Forgot WordPress Admin Password? 4 Recovery Methods

Before You Start — What You Need to Know

Forgetting your WordPress admin password is more common than you'd think — whether you've taken over a site from someone else, your password expired, or you simply didn't write it down. The good news is WordPress has multiple recovery mechanisms, and you absolutely don't need to reinstall.

Choose the right method based on what you have access to:

What You Have	Recommended Method	Difficulty
Access to admin email	Method 1: Lost Password Email	Very Easy
phpMyAdmin access (DirectAdmin)	Method 2: phpMyAdmin	Medium
SSH / WP-CLI available	Method 3: WP-CLI Command	Medium
Only File Manager / FTP	Method 4: Emergency Script	Hard / Risky

Method 1: Reset via Email (Easiest)

This is the official WordPress recovery method and requires no direct database or server access. It's the best starting point for most users.

WordPress reset links expire after 24 hours. A successful login also invalidates all pending reset links automatically.

Method 2: Reset via phpMyAdmin

Use this method when email delivery fails or you want direct database access. On AsiaGB Hosting, phpMyAdmin is available directly from the DirectAdmin control panel.

Accessing phpMyAdmin via DirectAdmin

1. Log in to DirectAdmin at https://yoursite.com:2222
2. Navigate to Extra Features → phpMyAdmin
3. Select the WordPress database (check wp-config.php for DB_NAME if unsure)
4. Click the wp_users table (prefix may differ, e.g. wp34_users)

Changing the Password in phpMyAdmin

1. Find the row where user_login is your admin username → click Edit
2. Locate the user_pass column
3. Change the Function dropdown from "No function" to MD5
4. Type your new password in the Value field (plain text — MD5 will hash it)
5. Click Go to save

Method 3: WP-CLI (SSH Users)

WP-CLI is the official WordPress command-line tool. It's the fastest and most reliable method, requiring no email or database GUI. Available on hosting plans with SSH access.

Check if WP-CLI is installed

wp --version

Reset the admin password

# Reset password for user ID 1 (usually the first admin)
wp user update 1 --user_pass="NewSecurePass@2026!" --allow-root

# List all users if you don't know the ID
wp user list --allow-root

# Or update by username
wp user update admin --user_pass="NewSecurePass@2026!" --allow-root

Method 4: Emergency PHP Script

Use this only as a last resort when all other methods are unavailable. This creates a temporary PHP file that resets the password via browser — you must delete it immediately after use.

Steps

1. Create a file named reset-password.php in the WordPress root directory
2. Paste the following code:

<?php
define('ABSPATH', dirname(__FILE__) . '/');
require_once(ABSPATH . 'wp-load.php');

$user = get_user_by('login', 'admin'); // Replace 'admin' with actual username
if($user) {
    wp_set_password('NewPassword@2026!', $user->ID);
    echo 'Password reset successful! Delete this file now!';
} else {
    echo 'User not found.';
}
?>

3. Visit https://yoursite.com/reset-password.php in your browser
4. When you see "Password reset successful!" — delete the file immediately
5. Log in with the new password

Email Not Working — Fix WordPress SMTP

When WordPress can't send password reset emails, it's usually because the hosting blocks PHP's built-in mail() function, or the email lands in spam.

Recommended Fix: Install an SMTP Plugin

1. Use Method 2 or 3 to gain admin access first
2. Install the WP Mail SMTP plugin (free)
3. Configure SMTP with Gmail, SendGrid, or your hosting email account
4. Send a test email — if it works, Lost Password will function normally

Common Causes of Email Delivery Failure

• PHP mail() blocked by shared hosting environment
• Missing or incorrect SPF/DKIM DNS records → email flagged as spam
• Admin email address is wrong or mailbox is full
• Recipient's spam filter blocking email from your domain

Comparison Table: All 4 Methods

Method	Speed	Security	Requires	Best For
1. Lost Password Email	Fast (5 min)	High	Email access	General users
2. phpMyAdmin	Medium (15 min)	Medium	Database access	When email fails
3. WP-CLI	Very fast (1 min)	High	SSH access	Developers / Sysadmins
4. Emergency Script	Medium (10 min)	Low (temporary)	File Manager / FTP	Last resort only

After Reset — Security Checklist

Resetting the password is just the first step. Take these actions to secure your site:

1. Invalidate All Old Sessions

Add the following to wp-config.php to force-logout all active sessions:

define('AUTH_KEY',         'new-random-string-here');
define('SECURE_AUTH_KEY',  'new-random-string-here');
define('LOGGED_IN_KEY',    'new-random-string-here');
define('NONCE_KEY',        'new-random-string-here');

Use the WordPress Salt Generator to create new random strings.

2. Audit Admin User Accounts

Go to Users → All Users and look for any unfamiliar admin accounts. Delete any that don't belong.

3. Update Everything

Update WordPress core, all plugins, and themes to their latest versions. Security vulnerabilities in outdated components are a leading cause of compromised credentials.

4. Enable Two-Factor Authentication

Install WP 2FA or Google Authenticator by miniOrange to add a second layer of protection beyond passwords.

Strong Password Tips — NIST 2026 Guidelines

NIST updated its password guidelines in 2024 with significant changes from older advice:

Old Advice (Outdated)	NIST 2024 Current Best Practice
Mandatory rotation every 90 days	Change only when compromised (breach detected)
Must include at least one symbol	Length (≥15 chars) matters more than complexity rules
Avoid dictionary words	Avoid known compromised passwords (check HaveIBeenPwned)
Store in a spreadsheet	Use a password manager (Bitwarden is free)

Strong Password Examples

• CorrectHorseBatteryStaple2026! — Long, memorable, strong (passphrase style)
• Th@iH0st#Wp2026$xZ — Shorter with mixed character types
• Password manager generated: kR#9mN!pQ2@vXz5Yw

Frequently Asked Questions

What should I do if WordPress password reset email isn't arriving?

Check your Spam/Junk folder first. If the email isn't there, your hosting may block PHP mail(). Use phpMyAdmin to directly edit the user_pass field in wp_users, or use WP-CLI: wp user update 1 --user_pass=NewPassword

How do I reset WordPress password using phpMyAdmin?

Log in to phpMyAdmin via DirectAdmin, select your WordPress database, open wp_users, click Edit on the admin row, change the Function to MD5, type your new password in the Value field, and click Go. WordPress upgrades the hash to phpass on next login.

Can I reset WordPress admin password without email access?

Yes — use phpMyAdmin to edit the database directly, WP-CLI via SSH with wp user update 1 --user_pass=NewPassword, or create a temporary emergency PHP script. All three bypass email completely.

What makes a strong WordPress admin password?

Use a passphrase or random string at least 16 characters long with mixed case, numbers, and symbols. NIST 2024 says length matters more than complexity rules. Use a password manager like Bitwarden (free) and enable 2FA as an extra layer.

What should I do after resetting my WordPress password?

Regenerate WordPress security keys in wp-config.php to invalidate old sessions, check Users list for suspicious admin accounts, update WordPress core and plugins, and enable 2FA with WP 2FA plugin.

Summary

Forgetting your WordPress admin password is not a disaster. There are 4 reliable recovery methods, in order of convenience:

1. Lost Password Email — Easiest; works when email is accessible
2. phpMyAdmin — Direct database access; works when email fails
3. WP-CLI — Fastest; best for developers with SSH access
4. Emergency PHP Script — Last resort; delete immediately after use

After recovery, set a strong password, enable 2FA, and audit your admin accounts to prevent future lockouts.