Losing access to /wp-admin/ has several very different causes — a forgotten password, a security-plugin lockout, a broken login flow, or a compromise. The right recovery depends entirely on which one it is, so confirm ownership and classify the lockout before forcing your way in.
What an administrator access recovery intervention covers
The first job is to establish why the authorised team cannot get in. A password issue, a redirect loop and a broken administrative screen need different work. We confirm the ownership route, assess the symptom and agree the scope and quote before making changes.
- Diagnosis: identify the affected account or route, relevant recent changes and the evidence supporting the repair.
- Recovery: restore the agreed legitimate access or repair the failing login or administration behaviour, according to the cause found.
- Verification: check normal sign-in, the affected management task and sign-out, with the account permissions and security controls agreed for the site.
- Handover: record what changed, what was checked, any unresolved limitations and the removal of temporary diagnostic access.
If the evidence indicates compromise, regaining access is only part of the job. We explain whether a separate hacked WordPress repair scope is needed; an account that opens again does not establish that the whole site is clean.
For the initial assessment, send the public URL, exact visible message, approximate start time, recent changes and which owner-controlled access routes remain available. Do not include passwords, reset links or recovery codes. Request an administrator access recovery assessment.
Want to identify the symptom first? Read the guides to an administrator login that keeps returning to the login page and a blank administrator screen while the public site works.
Step 1 — Classify the lockout
- Credential: the password is wrong or the reset email never arrives.
- Blocked: a security plugin or firewall is refusing your IP after failed attempts.
- Broken: the login page errors, loops, or reports a cookie problem.
- Compromise: your account is gone, its role changed, or unknown administrators appear.
Step 2 — Recover a legitimate password
Try the standard password reset first. If its email does not arrive, check the account address, delivery and filtering before deciding the cause. The official WordPress password recovery guidance describes the available methods. Where standard recovery is unavailable, an authorised administrator can assess the supported host or WP-CLI route after ownership is verified. A password change does not resolve every lockout or replace two-factor or single-sign-on recovery.
Is your website affected right now?
Send the URL and the symptom you can see. Jordi Ensenyat reviews the case personally and defines the scope and quote before anything is changed. This form never asks for passwords.
Step 3 — If a security plugin locked you out
First establish whether the block comes from a WordPress security plugin, the hosting provider or an upstream firewall. Use the relevant provider’s supported recovery or unblock process after ownership is verified. If a component must be isolated for diagnosis, agree the effect on protection, preserve its settings and restore the agreed controls before closing the work. Renaming a plugin folder does not necessarily resolve a host or firewall block.
Step 4 — If the login page itself errors
A critical error or redirect loop can involve application code, URLs, HTTPS, cache or session behaviour rather than a forgotten password. Review the failing request and matching error evidence before changing the account. For some fatal errors, WordPress Recovery Mode can help an authorised user diagnose the failing component; it is not a replacement for account credentials. Repair the identified fault and re-test the normal route.
When it is a compromise, stop and preserve
An unexpected administrator, changed administration email or reset destination can indicate compromise. Record the evidence and preserve the relevant state before removing suspicious items. Treat access recovery as part of a wider investigation when warranted: restoring one account does not establish that unauthorised access or persistence has been removed.
Do not leave the door open
Whatever route you use, do not leave a permanent shared-password admin behind or a security plugin disabled. Rotate credentials, remove temporary access, and confirm two-factor and protection are back on. If you would rather not touch the database or SFTP, the recovery can be handled after ownership is verified through a secure channel.
EVIDENCE-LED WORDPRESS RECOVERY
Recover administrator access without weakening the site
In urgent website repair and WordPress recovery, the visible symptom may be far from the cause. The objective is to restore the affected journey without gambling with the rest of the site. A login failure may be a simple account issue, a security-plugin lockout, a broken authentication flow or evidence of compromise. Recovery begins by confirming legitimate control and preserving the audit trail before changing credentials or disabling protection.
What we verify
- The complete journey, not only the screen where the error appears
- External dependencies, logs and evidence before configuration changes
- Ownership and an authorised recovery route
- User roles, unexpected administrators and recent account changes
- Security plugins, cookies, redirects and authentication errors
- A successful login followed by stronger, rotated access controls
What a verified outcome means
Close-out documents the cause found, the change applied and the tests performed. The result must be observable and repeatable—not a feeling that it “seems to work”.
BEFORE THE ASSESSMENT
Common questions about this WordPress incident
How do you verify that the problem is genuinely resolved?+
The affected journey is reproduced, its dependencies are checked and post-change evidence is recorded.
Can you recover access without the current WordPress password?+
Often yes, using an authorised hosting, database, email or command-line route after ownership is verified.
Will you disable the security plugin permanently?+
No. A temporary controlled change may be diagnostic, but protection should be restored or replaced once the cause is known.
What if an unknown administrator is present?+
That is treated as a possible compromise, not just a login issue. Access recovery should then be combined with incident investigation.