Can’t Log In to WordPress Admin? How to Fix It Step by Step

If you cannot log in to WordPress admin, the cause is almost always one of eight things: a wrong password, a cookie problem, a mismatched site address, a plugin conflict, a damaged .htaccess file, a database problem, a broken theme, or a missing wp-login.php file. Match your symptom to the table below, apply the fix that goes with it, and work through the steps in order. Most login problems are fixed by the third or fourth step, and none of the fixes below deletes your content.

What you will be able to do

By the end of this guide, you will be able to:

• Match your exact symptom to its cause in under a minute.
• Get back into wp-admin with the fix that matches your symptom, instead of guessing.
• Reset your password even when the reset email never arrives.
• Switch off a problem plugin or theme without dashboard access.
• Tell when the problem is your hosting account, not your website.

Find your symptom first

Start here. Find the row that describes exactly what you see when you try to log in, then jump to the fix in the third column. Do not skip ahead to a fix for a different symptom: the wrong fix wastes time and can make the problem harder to trace.

Before you change any file or database value, take a full backup of the site — files and database. Every fix below is reversible, but a backup is the only way back if you edit the wrong line. If your host offers one-click backups, use it now; if not, copy the files and export the database first. Our 3-2-1 backup strategy guide explains how to keep three copies in two places, with one off-site.

The fixes, in order

Work through these fixes in order and stop as soon as you can log in. Each one matches a row in the table above, so if you already know your symptom, jump straight to its fix.

1. Open the exact login URL

Go to yoursite.com/wp-login.php directly, instead of /wp-admin/. The /wp-admin/ address redirects to the login page, and a redirect problem can break that step while the direct login page still works. Type the address by hand rather than using an old bookmark: a bookmark can point to an old domain or an http address after the site moved to https. If the login form loads at /wp-login.php, log in there; you can worry about the /wp-admin/ redirect afterwards. If the page returns a 404, skip to Fixes 6 and 9: the login file or the rewrite rules are the problem.

2. Reset the password by email

On the login screen, click “Lost your password?” and enter your username or the email address on the account. WordPress sends a reset link to that address. Check the spam folder if nothing arrives within a few minutes, and check that you entered the email address that is actually on the account: the reset goes to the address in the user profile, not to any address you happen to use. If the email never arrives, the problem is usually email delivery rather than your password, and our guide to WordPress not sending emails walks through the same checks. If you no longer have access to the email address on file, skip to Fix 7 and reset the password directly in the database.

3. Clear cookies and cache, then try a private window

WordPress logs you in by setting a cookie. If that cookie cannot be set — because the browser is blocking cookies, an old cookie is stuck, or a cache is serving a stale login page — the login form reloads with no error, or you see “Cookies are blocked or not supported by your browser”. First, clear cookies and cached files for your site only: in your browser settings, search for your domain and remove its stored data. Then open a private or incognito window and try again. A private window has no old cookies and no extensions. If the private window works, the problem is your normal browser profile: clear its cookies for the site and disable extensions one by one. If the message about cookies persists in every browser, the cause is usually the site address mismatch in Fix 4.

4. Make the WordPress Address and Site Address match

WordPress stores two addresses: the WordPress Address (where the files live) and the Site Address (what visitors see). If one uses www and the other does not, or one uses http and the other https, the login cookie is set for the wrong domain and the login page loops or redirects endlessly. Open your hosting file manager, open wp-config.php, and add the two lines below just above the line that says “That’s all, stop editing!” — replacing yoursite.com with your own domain:

define( 'WP_HOME', 'https://yoursite.com' );
define( 'WP_SITEURL', 'https://yoursite.com' );

Save the file, clear your browser cookies for the site, and try logging in again. Leaving those two lines in place is harmless, but they override the settings screen, so remember they are there. If the addresses already match, move on: this fix only helps when they differ.

5. Deactivate plugins without the dashboard

A single broken plugin can block the whole login page — usually a security plugin that limits logins (see our guide to stopping WordPress brute-force attacks), a caching plugin serving a stale page, or a plugin that changed recently. Without dashboard access, deactivate them from your hosting file manager or FTP. Open the wp-content folder, find the plugins folder, and rename it to plugins-off. That switches off every plugin at once. Try logging in. If it works, rename the folder back to plugins, then open it and rename the plugin folders inside one by one, testing the login after each: the one that breaks it again is the problem. Leave that one off and look for an update or a replacement. If you would rather find the conflict methodically, our guide to troubleshooting plugin conflicts covers the same process in more detail. Before you update any plugin after this, run through the safe WordPress update checklist so the same problem does not come back with the next update.

6. Fix a corrupted .htaccess file

WordPress uses the .htaccess file in your site’s main folder for its rewrite rules — the rules that turn /wp-admin/ into the login page. A damaged or wrong .htaccess file can produce a 404 on the login page or a redirect loop. In your hosting file manager, download a copy of .htaccess first so you can restore it. Then replace its contents with the default WordPress rules below and save:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If you have extra rules in the file — for redirects, caching, or security — add them back one group at a time and test the login after each group. If the file’s permissions are wrong, the server may not be able to read it at all; our WordPress file permissions security guide explains the correct values for files and folders. If your site runs on a server without .htaccess, ask your host where the rewrite rules live instead.

7. Reset the password in phpMyAdmin

If the reset email never arrives and you cannot reach the email address on the account, reset the password directly in the database. This is the reliable fallback, but it changes the database, so make the backup from the warning above first. In your hosting control panel, open phpMyAdmin, select your site’s database, and open the wp_users table (the table prefix may differ — it might be wpxp_users or similar). Find your username, click Edit, and find the user_pass field. In the function column next to it, choose MD5, type your new password in the value box, and save. WordPress recognises the MD5 hash and re-hashes the password securely the next time you log in. Now log in with the new password. If the wp_users table shows users you do not recognise, stop: that points to a compromised site, and you should work through the WordPress hacked recovery guide before doing anything else. If the database itself will not open, or the site reports a database connection error instead of the login page, the problem is the connection rather than the password: follow the database connection error guide and check the four details in wp-config.php.

8. Switch to a default theme

If the login page loads but the dashboard shows a white screen after you log in, the active theme may be failing. Switch to a default theme without the dashboard: in your hosting file manager, open wp-content/themes and rename your active theme’s folder (for example, add -off to its name). WordPress cannot load a theme whose folder is missing, so it falls back to a default theme such as Twenty Twenty-Five if one is installed. Try logging in again. If the dashboard loads, the problem is your theme: update it, or switch to a different theme from the dashboard and leave the broken one off. If the screen is still white after the theme switch, the cause is a plugin rather than the theme — go back to Fix 5. Our white screen of death diagnosis covers this same split in more depth.

9. Restore a missing wp-login.php

If /wp-login.php returns a 404 while the rest of the site loads, the login file itself is missing or damaged. Download a fresh copy of WordPress from wordpress.org, unzip it on your computer, and upload only the wp-login.php file to your site’s main folder, replacing the broken one. Upload nothing else: replacing other core files is unnecessary and can wipe custom changes. If the file keeps disappearing, check the WordPress file permissions security guide and ask your host whether a security tool is removing it. A file that vanishes on its own is also a sign of a compromised site; in that case, work through the hacked recovery guide instead of restoring the file again.

10. Use WordPress Recovery Mode

When a plugin or theme triggers a fatal error, WordPress may email the site admin a link to Recovery Mode. That email goes to the address in Settings → General, so check that inbox (and its spam folder) for a message with the subject “Your Site is Experiencing a Technical Issue”. The link in the email opens the dashboard in Recovery Mode, where the broken plugin or theme is paused and you can deactivate it normally. If you cannot find the email, you can still trigger Recovery Mode by visiting /wp-login.php: WordPress shows a Recovery Mode link on the login screen when it has detected a fatal error. If no Recovery Mode link appears and no email arrived, use Fix 5 instead: renaming the plugins folder achieves the same result by hand.

Post-fix checklist

Once you are back in, do these checks before you call the job done. Each one stops the same problem from coming back:

• Change the password to a strong one and store it in a password manager.
• Confirm the email address on your user profile is one you can still open.
• Check Settings → General and make sure both addresses use https and match.
• Update the plugin or theme that caused the problem, or replace it.
• Look at the users list and remove any admin account you do not recognise.
• Take a fresh backup now that the site works again.

If the site shows “Briefly unavailable for scheduled maintenance” instead of the login page, the site is stuck in maintenance mode rather than locked out: follow our guide to what to do when WordPress gets stuck in maintenance mode.

Frequently asked questions

Why does the login page keep reloading?

The login form reloads without an error when the login cookie cannot be set. The usual causes are blocked or stale cookies, a caching plugin serving the old page, or a mismatch between the WordPress Address and the Site Address. Clear the site’s cookies, try a private window, and check the two addresses: Fixes 3 and 4 cover all three.

What if no reset email arrives?

First check the spam folder and confirm the email address on the account is one you can open. If the address is right and nothing arrives, your site is probably not sending email at all: work through our guide to diagnosing WordPress emails that never arrive. If the email address on the account is one you can no longer open, use Fix 7 and reset the password in phpMyAdmin instead.

What if the email on file is unreachable?

Use the database reset in Fix 7. You need hosting access to open phpMyAdmin. If you do not have hosting access, ask whoever manages the hosting to reset the password for you, or to update the email address on your user account so the reset link reaches you.

Back in your dashboard? If the dashboard itself loads as a blank white screen, the login problem is fixed but a fatal error is waiting inside. Work through the white screen of death diagnosis next to find the plugin or theme behind it.