When a WordPress password reset is not working, the failure usually happens at one of three points: WordPress cannot find the account, the reset email never arrives, or the reset link does not work. Use the steps below in order so you fix the actual cause without weakening site security.
Confirm the Username or Email Address
Open the standard WordPress lost-password page at /wp-login.php?action=lostpassword. Enter the email address or username attached to the account. A typo, old email address, or duplicate-looking username can make it seem like password recovery is broken.
If you can access the dashboard with another administrator account, go to Users and confirm the affected user’s email address and role.
Check Spam and Email Delivery
Password resets depend on WordPress email. Check spam, junk, quarantine, and any security gateway used by the recipient. Search for messages from the site’s WordPress sender address and verify that the mailbox is not full.
If other website emails are also missing, the problem is probably mail delivery rather than password recovery. Follow my guide to fix WordPress not sending emails. An authenticated SMTP or transactional email service is usually more reliable than the server’s default PHP mail function.
Check the Reset Link Carefully
WordPress reset links contain a temporary key. Request a fresh email and use only the newest link. Older links may expire as soon as another reset is requested. Email security software can also rewrite, scan, or split the URL.
- Copy the entire URL into a private browser window.
- Make sure the link contains both the login name and reset key.
- Request one new reset and ignore all earlier messages.
- Avoid repeatedly clicking the link in different browsers.
Verify the WordPress Address and Site Address
Incorrect URLs under Settings > General can send password-reset links to the wrong domain, protocol, or subdirectory. Both addresses should match the intended live site unless the installation is intentionally configured differently.
This issue often appears after a migration, staging push, HTTPS change, or domain replacement. Check WP_HOME and WP_SITEURL in wp-config.php if the dashboard fields are locked.
Clear Caches and Security Rules
Clear browser, plugin, server, CDN, and object caches. Exclude WordPress login and password-reset URLs from page caching. A cached login response or aggressive security rule can invalidate the process.
Temporarily disable recently changed security, login, CAPTCHA, membership, and redirection plugins on staging. Also review firewall logs for blocked requests to wp-login.php.
Rule Out a Plugin or Theme Conflict
A plugin can replace the login form, customize email messages, or change authentication hooks. Disable plugins on a staging copy, test the standard WordPress reset page, and reactivate plugins one at a time. If needed, temporarily switch to a default theme.
If the login sends users back to the same screen, use my WordPress login redirect loop guide. If sessions end immediately after login, see how to fix WordPress repeatedly logging users out.
Reset the Password Through WP-CLI
If you have SSH and WP-CLI access, an administrator can assign a new password without relying on email:
wp user update USERNAME --user_pass='NEW-STRONG-PASSWORD'
Replace the placeholders with the correct username and a unique password. Avoid exposing the password in screenshots, tickets, or shared command history. Sign in, then change it again if another person handled the recovery.
Use the Hosting Panel or Database as a Last Resort
Some managed hosts provide an administrator password reset tool. Use the host’s official account controls when available. Direct database editing should be the last option and requires a current backup.
If you must update the user through phpMyAdmin, identify the correct WordPress database and users table first. Never change another user’s record or assume the table prefix is wp_. WordPress will securely rehash a temporary compatible password after the next successful login.
Check for a Compromised Account
An unexpected email or username change may indicate unauthorized access. Review administrator users, recent activity logs, security alerts, active sessions, and file changes. Rotate hosting, WordPress, database, SFTP, and email credentials if compromise is suspected. Update WordPress, themes, and plugins after preserving evidence and creating a backup.
Fast Troubleshooting Order
- Confirm the correct username and email.
- Request one fresh reset and check spam.
- Test general WordPress email delivery.
- Verify the site URLs and clear caches.
- Check security and login plugin conflicts.
- Use WP-CLI or the host’s recovery tool if necessary.
Prevent Future Password Reset Problems
Use authenticated email delivery, monitor failed email logs, keep administrator email addresses current, and maintain more than one trusted administrator account. Do not share accounts. Each administrator should have a unique login, strong password, and multifactor authentication where supported.
For more common fixes, visit my WordPress SEO troubleshooting hub.
