Diagnostic tool

Login Issue Recovery Tool

Name: Login Issue Recovery Tool
Author: GrowrAI Editorial Team

By GrowrAI Editorial Team• Browser only, no data sent

Tell us what's happening when you try to log in.

Regain access to wp-admin when the login page refuses to cooperate.

No login required Free forever

What this tool does

The Login Issue Recovery Tool addresses every common cause of being locked out of WordPress: an endlessly refreshing login page, a misconfigured Site URL, a security plugin that has banned your IP address, a cookie domain mismatch, a forgotten password with no working email, and brute-force protection that is over-aggressive. Each path includes both wp-admin recovery and database-level recovery instructions.

Without wp-admin access, you cannot update plugins, publish content, process orders, or respond to security alerts. Many lockouts are caused by simple cookie or Site URL mismatches that can be resolved in under a minute once you know where to look. Other lockouts, such as banned-IP cases, require FTP intervention.

Runs in your browser

No files uploaded, no credentials requested.

Maintained by people

Reviewed and kept current by the GrowrAI editorial team.

Tested on live sites

Every fix path verified on a real broken WordPress install.

Scroll down for the full walkthrough, common mistakes, and FAQs. If you already know what you need, use the form below to get an instant recommendation.

Step 1: Describe the issue

What happens when you try to log in?

Frequently asked questions

Why does the login page keep refreshing?

Usually a cookie or Site URL mismatch. The tool gives steps to clear cookies and set WP_HOME correctly.

Can I reset my password without email?

Yes. You can reset the password hash directly in the wp_users table through phpMyAdmin.

How do I unban my own IP from a security plugin?

Connect via FTP and rename the security plugin's folder in /wp-content/plugins to deactivate it. Log in, whitelist your IP, then reactivate the plugin.

What if I never receive the password reset email?

Hosting outbound mail often fails silently. Reset the password through phpMyAdmin or use WP-CLI: wp user update <login> --user_pass=NEW.

Can I create a new admin user from the database?

Yes. Insert a row into wp_users with a hashed password, then add an entry to wp_usermeta with wp_capabilities set to a:1:{s:13:"administrator";b:1;}.

Why does WordPress say 'cookies are blocked' even though they are enabled?

Almost always a mismatch between the URL you used to log in and the WP_HOME or WP_SITEURL value. Make sure both use the same scheme and domain.

Is two-factor authentication causing my lockout?

Possibly. If you lost the 2FA device, deactivate the 2FA plugin via FTP folder rename, log in, and reconfigure it with a fresh device.

What is the safest way to reset wp-admin access?

Reset the password first, then verify Site URL, then check for active security plugins. Escalate to database changes only if those fail.

In-depth guide

Everything you need to know about the Login Issue Recovery Tool

Overview

Because losing dashboard access is one of the most stressful WordPress incidents, the tool prioritises non-destructive steps first. You start with cookie and cache resets and only move to FTP and database-level fixes if those fail.

Why this matters for WordPress site owners

How to use this tool, step by step

1Choose the exact symptom: redirect loop on login, blank screen, invalid credentials, or 'access denied' page.
2Indicate whether you can receive password reset emails.
3Follow the recovery sequence, which always starts with the safest fix and escalates only when needed.

Expertise and methodology

Recovery steps map to the WordPress core documentation on resetting passwords, resetting Site URL via wp-config.php, and recovering from security plugin lockouts. Steps have been verified against Wordfence, iThemes Security, All In One WP Security, and Sucuri.

Reviewed and maintained by GrowrAI Editorial Team. Every fix path is tested on a live WordPress install before it is published here.

Common mistakes to avoid

Resetting passwords through random SQL queries copied from forums.
Deactivating a security plugin by deleting it instead of renaming the folder.
Setting WP_HOME or WP_SITEURL to the wrong scheme (HTTP vs HTTPS).

The four different problems that all look like 'I cannot log in'

Being locked out of wp-admin has several distinct causes and they need different fixes, so the first job is telling them apart. If the login page loads and rejects your password, it is a credentials or user record problem. If it accepts the password and bounces you straight back to the login screen, it is almost always cookies or a site URL mismatch. If the login page redirects endlessly or lands on the homepage, the site address settings or an SSL rule are fighting each other. And if wp-admin loads but is blank or half broken, that is a plugin or theme failure rather than an authentication failure at all.

The bounce-back-to-login case is the most misdiagnosed. WordPress sets an authentication cookie for a specific domain; if the site address in the database says one thing and the browser is on another, for example www versus non-www or http versus https, the cookie is written for a domain the next request is not on, so WordPress sees you as logged out again. No amount of password resetting fixes that.

Getting back in when the reset email never arrives

Password reset emails fail often, because WordPress sends mail through the server's PHP mail function by default and most modern mail providers discard those messages. Check spam first, then stop relying on email and reset the password directly. In phpMyAdmin, open the wp_users table, edit your user row, type the new password in the user_pass field and choose MD5 as the function before saving; WordPress accepts that on the next login and immediately upgrades it to a stronger hash.

If you have no database access but you do have file access, you can add a temporary administrator by dropping a small snippet into your theme's functions.php using wp_create_user and then granting the administrator role, loading any page once so the code runs, and deleting the snippet immediately afterwards. Leaving that code in place is a serious security hole, so treat it as a two-minute operation and verify the file afterwards. Once you are back in, install a proper SMTP plugin so future reset emails actually get delivered.

Lockouts caused by security plugins and two-factor setups

Security plugins that limit login attempts will lock out the legitimate owner as readily as an attacker, particularly if you have been testing passwords. The block is normally stored either in the database or in a file inside the plugin's folder, and renaming that plugin's folder over FTP clears it instantly. The same applies to a two-factor plugin when you have lost the device: rename the folder, log in, then reconfigure two-factor properly before re-enabling it.

Two related checks save a lot of time. Some hosts and firewalls block by IP at a level WordPress never sees, so if the login page itself will not load, ask the host whether your address is blocked before touching the site. And clear cookies for the domain before deciding a fix has failed, because a stale authentication cookie from the broken state will keep reproducing the original symptom on an otherwise healthy site.