I’m locked out or lost access

What you are seeing

"Locked out" covers five different doors: WordPress, the hosting account, the domain registrar, email, and a person who holds the keys. Work out which door is shut before you start resetting passwords, because a reset email that goes to a mailbox you cannot open only locks you out further.

What you see	What it usually means
Error: The password you entered for the username ADMIN is incorrect.	The username exists and the password is wrong, or someone changed it.
Error: The username ADMIN is not registered on this site.	The account was deleted or renamed, you are on the wrong site (staging or an old copy), or the database prefix changed.
The reset email never arrives	The account email is an old or someone else’s address, or the site cannot send mail.
A message about too many failed login attempts, or a blocked IP	A security plugin or the server firewall locked out your IP address.
Asked for a two-factor code you can no longer get	Lost phone or authenticator app, and no backup codes.
Sorry, you are not allowed to access this page. after logging in	Your role was changed, or user roles do not match the table prefix after a migration.
Admin users you did not create, or your email changed on your account	A compromise. Treat it as a hack, not a lockout.
Hosting, registrar or DNS login tied to a former developer’s email or card	You do not control the account, even if you pay for the site. See former designer has my domain or logins.
The site and email went down, and the domain now shows nameservers you do not recognize	Possible domain hijack. See domain hijacked.
Mail app keeps asking for the password, and webmail rejects it too	The mailbox password was changed, or the account was locked after a compromise.

Confirm it in two minutes

1. Find out who controls the domain.

whois example.com | grep -iE 'registrar:|expir|status|name server'

Run it in your own computer’s terminal (macOS and Linux have whois; on Windows use the domain lookup tool). Replace example.com with your domain. It prints the registrar, the expiry date, the status codes and the nameservers. Good: a registrar you have a login for, a future expiry date, and nameservers you recognize. Bad: a registrar nobody in the business has an account with, an expiry date in the past, or nameservers that changed without anyone asking.

2. See where DNS is actually hosted.

dig +short NS example.com

Run it on your own computer (Windows: nslookup -type=NS example.com). The names it prints show which company runs your DNS, for example a host, Cloudflare or the registrar. You need a login there to change any record, including the ones for email.

3. List the real administrators.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Run it in an SSH terminal inside the site’s folder (the one that contains wp-config.php). --role=administrator shows only admins; --fields picks the columns. Good: names and email addresses you recognize. Bad: an admin you never created, a recent user_registered date nobody can explain, or your own account showing an email address that is not yours. Bad means stop and follow the hacked site steps first.

4. Set a new password without email.

wp user reset-password YOUR_USERNAME --skip-email --show-password

Run it in the same SSH terminal. YOUR_USERNAME is the user_login from check 3. --skip-email stops WordPress emailing the reset, and --show-password prints the new random password on screen, so this works even when mail is broken. Copy it into your password manager, then log in. If there is no SSH, your hosting panel's WordPress manager or phpMyAdmin can do the same; the locked out field guide shows how.

5. Look for a security plugin that is blocking you.

wp plugin list --status=active --fields=name,version | grep -iE 'wordfence|limit|login|security|solid|two-factor|2fa'

Run it in the same terminal. grep -iE filters the list for names that usually belong to login protection or two-factor plugins. If one shows up and you are locked out by it, wp plugin deactivate PLUGIN_NAME (PLUGIN_NAME is the name in the first column) switches it off so you can log in. Turn it back on straight afterward and set up new 2FA backup codes.

Most likely causes, in order

1. A forgotten password and a reset email going nowhere. Tell: the reset form says an email was sent, but it never arrives, and the account email in check 3 is an old address or the site has mail problems. Fix: reset over SSH or the hosting panel (check 4), then update the account email and fix site mail.
2. A login protection lockout. Tell: a "too many attempts" message, or the login page will not load from your office but works on mobile data. Fix: wait out the lockout, deactivate the plugin (check 5), or ask your host to unblock your IP in the server firewall.
3. Lost two-factor device. Tell: correct password, then a code prompt you cannot answer. Fix: use backup codes if you saved them; otherwise deactivate the two-factor plugin over SSH or SFTP, log in, and set it up again.
4. Accounts registered by someone else. Tell: the registrar, host or DNS account is in a former developer’s or agency’s name. Fix: ask in writing for access or a transfer, using the access request email. If they will not help, the former designer guide covers proving ownership.
5. A compromised account. Tell: check 3 shows an unknown admin, or your email address was changed. Fix: follow the compromised account guide before anything else, because a reset alone leaves the attacker’s way in open.
6. Roles broken after a migration. Tell: you can log in but see "not allowed" everywhere. Fix: make the PREFIX_user_roles option and PREFIX_capabilities user meta match $table_prefix in wp-config.php.
7. A hijacked domain. Tell: check 1 or 2 shows nameservers or a registrar you never chose, and the registrar account email was changed. Fix: secure the email account behind the registrar login first, then contact the registrar’s abuse or security team.

What it usually is not

• A WordPress bug. Login failures are almost always the password, a plugin, cookies or the site address, not core.
• Fixed by creating another admin and moving on. If an account was taken over, the old access is still there. Find out how first.
• Something the host can override at the registrar. Your host cannot unlock or transfer a domain held at a different registrar under someone else’s account.
• Proof of ownership because you paid the invoices. Registrars deal with the account holder and the listed registrant. Paying a designer is not the same thing.

What to send your host or the relevant provider

• To your host: your public IP address, the time you were blocked in UTC, and a request to check the server firewall and login protection logs for it.
• To your host, if you have no SSH: a request to reset the WordPress admin password or create a temporary admin, and confirmation that you are the account holder.
• To the registrar: the domain, the output of check 1, proof of who you are and that you are the registrant, and when things changed.
• To your email provider: the mailbox address, when it stopped working, and a request to check recent sign-ins and forwarding rules.
• Never send passwords in a ticket. Ask the provider to reset access through their own verified process.

Which guides to read

• Locked out of WordPress admin: passwords, roles, 2FA and security plugins.
• WordPress login loop: the right password, then straight back to the login page.
• Admin or client account compromised: when the lockout is an attacker.
• Former web designer has my domain or logins: getting accounts back from a person.
• Domain hijacked or nameservers changed: recovery through the registrar.
• Taking over an inherited WordPress site, with the printable site takeover access inventory.
• Email account hacked and sending spam and mail app keeps asking for the password.
• Site down only for me: when your own IP is blocked.
• Reference: the domain lifecycle and transfer cheat sheet.