WordPress Lost Admin Access - Recovery Without Database

You lost admin access to WordPress.

Normally, you'd reset the password via the database using phpMyAdmin. Quick fix. Done in 5 minutes.

But phpMyAdmin is blocked on your hosting.

Or your hosting doesn't provide database access.

Or you don't know how to use phpMyAdmin and don't want to learn.

You're stuck. No admin, no database access, no way forward.

A client called us in a panic. They lost their only admin account. Their hosting had phpMyAdmin disabled for security. They thought they were completely locked out and would have to reinstall WordPress.

We regained access in 8 minutes using just FTP and a text editor. No database needed.

Being locked out of WordPress doesn't mean the database is your only option. There are multiple ways back in using just file access. If you have FTP, SFTP, or SSH, you can regain admin access.

---

Why Database Access Isn't Always Available

Some hosting providers restrict or disable database access for security.

• Shared hosting: phpMyAdmin might be disabled by default
• WordPress.com: No database access at all
• Some managed WordPress hosts: phpMyAdmin blocked to prevent accidents
• Security-hardened hosting: Database tools removed by hosting provider
• You forgot your database password: Can't access database even if you wanted to

The good news: You don't need the database. FTP gives you everything you need.

---

Requirements: What You Need

Before you start, verify you have these:

• FTP, SFTP, or SSH access: Connection to your server files
• FTP credentials: Username and password (or SSH key)
• Text editor: Any editor (Notepad, VS Code, Sublime)
• Access to your site's domain: You can visit your WordPress URL

If you don't have FTP access: Contact your hosting provider and request it. Most provide it within 1 hour.

---

Method 1: Create New Admin User via functions.php

This is the quickest method. You add code that creates an admin user when you load your site.

How it works

WordPress runs functions.php every time a page loads. You add code that creates a new admin user. Then you delete the code. Clean and simple.

Step 1: Connect via FTP

1. Open your FTP client (FileZilla, WinSCP, Cyberduck, etc.)
2. Enter your FTP credentials
3. Connect
4. Navigate to your WordPress root directory

Step 2: Find your theme's functions.php

1. Navigate to wp-content/themes/[your-theme-name]/
2. Find functions.php file
3. Download it to your computer (backup)
4. Open it in a text editor

Step 3: Add the admin creation code

Scroll to the very end of functions.php (after the last ?> if present).

Add this code:

// Create admin user temporarily
if ( ! username_exists( 'admintemp' ) ) {
    wp_create_user( 'admintemp', 'TempPassword123!', 'admin@example.com' );
    $user = get_user_by( 'login', 'admintemp' );
    $user->set_role( 'administrator' );
    wp_safe_remote_post( 'https://example.com/wp-admin/', array(
        'blocking' => false,
    ) );
}

Replace:

• admintemp = username you want
• TempPassword123! = password (must be strong)
• admin@example.com = any email
• example.com = your actual domain

Step 4: Upload the modified functions.php

1. Save the file
2. Upload it back to wp-content/themes/[your-theme-name]/functions.php
3. Overwrite the original

Step 5: Trigger the code

1. Open your browser
2. Visit yoursite.com
3. The code runs on page load
4. New admin user is created

Step 6: Log in with the new admin

1. Go to yoursite.com/wp-login.php
2. Enter username: admintemp
3. Enter password: TempPassword123!
4. You're now logged in as admin

Step 7: Clean up

1. Go to Users
2. Create a permanent admin account for yourself
3. Delete the admintemp user
4. Go back to FTP
5. Remove the code you added to functions.php
6. Upload the cleaned functions.php back

IMPORTANT: Remove the code after using it. Leaving it in is a security risk.

---

Method 2: Create Admin User via wp-cli (if available)

Some hosting provides SSH access with WP-CLI installed. This is the cleanest method.

Check if you have SSH access

1. Go to your hosting control panel
2. Look for "SSH" or "Terminal Access"
3. If available, you can use this method

Connect via SSH

1. Open Terminal (Mac/Linux) or PuTTY (Windows)
2. Type: ssh username@yoursite.com
3. Enter your password
4. You're now on your server

Create new admin user

Navigate to your WordPress directory and run:

wp user create newadmin admin@example.com --role=administrator --prompt=user_pass

Replace:

• newadmin = your desired username
• admin@example.com = any email

It will prompt you to enter a password. Enter a strong one.

Verify it worked

wp user list

You should see your new user in the list.

Log in

1. Go to yoursite.com/wp-login.php
2. Log in with the new credentials

Advantages of this method

• No code to clean up
• User is created directly and properly
• Fastest method if you're comfortable with terminal
• No temporary usernames to delete

---

Method 3: Inject Code via wp-config.php

wp-config.php runs on every WordPress load. You can inject admin creation code there.

Step 1: Connect via FTP and download wp-config.php

1. Connect via FTP
2. Find wp-config.php in your WordPress root
3. Download it
4. Open in text editor

Step 2: Add admin creation code

Find this line: That's all, stop editing!

RIGHT BEFORE that line, add:

// Temporary admin creation
if ( ! function_exists( 'wprc_create_temp_admin' ) ) {
    function wprc_create_temp_admin() {
        if ( ! username_exists( 'temprecovery' ) ) {
            $user_id = wp_create_user( 'temprecovery', 'Recovery123!', 'recover@example.com' );
            $user = new WP_User( $user_id );
            $user->set_role( 'administrator' );
        }
    }
    add_action( 'wp_loaded', 'wprc_create_temp_admin' );
}

Step 3: Upload the modified wp-config.php

1. Save the file
2. Upload it back to WordPress root
3. Overwrite the original

Step 4: Load WordPress to trigger the code

1. Visit yoursite.com in your browser
2. The code runs
3. Admin user is created

Step 5: Log in and clean up

1. Log in as temprecovery
2. Create your permanent admin account
3. Delete temprecovery user
4. Remove the code from wp-config.php
5. Upload the cleaned wp-config.php back

Advantages: Works on any WordPress installation. wp-config.php is always there.

Disadvantages: You need to clean up after. If you forget, security risk.

---

Method 4: Replace .htaccess to Expose Functions

This advanced method temporarily removes WordPress rewrite rules so you can access functions directly.

Warning: This is for advanced users. Use only if other methods fail.

How it works

.htaccess rewrites all requests to WordPress. By temporarily removing it, you can access PHP files directly.

Step 1: Back up .htaccess

1. Connect via FTP
2. Find .htaccess in your WordPress root
3. Download it (backup)

Step 2: Temporarily rename .htaccess

1. Rename .htaccess to .htaccess.backup
2. This disables all rewrite rules

Step 3: Create a recovery.php file

Create a new file called recovery.php in your WordPress root:

<?php
require( dirname( __FILE__ ) . '/wp-load.php' );

if ( ! username_exists( 'adminrecovery' ) ) {
    $user_id = wp_create_user( 'adminrecovery', 'AdminPass123!', 'admin@example.com' );
    $user = new WP_User( $user_id );
    $user->set_role( 'administrator' );
    echo 'Admin user created! Username: adminrecovery';
} else {
    echo 'User already exists';
}
?>

Step 4: Upload recovery.php

1. Save the file
2. Upload it to your WordPress root

Step 5: Run the recovery script

1. Visit yoursite.com/recovery.php
2. You should see "Admin user created!"

Step 6: Log in

1. Go to yoursite.com/wp-login.php
2. Log in as adminrecovery

Step 7: Clean up

1. Delete recovery.php via FTP
2. Rename .htaccess.backup back to .htaccess
3. Your site is back to normal
4. Create permanent admin account

IMPORTANT: While .htaccess is renamed, WordPress URLs will be broken. Do this quickly and restore it immediately after.

---

Method 5: Use Hosting Control Panel (easiest if available)

Some hosting providers have WordPress tools built into their control panel.

Check if your hosting has WordPress tools

1. Log into your hosting control panel (cPanel, Plesk, etc.)
2. Look for "WordPress" section or "Applications"
3. Many modern hosts have one-click admin password reset

If your hosting has WordPress installer

1. Go to "WordPress Manager" or similar
2. Look for your site
3. There might be a "Reset Admin Password" or "Admin Access" option
4. Click it
5. New credentials are generated
6. You're logged back in

Why this is easiest: No code, no FTP, just control panel clicks.

Check your hosting's documentation or contact support to see if they offer this.

---

Troubleshooting: What If The Code Doesn't Work

New user wasn't created

Possible causes:

• wp_create_user() wasn't executed (code didn't run)
• WordPress functions aren't loaded yet (timing issue)
• Syntax error in the code you added

Fix:

1. Double-check the code has no typos
2. Make sure you're adding code BEFORE "That's all, stop editing!"
3. Try a different method (wp-cli or recovery.php)

Getting "Parse error" or "Syntax error"

You probably have a code syntax error.

Fix:

1. Download the file you edited
2. Check the line numbers in the error
3. Look for missing semicolons or quotes
4. Compare your code to the examples
5. Make sure closing ?> is correct

Can't connect via FTP

FTP credentials might be wrong or FTP is disabled.

Fix:

1. Check your FTP credentials in hosting control panel
2. Try SFTP instead (more secure)
3. Contact hosting and request FTP be enabled

Code ran but user still can't log in

The user might have been created but with issues.

Fix:

1. Go to Users in wp-admin (if you can log in as anyone else)
2. Check if the user exists
3. Click Edit
4. Verify role is "Administrator"
5. Try resetting their password

---

Real-World Admin Loss Scenario

Scenario: A freelancer inherited a WordPress site from the previous developer. The only admin account was tied to the old developer's email. The freelancer didn't know the password and the old developer wasn't responding to emails. They had no database access.

What they tried:

1. Clicked "Lost Password?" on login
2. Password reset email went to the old developer's email (bounced)
3. Contacted hosting support
4. Hosting said "We can't reset passwords, that's your responsibility"
5. Checked if phpMyAdmin was available (it wasn't)
6. Contacted the old developer (no response)
7. They were completely stuck for a day

Our fix:

1. Connected via FTP
2. Added code to functions.php to create a new admin user
3. Visited their site to trigger the code
4. Logged in as the new admin
5. Changed the old admin's email to a new one they owned
6. Reset the password properly
7. Removed the temporary code from functions.php

Total time: 12 minutes. No database access needed.

---

Security: Clean Up Properly

After regaining access, don't forget security.

Do this immediately

• ✓ Delete temporary admin users (temprecovery, admintemp, etc.)
• ✓ Remove injected code from functions.php and wp-config.php
• ✓ Delete any recovery.php files
• ✓ Rename .htaccess.backup back to .htaccess if you used that method
• ✓ Change all remaining admin passwords to strong ones
• ✓ Enable two-factor authentication
• ✓ Check User list for unauthorized accounts

Set up proper admin management

• Create at least 2 admin accounts (you + someone else)
• Store credentials in a password manager
• Use strong, unique passwords
• Enable 2FA on all admin accounts
• Regularly audit Users list

---

Admin Access Recovery Checklist

No database access but need admin back?

• ✓ Verify you have FTP/SFTP/SSH access
• ✓ Method 1: Try functions.php code injection (quickest)
• ✓ Method 2: Use WP-CLI via SSH (if available)
• ✓ Method 3: Inject code via wp-config.php (most reliable)
• ✓ Method 4: Create recovery.php file (if others fail)
• ✓ Method 5: Check hosting control panel for WordPress reset tool
• ✓ Log in with new admin credentials
• ✓ Create permanent admin account for yourself
• ✓ Delete temporary admin users
• ✓ Remove all injected code and recovery files
• ✓ Change all admin passwords
• ✓ Enable 2FA on admin accounts

---

Prevention: Never Get Locked Out Again

1. Keep multiple admin accounts

Create at least 2 independent admin accounts with different emails. If one gets compromised or lost, you have a backup.

2. Store credentials securely

Use a password manager (1Password, Bitwarden, LastPass). Not a notebook. Not a text file.

3. Use recovery email

Make sure the admin account's email is one you still have access to. Check it regularly.

4. Enable 2FA

Install Google Authenticator or Authy. Backup codes go in your password manager.

5. Test recovery methods

Once a year, test password reset. Make sure email works and recovery links arrive.

6. Keep FTP access available

Know your FTP credentials. Test FTP access quarterly.

---

When to Contact Hosting Support

Contact them if:

• You don't have FTP/SFTP/SSH access
• You're getting "Permission denied" errors when uploading files
• Files you upload aren't executing
• You need help accessing your hosting control panel
• You've tried all these methods and still can't regain access

What to tell them:

"I've lost admin access to WordPress and need to regain it. I have FTP access, but no phpMyAdmin. Can you confirm FTP is working correctly and files can be written to wp-content/themes/?"

Most hosting helps within 30 minutes.

---

The Real Talk

Losing admin access is scary. You feel locked out of your own site. Panic sets in.

But here's what most people don't know: You don't need the database. The database is just one path back in. There are at least 4 other paths using only file access.

If you have FTP, you have everything you need to regain control.

The methods I've shown you are used by WordPress developers, hosting providers, and security professionals every single day. They're not hacks. They're legitimate recovery techniques.

Pick the method that fits your situation. Follow it step by step. Clean up after yourself. You'll be back in before you know it.

And then set up proper backup admin accounts so this never happens again.

You've got this. WordPress doesn't lock you out permanently. It just needs you to know where to look.