Locked out of WordPress
It's your site. The door doesn't know that.
Every WordPress lockout is one of a handful of doors: the password's lost and the reset email never comes, a security plugin banned your IP, someone moved the login page, or the admin account's email points somewhere you can't read. Each door has a key. Some keys just live deeper than the login form.
Same-day diagnosis. Flat quote before any fix.
What’s actually happening
The login form is only the front door — WordPress ownership is really proven at three layers. The form itself (password + username), the email layer (reset links, which depend on your site's ability to send mail and your account's address being one you still read), and the database layer, where accounts actually live and where someone with hosting access can always restore an administrator. Lockouts feel absolute because people only know about layer one.
That layered design is why 'locked out' is recoverable in essentially every case where you control the hosting: the database outranks the login form. It's also the diagnostic frame — the failed reset email is an email-deliverability problem wearing a login costume; the vanished login page is a security plugin's custom URL; the 'too many attempts' ban is a firewall doing its job on the wrong person.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
Reset emails that never arrive
The site can't send mail (the classic WordPress deliverability hole) or the account email is a defunct address. The most common lockout isn't about passwords at all.
Security plugin lockouts and bans
Failed-attempt limits, IP bans, and two-factor tangles — protection aimed at attackers, hitting the owner.
A moved login page
Custom login URLs set by security plugins ('WPS Hide Login' class) — /wp-admin 404s and the real door's address left with a previous developer.
Admin email or account changed
Handover gaps: the only administrator is an ex-employee, an old agency, or an address nobody can open. Ownership drift, discovered at the worst time.
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Name your door before forcing any
Wrong password? No reset email? Login page missing? Banned message? Each is a different failure with a different key — thirty seconds of naming saves an hour of flailing.
- 2
Check spam, then wait, then try the reset once more
Reset emails land in spam constantly. Twice-failed resets mean the email layer is broken — stop retrying and move layers.
- 3
Confirm your hosting access
Can you log into the host panel? Then you're not really locked out — the database route exists. That's leverage, whether you use it yourself or hand it to us.
Stop and call when…
- The database route is the answer but phpMyAdmin is a foreign country — wrong place to improvise
- No hosting access either — ownership recovery through the host comes first, and it's a process
- Unfamiliar admins or changed emails greet you on re-entry — that's a compromise, keep the evidence
From there it’s our job: same-day look, flat quote, and the $229 flat repair covers most cases of exactly this.
Single Error Fix — buy it now, skip the hunt.
One error, hunted down and fixed — 500s, white screens, redirect loops, broken pages.
Covers one specific error or broken behavior on one site. Diagnosis, the fix, and a plain-English note on what happened. If we can't fix it, you get a full refund.
Questions we hear a lot.
Reset emails never arrive — is my account gone?
No — your account is fine; your site's outbound email is broken. WordPress sends resets through the same fragile channel as every site email, and that channel fails silently all the time. The account restores through the database in minutes; the mail channel is its own repair worth doing while we're in there, since your customer emails are using it too.
Can you get me in without my password?
With your hosting access, yes — that's the point of the database layer. We verify you control the hosting (that's the real proof of ownership), restore or create your administrator account server-side, confirm nothing else was touched, and hand you fresh credentials. The $229 flat fix, same-day.
How do I prevent the handover lockout?
Two administrators minimum, on addresses you control; the admin email on a monitored inbox; the custom login URL written somewhere that survives staff changes; and your own hosting login in your own password manager. Five minutes of hygiene that turns future lockouts from crises into inconveniences.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
Back behind the wheel today — verified, documented.
Send the symptom, get a same-day look and a flat quote from the developer who's fixed this exact thing more times than either of us can count.