Access recovery · Beginner · 5–15 minutes
How to reset your WordPress password — Three Routes Back Into wp-admin, Ranked by Speed
You are locked out of your own site and the reset email is not arriving — which is two problems, and the second one is the interesting one.
The short answer
Use the fastest channel you still hold: with SSH, `wp user update your_username --user_pass='newpassword'` finishes it in one command; with cPanel only, edit wp_users in phpMyAdmin and set user_pass using the MD5 function; with neither, the 'Lost your password?' link is still there. All three end in the same place, so pick on access rather than preference.
Then fix the reason the email never came. WordPress sends through PHP mail by default and inbox providers grow less tolerant of that every year — an authenticated SMTP path repairs resets, form notifications and order confirmations in one change.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Assumed skill
5–15 minutes
Time at the keyboard
5
Routes covered here
24/7
Engineers on shift
This assumes you own the hosting account. Everything below is an owner's recovery path, reachable only by someone who can already sign in to cPanel or SSH — which is exactly why that login is the perimeter worth defending properly.
Work down the list by access rather than by taste. If you have a terminal open, the terminal route is thirty seconds; if you do not, phpMyAdmin is five minutes; the email link is only slow when it works and infinite when it does not.
One command, if you have SSH
`wp user update your_username --user_pass='newpassword'` from the WordPress root, and you are done. `wp user list` first if you are unsure of the login name. WP-CLI hashes the password properly on the way in, which is one fewer thing to get wrong.
SSH, Git and Composer come with the developer-focused plans, so this route is usually available. It is also the only one that leaves no browser session, no clipboard copy and no half-finished form behind it.
The database route, precisely
In cPanel, open phpMyAdmin, select the site's database and find the wp_users table — the prefix may not be wp_, so check wp-config.php if the table is not where you expect. Edit your row, choose MD5 from the function dropdown beside user_pass, and put the new password in the value field.
WordPress accepts that hash on the next login and re-stores it with its own stronger algorithm, so the MD5 is a one-time handover rather than a permanent downgrade. Change nothing else in that row: user_login and user_email are referenced elsewhere and editing them creates a second problem.
Why the reset email never arrived
By default WordPress hands mail to PHP's mail function, which sends unauthenticated from your web account. Receiving providers treat that with increasing suspicion, so resets, contact-form notifications and WooCommerce receipts all quietly disappear together.
Point the site at an authenticated mailbox with an SMTP plugin — your own domain mailbox is included with hosting, and webmail plus IMAP, POP and SMTP are switched on from the start. One change repairs every transactional email the site sends, not just the reset you needed today.
Close the door behind you
Set the new password from a password manager rather than inventing one, enable two-factor authentication, and read the user list while you are in there. On an older site the interesting discovery is rarely your own account — it is the second administrator nobody remembers creating.
If several people hold admin, demote the ones who only need editor. Fewer accounts with full rights is the cheapest security change available, and it costs nothing but a conversation.
The account these routes assume
Tutorials written against imaginary hosting rot fast. This one was written against the real thing: the same panel, the same phpMyAdmin build and the same SSH access sitting in your account right now.
Support is a human being at any hour, and the scope covers the awkward practical questions other hosts bounce straight back to you.
- SSH, Git and Composer on the developer-focused plans
- phpMyAdmin and per-site PHP settings in the panel
- Mailboxes on your own domain, with SMTP available
- Engineers on shift whatever hour it goes wrong
Why HostingFast
Standard on every plan
Ranked by access, not by taste
Three routes in, ordered by what you can still reach — SSH, then phpMyAdmin, then the email link.
The exact command
One WP-CLI line, with the flag spelled out, rather than 'use WP-CLI' and a shrug.
The hash question answered
Why MD5 in phpMyAdmin is safe as a one-off, and what WordPress does with it on the next login.
The real fix included
A missing reset email means the site cannot send mail at all — so the SMTP path gets fixed, not just the password.
Scoped honestly
Getting back into wp-admin is a beginner-level job — 5 to 15 minutes, depending which route you still have.
Tidied up afterwards
The last step is the user list, because lockouts are the one moment anybody actually reads it.
Quick Start
From order to online
- 1
Take the SSH route if you have it
`wp user update your_username --user_pass='newpassword'` from the site root, with `wp user list` first if you need the login name. Thirty seconds, correctly hashed, no browser involved.
- 2
Otherwise go through phpMyAdmin
Open the site's database in cPanel, find wp_users — check the prefix in wp-config.php — edit your row, select MD5 in the function dropdown for user_pass and enter the new password as the value.
- 3
Fall back to the email link
'Lost your password?' on the login form still works when mail does. Give it a few minutes and check the spam folder before writing the route off entirely.
- 4
Repair the mail path
A reset email that never lands means the site cannot send mail reliably. Add an SMTP plugin pointed at an authenticated mailbox on your own domain, and every transactional email starts arriving again.
- 5
Harden the account you just recovered
New password from a manager, two-factor enabled, and a read through the user list. Demote anyone holding administrator who only needs editor.
Built In
Loaded onto every plan
- SSH, Git and Composer on the developer-focused plans
- phpMyAdmin and per-site PHP settings from the control panel
- Email addresses that run on your own domain name
- Browser webmail plus IMAP, POP and SMTP for any mail app
- Spam and virus screening on every mailbox as standard
- Daily backups, with self-service restores you run from the panel
- WordPress and 400+ other applications installed in one click
- cPanel — the control panel most of the industry already runs
- Human support on duty every hour of every day
- Zero setup charges — there is no joining fee, ever
Frequently Asked
What people ask us most often
Which route is quickest if I still have a terminal?
WP-CLI, by a wide margin. One `wp user update` line, correctly hashed, with no browser session and no clipboard involved. phpMyAdmin is the fallback when SSH is not on the plan, and the email link is the fallback to the fallback — fine when mail works, useless when it is mail that is broken.
Is writing an MD5 hash into wp_users a security problem?
Not as a one-off. WordPress recognises the legacy hash at the next successful login and immediately re-stores the password with its own modern algorithm, so the weaker hash exists for a single sign-in. What would be a problem is leaving that password in place — replace it from a password manager once you are inside.
How quickly can a site be live here?
Minutes rather than days. The account activates as soon as payment clears, the domain — free for the first year on annual plans — connects immediately, and the one-click installer puts WordPress or any of 240+ applications in place straight away. Already hosted elsewhere? Send the details and we migrate it free, normally within a day.
Are backups something I can restore myself?
Yes. Every plan takes a daily backup and the restore runs from your panel in minutes — files, databases or both, at three in the morning, with no queue in front of you. Keeping an extra copy off the platform is still a sound habit, and nothing here stops you.
Keep reading
How to Install WordPress
A live WordPress install answering on your domain inside ten minutes, with the PHP version set before the first request — beginner, about 10 minutes.
How to Create a WordPress Child Theme
Customise a theme so the next update rolls straight through without erasing your work — intermediate, roughly 30 minutes.
WordPress (Glossary)
One term, defined precisely, with the detail that matters when you are debugging rather than browsing.
Drupal Hosting
Drupal with Composer, Drush and per-site PHP control available on tap.
VPS Hosting
KVM virtual servers — root access, DDoS filtering and one flat monthly price.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Host it where SSH is on the plan.
SSH, Git and Composer on developer plans, phpMyAdmin in the panel, daily backups and mailboxes on your own domain — with support that answers at any hour.
View Drupal Hosting plans