Ways to recover or change a WordPress user's password

If you have forgotten a WordPress user's password, you can reset it. WordPress stores a hash, not a recoverable copy of the original password. Before you start, identify the correct installation and user.

The WordPress password is separate from cPanel and the client area. Changing either of those does not automatically restore access to wp-admin.

Use the methods in this order: the reset link, WordPress Toolkit or Softaculous, and WP-CLI. Editing the database directly should be kept only as an emergency procedure.

Recover the password with "Lost your password?"

On the login screen, click Lost your password? and enter the associated username or email address. If the website can send email and you can access the address, you will receive a link to set the new password. Check your Spam folder too.

The problem is that this is sometimes no use, whether because you have forgotten the username, the email address is no longer in use or the confirmation email simply does not arrive. That is why the other methods covered below are more useful.

Change the password with Softaculous

Log in to the hosting service's cPanel, go to the Softaculous App Installer section and, at the top, click the WordPress icon to show the list of installations.

If your website does not appear in the list of installations, click Scan in that same section and Softaculous will find and add them automatically.

Then use the Manage users option next to the WordPress installation whose password you want to recover.

A form appears. Select the WordPress user you want from the drop-down, enter the new password under password and click Save. That's it: you can now log in with the username and password you have given.

Change the password with WordPress Toolkit

For this recovery method, log in to cPanel and go to the WordPress Toolkit section.

A list of installations appears. Click the one you want to expand all its options.

If your website does not appear in the list of installations, click Scan in that same section and WordPress Toolkit will find and add them automatically.

Find the Setup option, just below the website's screenshot.

A form opens in which you can select the WordPress user whose password will be changed, with fields to change the password and even the contact email address.

Change the password with WP-CLI

If you have SSH access, run WP-CLI from the installation's directory. Generate a random, unique password in a password manager, avoid typing it in a shared session and replace USUARIO:

wp user update USUARIO --prompt=user_pass

WP-CLI will ask for the value without including it in the command history, and WordPress will store it with its current hashing system.

Change the password with phpMyAdmin

Log in to cPanel and go to the phpMyAdmin section.

Once inside this tool, open the WordPress database. You can check its name by opening WordPress's wp-config.php file, where it appears like this:

define('DB_NAME', 'nombre_base_de_datos');

Find the wp_users table, which may also appear with a different prefix followed by _users. You can check the prefix in the same wp-config.php file:

$table_prefix  = 'prefijo_';

Click Edit on the row of the exact user. First keep a backup of the database and change only the fields indicated.

Editing with MD5 should only be used if the previous methods are not available and you need emergency access. Generate a random, unique, single-use password, edit the user_pass field and select MD5 only for this recovery.

Save and log in immediately: WordPress will replace that old hash with the current algorithm when you log in. Then check that the value is no longer in MD5 format and change the password again to a final, unique, generated one, logging out the user's other sessions. Do not reuse the emergency password or keep it as your usual password.

If changing the password does not restore access

Check the login URL and whether a security plugin, an IP restriction, 2FA or external authentication is involved. Those controls can still block a correct password. Do not keep making blind changes to the database.

If you do not recognise the administrator's email address or unknown users appear, treat the case as a possible intrusion: keep evidence and review users, sessions, plugins and files, as well as recovering access. Also check that the recovered user has the role it needs; changing its password does not grant it extra permissions.