Before you start
- Control panel access with phpMyAdmin, or SSH with WP-CLI
- Read access to the site's wp-config.php
Step 1: Try the normal reset first
The Lost your password? link on the login page emails a reset link. If it never arrives, the site probably cannot send mail, which is worth fixing separately — but the steps below do not depend on it.
https://yourdomain.com/wp-login.php?action=lostpasswordStep 2: Find the right database and table prefix
Open wp-config.php. DB_NAME is the database and $table_prefix is the prefix on its tables — wp_ by default, often something else. Accounts with several WordPress installs have several databases, so check before editing.
Step 3: Edit the user in phpMyAdmin
In cPanel, open Databases → phpMyAdmin, select the database, then the users table (prefix + users). Click Edit on your user's row. In the user_pass row, choose MD5 in the Function column, type the new password as the value, and click Go.
Step 4: Or run it as a query
The same change in SQL, using your prefix and username. WordPress accepts the MD5 value once and replaces it with its own stronger hash the first time you log in.
UPDATE wp_users SET user_pass = MD5('a-new-strong-password') WHERE user_login = 'yourusername';Step 5: With SSH, use WP-CLI instead
WP-CLI hashes the password the same way WordPress does, with no database editing at all. Run it from the WordPress directory.
wp user update yourusername --user_pass='a-new-strong-password'Step 6: Check who else is an administrator
Log in and open Users, filtered to Administrator. If you were locked out unexpectedly, an account you do not recognise is a sign of a compromise — remove it and change every admin password, the database password and the salts in wp-config.php.
The mistake people make
Editing the users table of the wrong database on an account with more than one site. The query succeeds, the password still fails, and a different site now has a changed admin password.
