WordPress Login Not Working
WordPress login usually fails because of a stale cookie, a wrong password, a security plugin lockout, or a site URL that no longer matches the browser address. Try a private window at /wp-login.php first. If the password is right and you still bounce back, rename the lockout plugin or fix siteurl and home before resetting the password.
For WordPress site owners locked out of wp-admin who need the quickest safe fix for their exact login symptom.
knowledge
- Read time
- 5 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Which WordPress login failure do you have?
What the screen shows decides the fix: a wrong-password message, a form that reloads, a lockout notice, a bounce back to the form, a blank page and a 404 each have different causes. Identify yours before touching the database.
| What you see | Likely cause | Do this first |
|---|---|---|
| "The password you entered … is incorrect" | Wrong password or username | Lost your password on /wp-login.php |
| "Cookies are blocked or not supported" | Browser or cache blocking the test cookie | Private window; allow cookies for the site |
| "Too many failed attempts" or login disabled | Security plugin lockout | Rename that plugin folder in File Manager |
| Correct password, back at the form | URL mismatch, redirect loop, proxy HTTPS | Check siteurl, home and .htaccess |
| Blank page or "critical error" | PHP fatal in a plugin or theme | Rename the plugins folder |
/wp-login.php returns 404 | Login URL changed by a plugin, or wrong hosting account | Disable the hide-login plugin; confirm the files are here |
| Logged in, but "Sorry, you are not allowed" | Your role was changed | Another admin restores Administrator role, or use WP-CLI |
What to try in the browser before changing any files
Open https://your-domain/wp-login.php in a private window and sign in; if that works, the problem is cookies or cache in your normal browser, not the site.
- Clear cookies and cached files for this site only, then sign in again.
- Type the address yourself rather than using an old bookmark that may point to
http://or a different host. - If the form says the password is wrong, use Lost your password and check spam for the email.
- If you use a page cache or CDN, make sure
/wp-login.phpand/wp-admin/are excluded from caching; see clearing the WordPress cache.
How to clear a security plugin lockout or 2FA block
Rename the lockout plugin's folder in wp-content/plugins; WordPress deactivates it, the lockout disappears and you can sign in. This works for limit-login, firewall, hide-login and two-factor plugins alike.
- Open cPanel → File Manager, then
public_html/wp-content/plugins. - Rename the plugin folder, e.g.
limit-login-attempts-reloaded→limit-login-attempts-reloaded-off. - Reload
/wp-login.phpand sign in. - Rename the folder back, reactivate it, remove your IP from its lockout list, and keep the protection on.
If you cannot tell which plugin is responsible, rename the whole plugins folder, sign in, rename it back and reactivate plugins one at a time. A code prompt after the right password is two-factor authentication; use a recovery code, or disable the 2FA plugin this way and set it up again, as covered in WordPress two-factor authentication. File Manager steps for plugins are in managing plugins from cPanel.
Why a correct password sends you back to the login page
WordPress accepted the password but then redirected the browser to a different address, so the login cookie does not match; the cause is almost always siteurl/home, a redirect rule or HTTPS behind a proxy.
- Site URLs: the
siteurlandhomerows in the_optionstable must match the address you use exactly, includinghttpsandwww. IfWP_HOMEandWP_SITEURLare set inwp-config.php, those win. Ways to fix them are in changing the WordPress site URL. - .htaccess loop: rename
.htaccessto.htaccess-offand try again; if it works, re-save Settings → Permalinks to write a clean file. - Cloudflare "Flexible" SSL or a proxy: the proxy talks to the server over HTTP while WordPress expects HTTPS, causing a loop. Switch Cloudflare SSL to Full (strict) with a certificate on the server, or, behind a trusted proxy, add
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) { $_SERVER['HTTPS'] = 'on'; }near the top ofwp-config.php.
What if the login page is blank or shows a critical error?
A blank login page means PHP stopped with a fatal error before the form was drawn, usually after a plugin or theme update. Rename wp-content/plugins to plugins-off; if the form returns, a plugin is at fault.
If it stays blank with plugins off, rename the active theme's folder in wp-content/themes so WordPress falls back to a default Twenty-series theme, which must still be installed. To see the actual error, enable the debug log as explained in checking WordPress error logs, and for a site-wide blank page use fixing the WordPress white screen.
Resetting the WordPress password with WP-CLI or phpMyAdmin
When the reset email never arrives, set a new password directly: WP-CLI is the cleanest way, and phpMyAdmin works without SSH. Back up the database first.
# list administrators, then set a new password
wp user list --role=administrator --fields=ID,user_login,user_email
wp user update 1 --user_pass='use-a-long-unique-passphrase'
# restore a lost Administrator role
wp user set-role 1 administrator
- Without SSH, open cPanel → phpMyAdmin, select the site's database and the table ending in
_users. - Click Edit on your user, type a new password in
user_pass, choose MD5 in the Function column and click Go. - Sign in at
/wp-login.php. WordPress accepts the old-style hash once and replaces it with a modern one; since WordPress 6.8 new hashes use bcrypt. - Change the password again from Users → Profile, so the stored value is one you never typed into phpMyAdmin.
If your username is not in that table, you are in the wrong database or prefix; check DB_NAME and $table_prefix in wp-config.php. A strong password can come from the password generator.
Getting help from WebJi® support
On WebJi® WordPress hosting, email support@webji.services with the domain, what the login screen shows and what you have already tried; support replies 24/7 in Hindi and English, on average within 60 minutes. Phone support on +91 141 4941811 is available during business hours. WebJi® does not store your WordPress password, so support resets access through the same file and database steps shown above, and any larger repair is quoted before work starts.
Frequently asked questions
Why did WordPress stop sending password reset emails?
The server's PHP mail() messages are often rejected or filtered as spam because they fail SPF and DKIM. Configure an SMTP plugin that sends through a real mailbox on your domain, then test the reset again. Meanwhile, use WP-CLI or phpMyAdmin to get in.
I changed the login URL with a plugin and forgot it. How do I find it?
Rename that plugin's folder in wp-content/plugins; the default /wp-login.php returns immediately. After signing in, reactivate the plugin and note the custom slug. The trade-offs of hiding the login page are in changing the WordPress login URL.
Can a full disk stop WordPress logins?
Yes. When the account's disk or inode quota is full, PHP cannot write session data or the database cannot write, and logins fail silently or with errors. Check disk usage in the hosting panel and delete old backups or logs before trying again.
Is it safe to keep a limit-login plugin after a lockout?
Yes, and you should. Add your own IP to its allowlist if it has one, and pair it with two-factor authentication. Settings for retry limits are covered in limiting login attempts in WordPress.
Checked 15 November 2026 against WordPress and WP-CLI documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.