Forgot the WordPress admin password, the reset email never arrives, or you inherited a site without credentials? On a VPS you have several ways back in. Here they are, from easiest to most hands-on.

On wp-login.php, click Lost your password?, and enter the username or email. WordPress emails a reset link.

It only works if the server can send email. Many VPS setups can’t until SMTP is configured, so if nothing arrives (check spam too), use one of the methods below and fix mail later. See WordPress email and SMTP.

2. WP-CLI (fastest on a VPS)

cd /var/www/example.com
wp user list --role=administrator --fields=ID,user_login,user_email
wp user update admin --user_pass='a-new-long-random-password'

Use the username or ID from the list. To avoid the password ending up in your shell history, prefix the command with a space (if HISTCONTROL includes ignorespace), or let WP-CLI generate one:

wp user reset-password admin --show-password

(reset-password emails the user by default. Add --skip-email to only show the password.) See WP-CLI guide.

3. Create a new administrator

If you don’t know which account to fix, or the admin account was deleted:

wp user create newadmin [email protected] --role=administrator --user_pass='a-new-long-random-password'

Log in, then clean up the old accounts.

4. MySQL directly

Without WP-CLI, update the password hash in the database. WordPress accepts an MD5 hash once, and upgrades it to a secure hash on the next login:

sudo mysql
USE wordpress;                        -- your database name from wp-config.php
SELECT ID, user_login FROM wp_users;  -- table prefix may differ
UPDATE wp_users SET user_pass = MD5('a-new-long-random-password') WHERE user_login = 'admin';

Log in right away, so the hash gets upgraded. Find the database name, user and table prefix in wp-config.php (DB_NAME, $table_prefix). See MySQL show databases, tables and users.

5. phpMyAdmin or Adminer

Same as above through a web UI: open wp_users, edit the user, put the new password in user_pass, choose MD5 in the function column, and save. Remove or protect phpMyAdmin afterwards. See phpMyAdmin with Nginx.

6. functions.php emergency snippet (last resort)

Only if you have file access but no shell or database access:

// add temporarily to the active theme's functions.php
wp_set_password( 'a-new-long-random-password', 1 );   // 1 = user ID

Load any page once, then remove the line immediately. Otherwise the password resets on every request.

Still can’t log in?

If the password is definitely correct, but you land back on the login page, the problem is cookies, URLs or caching, not the password. See WordPress login redirect loop.

Other blockers:

  • Security plugin lockout after too many attempts: wait, or deactivate the plugin (wp plugin deactivate wordfence, or rename its folder). See limit login attempts.
  • 2FA device lost: disable the 2FA plugin, or reset that user’s 2FA via WP-CLI or the plugin’s recovery codes. See WordPress two-factor authentication.

After you’re back in

  1. Use a strong, unique password stored in a password manager. See Vaultwarden.
  2. Check the user list for administrators you don’t recognise. Unknown admins are a sign of compromise. See WordPress malware removal.
  3. Make sure the admin email (Settings → General) is one you can access.
  4. Configure SMTP, so password resets and recovery emails work next time.
  5. Enable two-factor authentication for admins.

Quick reference

Method Command
WP-CLI wp user update <user> --user_pass='…'
New admin wp user create name email --role=administrator
SQL UPDATE wp_users SET user_pass = MD5('…') WHERE user_login='…';
List admins wp user list --role=administrator

Related: WordPress hardening and WordPress user roles.

  • WordPress
  • WP-CLI
  • Security