WordPress Admin Login Not Working
You can't get into your WordPress dashboard — /wp-admin rejects your password, resets never arrive, or the login page just loops back at you.
Common signs of this issue
- Your correct password is rejected at /wp-admin, or your username is "not recognized."
- The login page accepts the password, then reloads itself in a loop and never lets you in.
- "Lost your password?" reset emails never arrive, even in spam.
- You see "too many attempts" or a lockout message from a security plugin.
- The /wp-admin page itself won't load, shows a 404, or looks different than usual.
- Your credentials worked last week and nothing you know of changed.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Confirm the address:
yourdomain.com/wp-admin— and remember many security setups move the login to a custom address. If /wp-admin 404s, search old emails or notes from whoever set up the site for the custom login URL. - Check the basics that eat an hour of everyone's life eventually: caps lock, an autofilled old password, and whether you're on the right site (the live domain, not a staging copy with different credentials).
- Use Lost your password? with your username AND with your email address (both work). If the reset email never arrives, check spam — and know that missing reset mail is usually the site's email delivery failing, not your account: the email guides below cover the underlying fix.
- For a login loop (right password, back to the login page): clear cookies for your site or try a private window, and if you use a caching plugin or Cloudflare, purge caches — cached login pages cause exactly this.
- For a lockout message: wait it out (commonly 15–60 minutes) rather than retrying — many security plugins extend the block on each new attempt. Trying from your phone on mobile data (different IP) tells you whether it's an IP block.
- If a security plugin (Wordfence, iThemes/Solid, WPS Hide Login) went in recently, it may have moved the login page or blocked your IP — check any emails it sent when installed.
- Rule out the bigger problem: if a password that definitely worked is definitely rejected, resets go nowhere, or you spot other oddities (strange admins, changed content), read the hacked-site guide before anything else — attackers change admin passwords.
What this usually means
Login failures sort into a few families, each with its own signature. Rejected password: wrong credentials, wrong site, or a changed password. Login loop: cookies/caching, occasionally a URL mismatch in settings. No reset email: the site's outbound email is broken — extremely common, and the same root cause as missing form emails. Lockout message: a security plugin doing its job too enthusiastically. Login page missing: a moved login URL.
The reset-email failure deserves emphasis because it compounds: a mistyped password is trivial until resets can't be delivered, at which point a non-problem becomes a full lockout. Fixing the site's email (authenticated SMTP) fixes password resets, form notifications, and order emails all at once.
Full lockouts are still recoverable without data loss: access can be restored from the hosting side (database password reset, or a temporary admin created via standard methods). It's routine work for someone who knows it — nothing about a lockout threatens your content.
What not to do
- Don't keep guessing passwords — security plugins and hosts extend lockouts with each failure, and enough failures can flag your own IP as an attacker.
- Don't edit the database to reset your password unless you know exactly what you're doing and have a backup — one wrong edit in the users table makes things worse than a lockout.
- Don't delete security plugin files by FTP as a first move — some leave rules behind that outlive the deletion, and you lose the plugin's record of why you were blocked.
- Don't ask a stranger from a forum or social media to 'hop in and fix it' with your hosting credentials — locked-out owners are a favorite target for opportunists.
- Don't panic-restore a full backup to undo a lockout — access can be restored without rolling back your content.
When to get help
If resets won't send and you're fully locked out, the recovery runs through the hosting account — resetting the password at the database level or creating temporary access — which is quick, safe, routine work for someone experienced, and easy to get wrong solo. It's also the natural moment to fix the email delivery that turned a typo into a lockout, and to have someone confirm nothing suspicious explains the lost access.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
Why don't my WordPress password reset emails arrive?
WordPress sends them via the server's basic mail, which is widely distrusted and often silently dropped — same disease as missing contact-form emails. Check spam first; the real fix is the site sending through an authenticated mail service (SMTP).
Why does the login page just reload without logging me in?
The classic login loop — usually cookies or caching serving you a stale login page. Clear cookies for the site or use a private window, and purge any caching plugin/Cloudflare cache. If it persists, the site's URL settings may disagree with the actual address.
My /wp-admin shows a 404. Where did my login go?
A security plugin most likely moved it to a custom address (a common, legitimate hardening step). Check emails or notes from whoever configured security. Failing that, someone with hosting access can find the plugin and its setting.
I'm completely locked out and resets don't work. Is my site stuck?
No — access can be restored from the hosting side (a database-level password reset or a temporary admin) without touching your content. It's a routine job; the door is locked, the house is fine.
Could my login failing mean the site was hacked?
Occasionally — attackers do change admin passwords. Treat it seriously if a known-good password fails AND resets vanish AND anything else looks off (new admin users, changed content, strange redirects). One symptom alone is usually mundane; the combination isn't.
How do I stop lockouts from happening again?
A password manager (no more typos and forgotten passwords), working site email (so resets actually deliver), your security plugin's lockout threshold set forgivingly for you, and two-factor login if the plugin offers it — protection that doesn't depend on lockout counting.