2026年11月12日

Reset a WordPress Password via FTP (Using wp_set_password)

This article is a localized edition of the Japanese original. Read the Japanese original

If you cannot log in to WordPress and the reset email from the "Lost your password?" link on the login screen never arrives, you can still change your password as long as you can edit the site's files over FTP (or SFTP, or your hosting company's file manager). The method temporarily runs the WordPress function wp_set_password().

This article explains the steps, how to clean up afterward, and other methods for when you have database or WP-CLI access. Before you start, back up the site's files and database.

Check these first

Try the email reset first: On the login screen, use "Lost your password?" and enter your username or email address to send a reset email. Check your spam folder as well. Use the method in this article if the email does not arrive, or if you can no longer receive mail at the registered address.
Do you know the username (login name)?: The steps below identify the user by username or email address. If you know neither, check the user_login column of the wp_users table in phpMyAdmin, described later.
Make sure it is your own site: Anyone who can modify the server's files can use this method. If you suspect the site was hijacked, changing the password is not enough (see "If you suspect a hijacked account" at the end).

Changing the password over FTP

The official WordPress documentation (Reset your password) describes adding wp_set_password( 'my_new_password', 1 ); at the top of the active theme's functions.php. However, that line sets the password again on every page load, so forgetting to remove it after you log in causes problems. Here, we use a file placed in mu-plugins instead: it does not touch your theme files and does nothing once the password has been changed.

Step 1: Create the temporary file

On your computer, create a file with the following content and save it as reset-password-once.php (UTF-8 encoding). Replace $login and $new_pass with your own values.

<?php
/**
 * Temporary password reset. Delete this file as soon as you can log in.
 */
add_action( 'init', function () {
	$login    = 'admin';                    // Username of the user whose password you are changing
	$new_pass = 'write-your-new-password-here'; // New password (long and hard to guess)

	$user = get_user_by( 'login', $login );
	// To look the user up by email address, use this line instead
	// $user = get_user_by( 'email', 'you@example.com' );

	if ( ! $user ) {
		return;
	}

	// Set the password only if it is not the new one yet
	if ( ! wp_check_password( $new_pass, $user->user_pass, $user->ID ) ) {
		wp_set_password( $new_pass, $user->ID );
	}
} );

wp_set_password() hashes the password the way WordPress does and saves it. The password is not stored in the database as plain text.
Because wp_check_password() first checks whether the new password is already set, the password is not reset again on every page load.
Changing the password ends that user's existing login sessions (including logins in other browsers).

Step 2: Upload it to the mu-plugins folder

In your FTP client or file manager, open WordPress's wp-content folder. If there is no mu-plugins folder inside it, create one, then upload reset-password-once.php into it.

wp-content/
  mu-plugins/
    reset-password-once.php

PHP files placed in the mu-plugins (Must Use plugins) folder are loaded automatically, without being activated in the admin area.

Step 3: Open the site, then log in

In your browser, open the site's home page or the login screen (/wp-login.php). The password changes at this point. Then log in with the username and the new password you wrote in step 1.

If you cannot log in, check the following:

Is the username in $login correct? (It must be the name used to log in, not the display name or nickname.)
Is the file directly inside wp-content/mu-plugins/? (Files in subfolders are not loaded.)
Does opening the site show a blank white screen because of a PHP syntax error? (If so, delete the file and write it again.)

Step 4: Delete the temporary file

As soon as you can log in, delete wp-content/mu-plugins/reset-password-once.php over FTP. The file contains the new password in plain text, so leaving it on the server is dangerous.

After deleting it, it is safer to change the password once more to a different one under "Profile" in "Users" in the admin area (Users → Profile). A password that passed through a file can leak through FTP traffic or the copy left on your computer. (FTP does not encrypt traffic, so use SFTP or FTPS if you can.)

On the same screen, also check that "Email" is an address you can receive mail at now, and correct it if needed. That way you can reset your password by email the next time you forget it.

Other methods (if you have database or SSH access)

Change it in phpMyAdmin

If you can use phpMyAdmin from your hosting control panel, edit the user's user_pass in the database's wp_users table (xxx_users if you changed the table prefix). Enter the new password, choose MD5 in the function column, and save. This method is also described in the official WordPress documentation; when you log in, WordPress saves the password again with its current hashing method.

Change it with WP-CLI

If you can use WP-CLI over SSH, run the following in the WordPress folder.

# List users
wp user list --fields=ID,user_login,user_email

# Generate a new password and display it (no email is sent)
wp user reset-password admin --skip-email --show-password

--show-password and --porcelain were added in WP-CLI 2.8.0. They do not work in older WP-CLI versions, so check your version with wp cli version. You can also change the password with wp user update admin --user_pass=NEW_PASSWORD, but the password stays in your shell history, so take care, for example by removing it from the history afterward.

If you suspect a hijacked account

If you were locked out by a password or email change you did not make, restoring the password is not enough. Also check the following:

Whether an unfamiliar administrator user has been added on the "Users" screen
Whether there are unfamiliar files in wp-content/mu-plugins/, wp-content/plugins/ or your theme folders
Change the authentication keys in wp-config.php (AUTH_KEY and the others) to new values to log out every user

Summary

If you cannot reset by email, put a temporary file that runs wp_set_password() in wp-content/mu-plugins/ over FTP, open the site, then log in
Checking with wp_check_password() before setting the password keeps it from being reset on every page load
Once you can log in, delete the temporary file right away and review your password and email address in the admin area
If phpMyAdmin (update user_pass with MD5) or WP-CLI (wp user reset-password) is available, you can use those instead

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)