress with the new password to confirm it worked.

Why you must remove the line afterwards

This step is not optional. The wp_set_password() function runs every time the file loads, which means every single page view on your site would reset that user’s password again. Left in place, this would either lock you out again on the next visit or let anyone who finds out about it reset the password themselves.

As soon as you’ve confirmed the new password works, go back into the theme folder, delete that line from functions.php, and upload the cleaned file again. Treat this method as a quick, one-time fix rather than a permanent change.

Method 3: Reset your password with WP-CLI

If you have SSH access to your server, WP-CLI is the cleanest option. WP-CLI is a command-line tool for managing WordPress, and many managed hosts already have it installed. It uses WordPress’s own internal functions to set the password, so it always generates a correctly formatted hash — there’s no risk of picking the wrong function in a dropdown or leaving a stray line of code in a theme file.

Step-by-step

1. Connect to your server using SSH.
2. Navigate to your WordPress installation folder (the one containing wp-config.php).
3. Run the following command, replacing the username and password with your own:

   wp user update your_admin_username --user_pass=newpassword

4. Once the command completes, log in to WordPress with the new password.

This method avoids the bcrypt/MD5 compatibility issue entirely, because WP-CLI calls WordPress’s own password-setting function rather than writing a hash into the database by hand.

Comparing the three methods

Once you’re back in

After regaining access, take a few minutes to reduce the chance of this happening again:

• Set a proper, unique password from your WordPress profile page rather than leaving the temporary one in place.
• Make sure the email address linked to your admin account is one you can actually access, so the normal “lost your password” link works next time.
• Consider adding a login protection measure such as CAPTCHA or limiting failed login attempts — see How to Add CAPTCHA in WordPress Login and Registration Form.
• Review your site’s broader security settings; How to secure a WordPress website from hackers covers practical steps beyond login protection.

FAQ

Why can’t I just use the “Lost your password” link?

That link sends a reset email to the address on file for your account. If that email no longer exists, is misspelled, or your site can’t send emails at all, the link won’t help. In that case, you’ll need one of the database or file-based methods described above instead.

Is it safe to edit the WordPress database directly?

Yes, as long as you only edit the specific field described and avoid touching other tables or rows. It’s still good practice to make sure your site has a recent backup before making any manual database change, in case something is edited by mistake.

What if I don’t know my table prefix?

Open wp-config.php in your site’s root folder and look for the line starting with $table_prefix. Whatever value follows is your prefix — use that instead of the default wp_ when looking for the users table.

Do I need to remove the password-reset line from functions.php straight away?

Yes. The line runs on every page load, so leaving it in place means the password keeps getting reset to the same value every time the file is loaded, and anyone who views the file could potentially see or exploit it. Delete the line and re-upload the file as soon as you’ve confirmed you can log in.

Keep Reading

BloggingJoomla vs WordPress for a Small Business Blog: Which Fits You?WordPressWhy Are My WordPress Images Not Loading? 7 Common FixesWordPressTop 10 WordPress Plugins Worth Installing on a New Site