Locked out of WordPress
It's your site. The door doesn't know that.
Every WordPress lockout is one of a handful of doors: the password's lost and the reset email never comes, a security plugin banned your IP, someone moved the login page, or the admin account's email points somewhere you can't read. Each door has a key. Some keys just live deeper than the login form.
Diagnosis within one business day (Mon–Fri). Flat quote before any fix.
What’s actually happening
The login form is only the front door — WordPress ownership is really proven at three layers. The form itself (password + username), the email layer (reset links, which depend on your site's ability to send mail and your account's address being one you still read), and the database layer, where accounts actually live and where someone with hosting access can always restore an administrator. Lockouts feel absolute because people only know about layer one.
That layered design is why 'locked out' is recoverable in essentially every case where you control the hosting: the database outranks the login form. It's also the diagnostic frame — the failed reset email is an email-deliverability problem wearing a login costume; the vanished login page is a security plugin's custom URL; the 'too many attempts' ban is a firewall doing its job on the wrong person.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
Reset emails that never arrive
The site can't send mail (the classic WordPress deliverability hole) or the account email is a defunct address. The most common lockout isn't about passwords at all.
Security plugin lockouts and bans
Failed-attempt limits, IP bans, and two-factor tangles — protection aimed at attackers, hitting the owner.
A moved login page
Custom login URLs set by security plugins ('WPS Hide Login' class) — /wp-admin 404s and the real door's address left with a previous developer.
Admin email or account changed
Handover gaps: the only administrator is an ex-employee, an old agency, or an address nobody can open. Ownership drift, discovered at the worst time.
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Name your door before forcing any
Wrong password? No reset email? Login page missing? Banned message? Each is a different failure with a different key — thirty seconds of naming saves an hour of flailing.
- 2
Check spam, then wait, then try the reset once more
Reset emails land in spam constantly. Twice-failed resets mean the email layer is broken — stop retrying and move layers.
- 3
Confirm your hosting access
Can you log into the host panel? Then you're not really locked out — the database route exists. That's leverage, whether you use it yourself or hand it to us.
Stop and call when…
- The database route is the answer but phpMyAdmin is a foreign country — wrong place to improvise
- No hosting access either — ownership recovery through the host comes first, and it's a process
- Unfamiliar admins or changed emails greet you on re-entry — that's a compromise, keep the evidence
From there it’s our job: a look within one business day, flat quote, and the $249 flat repair covers most cases of exactly this.
Site Down or White Screen — buy it now, skip the hunt.
500 and 502 errors, a white screen, a database connection error, a site that broke after a PHP update.
Back online first, then the cause. A full backup once it is up, and a note on what failed and how to keep it from happening again. We start within one business day (Monday–Friday) of payment. Full refund if we can't fix it.
Questions we hear a lot.
Reset emails never arrive — is my account gone?
No — your account is fine; your site's outbound email is broken. WordPress sends resets through the same fragile channel as every site email, and that channel fails silently all the time. The account restores through the database in minutes; the mail channel is its own repair worth doing while we're in there, since your customer emails are using it too.
Can you get me in without my password?
With your hosting access, yes — that's the point of the database layer. We verify you control the hosting (that's the real proof of ownership), restore or create your administrator account server-side, confirm nothing else was touched, and hand you fresh credentials. The $249 flat fix, started within one business day.
How do I prevent the handover lockout?
Two administrators minimum, on addresses you control; the admin email on a monitored inbox; the custom login URL written somewhere that survives staff changes; and your own hosting login in your own password manager. Five minutes of hygiene that turns future lockouts from crises into inconveniences.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
- Login LoopWhen the door accepts you, then bounces you.
- Access DeniedIn the door, but stripped of authority.
- Email Not SendingThe reset-email hole, fixed properly.
- Hacked SiteIf re-entry reveals strangers.
- Website RepairThe whole bench.
- Mixed ContentMixed content warnings
- New Site InvisibleNew site not on Google
- Not SecureNot secure warning
Back behind the wheel today — verified, documented.
Send the symptom, get a look within one business day and a flat quote from the developer who's fixed this exact thing more times than either of us can count.