Where your WordPress login details are stored
Your WordPress admin username and password live in two places: the database that runs your site, and your email inbox (if you set up the account yourself or asked WordPress to send you a reset link). If you can access either one, you can get back in. The database is on your web host's server. Your email is in whatever email account you used when you created the WordPress site.
Most people lose access because they forgot the password, not the username. The username is usually visible on the login page itself — it's the name you type in, so you may have written it down or saved it in a browser. The password is what you actually need to recover.
Key Takeaways
- If you remember the email address tied to your WordPress account, use the "Lost your password?" link on the login page to reset it by email.
- If you don't have access to that email account, contact your web host — they can reset your password through the hosting control panel or database tools.
- Your username appears in the WordPress database and in your site's user list, but you need database access or hosting support to see it if you're locked out.
- Write down your username and password in a password manager (like Bitwarden or 1Password) after you regain access, so you don't lose them again.
Using the password reset link on your login page
Go to yoursite.com/wp-login.php and look for the text "Lost your password?" below the login box. Click it. You'll be asked for your username or the email address associated with your account. Enter whichever one you remember.
WordPress will send a reset link to that email address. Open your email, find the message from your site (check spam if you don't see it in your inbox), and click the link. It takes you to a page where you create a new password. Type a strong one — at least 12 characters, mixing uppercase, lowercase, numbers, and symbols. After you save it, go back to wp-login.php and log in with your username and the new password.
This method works only if you still have access to the email address you used to set up the account. If that email account is closed or you can't remember which one you used, move to the next section.
Asking your web host to reset your password
Every web host (GoDaddy, Bluehost, Kinsta, SiteGround, and others) gives you a control panel — usually cPanel, Plesk, or their own branded version — where you can manage your site's database. Your host's support team can reset your WordPress password through that panel without needing your email.
Log into your hosting account using the credentials you got when you signed up (not your WordPress credentials — your hosting account credentials). Look for a tool called phpMyAdmin or Database Manager. Open it and find the table called wp_users (or yourprefix_users if your site uses a custom prefix). In that table, you'll see a row with your username. The password field is encrypted, so you can't read it, but you can change it.
If you're not comfortable doing this yourself, contact your host's support team and tell them you need to reset your WordPress admin password. They will do it for you, usually within a few hours. Have your hosting account username and the domain name ready when you contact them.
Finding your username if you don't remember it
Your WordPress username is stored in the wp_users table in your database. If you have access to phpMyAdmin through your hosting control panel, you can see it there. Log in to your hosting account, open phpMyAdmin, select your site's database, and click the wp_users table. The username column shows all admin accounts on your site.
Another way to find your username is to look at your site's public pages. WordPress displays the author name on posts and in the author archive (yoursite.com/author/username). That's usually your username, though some sites use a display name instead. If you see a name on your posts, try logging in with that.
If your site is brand new and you never finished setting it up, your host may have created a default admin account. Check your hosting welcome email — it often includes a temporary username and password, or a link to set one up.
Using WordPress security plugins to regain access
If you have a plugin like Wordfence or iThemes Security installed, some of them have built-in account recovery tools. Log into your hosting account, go to your site's file manager or use SFTP, and look in the wp-content/plugins folder. If you see wordfence or better-wp-security, your site has one of these plugins.
These plugins can sometimes send you a password reset link or let you create a new admin account through a special recovery page. The exact steps depend on which plugin you have and whether it's still active. Your web host's support team can tell you if your site has one of these tools and how to use it.
Creating a new admin account if you're completely locked out
If you can't reset your password through email, your host won't help, and you don't have a recovery plugin, you can create a new admin account by editing your site's files directly. This requires SFTP access or a file manager in your hosting control panel.
Connect to your site using SFTP (your host provides the login details in your hosting account). Navigate to the wp-content folder and create a new file called create-admin.php. Paste this code into it:
<?php $user = 'newadmin'; $pass = 'YourNewPassword123'; $email = 'your@email.com'; wp_create_user( $user, $pass, $email ); $user_id = username_exists( $user ); $user = new WP_User( $user_id ); $user->set_role( 'administrator' ); echo 'Admin account created'; ?>
Replace newadmin, YourNewPassword123, and your@email.com with your own values. Save the file, then visit yoursite.com/wp-content/create-admin.php in your browser. You'll see "Admin account created" if it worked. Delete the create-admin.php file when ready after — leaving it there is a security risk. Now log in with the new username and password you created.
Protecting your login details after you regain access
Once you're back in, change your password to something you won't forget. Go to Users > Your Profile in the WordPress dashboard and click "Generate Password". WordPress will create a strong random one. Copy it into a password manager like Bitwarden, 1Password, or Dashlane. These tools store your passwords encrypted and fill them in automatically when you need them.
Write down your username somewhere safe too — not on a sticky note on your monitor, but in that same password manager or a locked document. If you use the same password manager for your hosting account, your email, and your WordPress site, you'll have one place to look if you get locked out again.
Consider enabling two-factor authentication on your WordPress account if your host or a security plugin supports it. This adds a second step — usually a code from your phone — when you log in, so even if someone gets your password, they can't access your site.
Frequently Asked Questions
Can I see my password if I'm already logged in?
No. WordPress doesn't store passwords in a readable form — they're encrypted one-way, so even WordPress itself can't show you what you typed. You can only reset it to something new. If you're logged in, go to Users > Your Profile, click "Generate Password", and save the new one to a password manager.
What if my web host won't help me reset my password?
Most hosts will help if you prove you own the account. If they refuse, you can create a new admin account using the file method described above, or hire a WordPress specialist to do it for you. Expect to pay $50 to $150 for that service.
Is it safe to use a password reset plugin?
Yes, if it's from a trusted source like Wordfence or iThemes Security. Avoid plugins with very few downloads or poor reviews. After you reset your password, deactivate and delete the plugin so it's not sitting on your site unused.
Why does WordPress send password reset emails to spam?
Your email provider may filter WordPress emails because they come from your site's server, not a major email company. Check your spam folder first. If you never see the email, ask your host to check your site's mail logs — they can tell you if the email was actually sent.
Can I change my username after I log back in?
You can create a new admin account with a different username and delete the old one, but you can't rename an existing account. Go to Users, add a new user with administrator role, log out, log back in as the new user, then delete the old account from the Users page.