Locked Out

Locked out of your own site, and the password just won’t work.

Two of the four causes you can clear yourself. The message on your screen tells you which.

One of those two fixes is doing nothing at all and waiting it out. Here’s how to tell the four apart, so you don’t turn a lockout into something worse.

Work out which one you have

Text 562-726-2287

Start with the free steps below. If you’re still locked out, text us and a person takes it from there.

4 causes

The screen tells you which

$0

If your host can reset it

~4 hrs

To a written diagnosis

The short answer

Four things lock people out of WordPress, and the symptom tells you which.

Wrong password: the login page says so plainly. Use Lost your password, and if the reset email arrives you’re done in two minutes.

A security plugin lockout: the message mentions too many attempts, or the login page won’t load at all from your connection. These usually clear themselves in fifteen to sixty minutes. Waiting is often the whole fix, and trying again from the same connection extends it.

The admin email is stale: the reset appears to send and nothing arrives, because it’s going to an address belonging to someone who left. Check who the admin address actually is, if you can reach anyone still logged in.

The reset email never arrives at a working address: this isn’t a password problem at all. It’s mail configuration, the same fault that silently breaks contact forms, and no amount of resetting will fix it.

For that last one, your host can reset the password directly through their control panel or the database, which bypasses email entirely. That’s the fastest route back in.

Text 562-726-2287 or describe it here. Written diagnosis and a fixed quote in about 4 business hours, free.

Is this you?

Check you’re on the right page.

That last one isn’t a lockout, and it changes what you should do next. It’s covered in when to stop, below.

You’re locked out of your own site, and the friend you asked to log in can’t get in either
The password you’ve always used just stopped working
You requested a reset and nothing arrived, at an address you can definitely read
It says too many failed attempts, try again in five hours
The login page won’t load from your connection, but works elsewhere
The developer who set it up is gone, and the access left with them

What’s actually causing it

Four causes, in the order they usually turn out to be.

01 Most common

A security plugin lockout

Wordfence and similar plugins block an IP address after failed attempts, and the block is usually temporary. If the site loads fine from your phone with wifi off, that confirms it: your office IP is blocked, not your account.

Mail configuration

The reset genuinely sends and never arrives, because WordPress is sending from the web server rather than an authenticated mail service and the receiving server discards it silently. Same root cause that breaks contact forms, covered in depth on that page.

A stale admin email

The address on the account belongs to a person or an agency who’s gone. Everything is working correctly and delivering to a mailbox nobody opens.

A compromise

Your account still exists but has lost its administrator role, or a new administrator you don’t recognise has appeared. That isn’t a lockout. That’s someone else being in your site, and it’s different work.

What you can try yourself

The ways back in, in order.

Most pages on this send you to edit wp-config.php or run a SQL query. That’s worse advice for a stranger in a hurry, and there’s a faster route.

Wait, if it mentions failed attempts

Fifteen to sixty minutes on most configurations. Trying again from the same connection resets the timer, so leave it alone. Test from your phone on mobile data to confirm it’s your IP rather than your account.

Request one password reset, and watch for it

One. Then check spam. If it arrives, you’re done.

If it doesn’t arrive, ask your host to reset the password

Most hosts can do this directly, in the panel or in the database, bypassing email entirely. This is the route people don’t know exists and it’s usually the fastest one.

When to stop

Stop here

If you see an administrator account you don’t recognise, or your own account has quietly lost its administrator role, stop and treat it as a compromise.

Get in touch with somebody immediately, because further action can make it worse. Depending on the kind of attack or exposure, you may even want to take the site offline temporarily.

Otherwise, stop when your host can’t reset the password either. At that point it’s database work, and a wrong query on a user table locks everybody out rather than just you.

What we do about it

Back in today, and the next one is a two-minute problem.