You type in your username and password — the same ones you've used for months — and instead of the wp-admin dashboard, you get "incorrect password," a blank white page, or worse, the login form just reloads itself over and over. There are really only a handful of reasons this happens, and every one of them has a fix that doesn't need a developer or a full restore.

Symptom: Which Kind of Lockout Are You Seeing?

The fix depends entirely on what's actually happening on screen, so start there:

  • "The password you entered is incorrect" — you've genuinely forgotten it, or it's stored wrong somewhere (password manager pointing to an old domain, for instance).
  • "Error: The email could not be sent" when you click Lost your password? — the reset works fine, but WordPress can't deliver the email. That's a mail delivery problem, not a login problem.
  • The login page keeps reloading after you submit correct credentials, sending you right back to wp-login.php — usually a cookie or site URL mismatch, not a password issue at all.
  • "Your access to this site has been limited" or a plain 403 on wp-login.php — a security plugin or firewall rule decided your IP looks suspicious.
  • You can log in but land on a blank white screen right after — that's a plugin conflict, not an authentication issue, and a different fix entirely.

Fix 1: Reset the Password the Normal Way First

Before touching any files or databases, try the built-in reset: click Lost your password? on the login screen, enter your username or email, and check both inbox and spam folder. If the email never arrives, the problem is almost always wp_mail failing to send, not the reset itself — fixing SMTP delivery solves it faster than any database edit.

Fix 2: Reset the Password Directly in phpMyAdmin

No working email at all? Go around it entirely through the database:

  1. In cPanel, open phpMyAdmin and select your WordPress database.
  2. Open the wp_users table (the prefix may differ, e.g. wp7x2_users — check wp-config.php for $table_prefix).
  3. Find your admin row and click Edit on it.
  4. In the user_pass field, type your new password, then set the Function dropdown next to it to MD5.
  5. Click Go to save.

This works because WordPress core still accepts a plain MD5 hash in user_pass as a one-time bridge — it verifies against the MD5, then silently upgrades the stored hash to its normal format the moment you log in successfully. You do not need to touch any other column.

Fix 3: Reset via WP-CLI (Fastest if You Have SSH)

If your plan includes SSH access, this is the cleanest option:

wp user list --field=user_login
wp user update yourusername --user_pass='a-strong-new-password'

Locked out of every admin account, or not sure any of them still work? Create a fresh one instead:

wp user create rescueadmin rescue@yourdomain.com --role=administrator --user_pass='a-strong-new-password'

Log in with the new account, fix whatever caused the original lockout, then delete the rescue user once you're done.

Fix 4: The Login Page Keeps Redirecting Back to Itself

This one isn't a password problem at all — it's usually a mismatch between the URL WordPress thinks it lives at and the URL you're actually visiting. Check the siteurl and home values:

wp option get siteurl
wp option get home

If either one is missing https://, has a trailing slash mismatch, or points at a staging domain, correct both:

wp option update siteurl 'https://yourdomain.com'
wp option update home 'https://yourdomain.com'

No SSH? Add the same values as constants near the top of wp-config.php, above the "That's all, stop editing!" line:

define('WP_HOME','https://yourdomain.com');
define('WP_SITEURL','https://yourdomain.com');

Note that this is a narrower problem than a site-wide redirect loop across every page — if your entire domain loops (not just wp-login.php), that's more likely an SSL or CDN configuration issue rather than a WordPress option.

Fix 5: A Security Plugin Locked You Out

Plugins like Wordfence, Limit Login Attempts Reloaded, and iThemes Security will happily lock out the site owner along with any attacker after a few failed tries. If you can't reach wp-admin at all, deactivate the plugin from outside WordPress:

  1. Connect via cPanel File Manager or FTP and go to wp-content/plugins/.
  2. Rename the offending plugin's folder — e.g. wordfence to wordfence-off.
  3. WordPress deactivates it automatically since the plugin file can no longer be found, and your lockout clears immediately.

Log back in, rename the folder back, and adjust the plugin's lockout threshold or add your own IP to its allowlist before re-enabling brute-force protection.

Fix 6: An Old .htaccess Rule Is Blocking wp-admin

If someone previously restricted wp-admin or wp-login.php to a specific office or home IP address, and that IP has since changed, you'll get a flat 403 with no WordPress error message at all. Open .htaccess in your site's root (and check for a second one inside /wp-admin/) via File Manager, and look for a block like:

<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from 203.0.113.5
</Files>

Update the IP, or comment the block out with # at the start of each line while you sort out access.

Prevention

  • Keep one backup administrator account with credentials stored somewhere other than your primary email, for exactly this situation.
  • Turn on two-factor authentication on cPanel, and use an authenticator app rather than SMS for WordPress admin logins too.
  • If you add an IP restriction to wp-login.php, write down where and why — in a note, a ticket, anywhere you'll actually look again in six months.
  • Set login-attempt limits high enough that a mistyped password twice in a row doesn't lock out the site owner.
  • Take a quick backup or snapshot before installing any new security plugin, so a bad lockout rule is a one-click rollback instead of a support ticket.

Frequently Asked Questions

I don't have access to the email address on my WordPress account anymore. Now what?

Skip the email-based reset entirely and use the phpMyAdmin or terminal" class="auto-link">WP-CLI method above to set a new password directly. Once you're back in, update the account's email address under Users in wp-admin so future resets go somewhere you control.

Is resetting the password with phpMyAdmin's MD5 function actually safe?

Yes — it's a documented WordPress core behavior, not a hack. WordPress checks for a 32-character MD5 hash as a legacy compatibility path, verifies it once, and immediately rehashes your password into its normal format on that first successful login. You're not left with a weaker password long-term.

What if the login page redirects back to itself even with the correct password?

That's almost always a siteurl/home mismatch or a stale login cookie, not a wrong password. Clear your browser cookies for the domain first, then check the wp_options values as shown in Fix 4.

Can I fix any of this without cPanel access, using only FTP?

Yes for the plugin-lockout and .htaccess fixes — both only need file access, which any FTP client provides. The password reset itself needs either database access (phpMyAdmin, or any MySQL client with your database credentials from wp-config.php) or SSH for WP-CLI.

How do I stop this from happening again?

Most repeat lockouts trace back to overly aggressive login-attempt limits or a forgotten IP restriction. Loosen the threshold slightly, keep a rescue admin account on file, and document any access rule the moment you add it.