Add a WordPress Admin via the Database: WP-CLI, phpMyAdmin, mu-plugin

This article is a localized edition of the Japanese original. Read the Japanese original

If you cannot get into the WordPress admin because you do not know the administrator password, you deleted the administrator account by mistake, or an attacker took over and changed the permissions, you can add a new administrator user from the server side.

This article explains the three methods below. The SQL and behavior were checked on WordPress 6.9 and MySQL 8.0 (as of November 2026).

Back up the database before you start. You can use your hosting provider's backup feature or "Export" in phpMyAdmin.

Method 1: Create it with WP-CLI (when SSH is available)

Run this in the folder where WordPress is installed (where wp-config.php is).

wp user create new_admin admin@example.com --role=administrator

If you leave out --user_pass, a random password is generated and shown on the Password: line. This keeps the password out of your shell history, so it is the recommended way.

Check the list of administrators to confirm the user was created.

wp user list --role=administrator --fields=ID,user_login,user_email

• When running from another folder, point to the WordPress location, for example --path=/var/www/html.
• WP-CLI shows a warning and stops when run as root. Run it as the web server's user (for example sudo -u www-data wp user create ...), or, if you have a reason to run it as root, add --allow-root.
• If you only need to make an existing user an administrator again, change it with wp user set-role username administrator.

Method 2: Run SQL in phpMyAdmin

Step 1: Check the table prefix

WordPress table names have a prefix (wp_ by default). Check it on this line of wp-config.php.

$table_prefix = 'wp_';

You can also tell from the table list on the left side of phpMyAdmin, by whether names look like wp_users and wp_usermeta. The SQL below assumes the prefix is wp_.

Step 2: Run the SQL

In phpMyAdmin, select the WordPress database, paste all of the following into the "SQL" tab and run it. Replace the username, password and email address.

INSERT INTO wp_users
  (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
VALUES
  ('new_admin', MD5('temporary-password'), 'new_admin', 'admin@example.com', UTC_TIMESTAMP(), 0, 'new_admin');

SET @uid = LAST_INSERT_ID();

INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES
  (@uid, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}'),
  (@uid, 'wp_user_level', '10');

• LAST_INSERT_ID() returns the ID of the user just added, so you do not need to look up the ID and type it in. Send the three statements together in a single run (if you run them separately, @uid may not carry over).
• The wp_capabilities value a:1:{s:13:"administrator";b:1;} is data meaning "has the administrator role". s:13 is the number of characters in administrator, so do not change it.
• user_registered is stored in UTC, matching how WordPress records it.

Even if you set the password with MD5(), WordPress accepts this format. The first time you log in, it is re-saved using the current method (bcrypt in WordPress 6.8 and later). MD5 is not a secure format, so change the password right after logging in (see below).

If the prefix is not wp_

The prefix goes not only on the table names but also on the key names stored in wp_usermeta. For example, if the prefix is mysite_, it looks like this:

INSERT INTO mysite_users
  (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
VALUES
  ('new_admin', MD5('temporary-password'), 'new_admin', 'admin@example.com', UTC_TIMESTAMP(), 0, 'new_admin');

SET @uid = LAST_INSERT_ID();

INSERT INTO mysite_usermeta (user_id, meta_key, meta_value) VALUES
  (@uid, 'mysite_capabilities', 'a:1:{s:13:"administrator";b:1;}'),
  (@uid, 'mysite_user_level', '10');

If you leave the key name as wp_capabilities, the user is created but gets no permissions, and even after logging in the admin shows a message saying you do not have permission, so you cannot use it.

Method 3: Create it with a temporary mu-plugin (when you cannot touch the database)

Using FTP or a file manager, put the following file in the wp-content/mu-plugins/ folder (create the folder if it does not exist). PHP files in mu-plugins are loaded automatically without being activated.

Example file name: wp-content/mu-plugins/emergency-admin.php

<?php
// Create an emergency administrator once. Delete this file as soon as you can log in
add_action( 'init', function () {
    if ( username_exists( 'emergency_admin' ) ) {
        return;
    }
    $user_id = wp_create_user( 'emergency_admin', 'a-long-temporary-password-here', 'emergency@example.com' );
    if ( ! is_wp_error( $user_id ) ) {
        $user = new WP_User( $user_id );
        $user->set_role( 'administrator' );
    }
} );

After uploading the file, open the site once, then log in as emergency_admin at /wp-login.php. As soon as you can log in, delete this file. The password is written in the file in plain text.

• If the email address matches an existing user, the user is not created. Use an address that is not in use.
• If you put this code in wp-config.php, it runs before WordPress functions are loaded, so add_action() is undefined and the site stops displaying with an error. Do not put it in wp-config.php.

On Multisite

On Multisite, the information about network-wide administrators (Super Admins) is in a separate table, and keys such as wp_2_capabilities are used per site. The SQL above alone will not get you into the Network Admin. If WP-CLI is available, create the user and then make it a Super Admin with this command:

wp super-admin add new_admin

What to do right after you log in

1. In "Users" → "Profile", change the new account's password to a long one
2. If you used the mu-plugin, confirm that the file has been deleted
3. In "Users" → "All Users", check for administrators you do not recognize (especially if the lockout was caused by a takeover)
4. Once the original administrator account works again, delete the emergency account

When you delete the emergency account, decide what happens to the posts created with it. In WP-CLI, specify the user ID that keeps them with --reassign.

wp user list --role=administrator --fields=ID,user_login
wp user delete emergency_admin --reassign=1

The 1 in --reassign=1 is the ID of the user who takes over the posts. Specify a real ID that you confirmed in the list. When deleting from the admin screen, you can also choose the user to take over the content on the deletion confirmation screen.

For database operations with WP-CLI, see also WP-CLI database commands.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)