Not allowed to access
You logged in fine. WordPress just no longer believes you're the admin.
'Sorry, you are not allowed to access this page' after a successful login is a permissions identity crisis: your password worked, but your account's authority evaporated. The causes are database-side, specific, and very fixable.
Same-day diagnosis. Flat quote before any fix.
What’s actually happening
WordPress authority lives in roles and capabilities stored in the database — and this error means your logged-in account no longer carries the capability the page demands. You authenticated as someone; that someone just isn't an administrator anymore, as far as the database tells it.
The classic mechanisms: a migration changed the database table prefix and the permission entries (stored under prefix-specific keys) got orphaned; a role or membership plugin rewrote roles badly; a partial restore mixed two databases' worth of accounts; or — the dark variant — a hack demoted you while promoting accounts you've never heard of, which is why a quick look at the user list is part of any diagnosis.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
Table-prefix mismatch after migration
Permissions stored under wp_-prefixed keys stop matching a database moved to a new prefix. The site works; authority orphans. The leading cause post-migration.
A role plugin rewrote the rules
Membership, role-editor, or security plugins reshaping roles — occasionally deleting the administrator's capabilities in the process.
Corrupted or partial restore
A restore that mixed eras of the database, leaving your account present but its authority behind.
A compromise rearranged the hierarchy
Attackers demote real admins and add their own. If unfamiliar admin accounts exist, this stopped being a permissions bug.
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Confirm which pages refuse you
Everything past the dashboard? Just plugins/settings? A specific plugin's page only? Total refusal is role corruption; selective refusal is capability-specific — different depths of the same repair.
- 2
Note what preceded it
Migration, restore, new membership plugin, host move? The mechanism almost always matches the most recent database-touching event.
- 3
If you can see the Users list, read it
Unfamiliar administrators or your account showing a diminished role turns this from repair into incident response. Screenshot; don't delete yet.
Stop and call when…
- Strange admin accounts exist — treat as a possible compromise, not a glitch
- The fix requires database-level role restoration — precise work, wrong place to learn SQL
- It followed a migration and other oddities are appearing — the prefix mismatch rarely travels alone
From there it’s our job: same-day look, flat quote, and the $229 flat repair covers most cases of exactly this.
Single Error Fix — buy it now, skip the hunt.
One error, hunted down and fixed — 500s, white screens, redirect loops, broken pages.
Covers one specific error or broken behavior on one site. Diagnosis, the fix, and a plain-English note on what happened. If we can't fix it, you get a full refund.
Questions we hear a lot.
My password works — how can I not be admin?
Authentication and authorization are separate ledgers: the password proves who you are; roles stored in the database say what you may do. This error is ledger two failing — your identity intact, your authority orphaned or rewritten. Repairing the ledger restores it.
Can this be fixed without wp-admin access?
Yes — authority repairs happen in the database directly, which is exactly where the fault lives. Done carefully (on a backup-first basis), your account's capabilities are restored and verified before anything else is touched. That's the flat fix.
Was I hacked?
Usually not — migrations and role plugins cause most of these. But the overlap is real enough that the diagnosis always includes the check: unfamiliar accounts, changed emails, or recently modified core files reroute this to the hacked-site protocol. You'll know which within the first look.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
Get your authority back — verified, same-day.
Send the symptom, get a same-day look and a flat quote from the developer who's fixed this exact thing more times than either of us can count.