If you your Forgot WordPress admin password If you have and normal password recovery did not work, you can reset a WordPress user's password directly via the database. With CURIAWEB hosting, you have phpMyAdmin available via cPanel.
This method is particularly helpful if you no longer have access to the email address associated with the WordPress user or if WordPress cannot deliver a password reset email. However, you will need access to your hosting or cPanel and must identify the correct database for your WordPress installation.
Since you are accessing the WordPress database directly with phpMyAdmin, you should proceed with caution. An incorrect change can affect the website or individual functions. In this guide, we will therefore only change the entry relevant to the user password.
Briefly explained: Open in cPanel phpMyAdmin, select the database of your WordPress installation and open the users table. Edit the desired user and set for
user passworda new password using the functionMD5. After the first successful login, WordPress processes the password further using its current password hashing method.
When should you change the WordPress password via phpMyAdmin? #
Making the change via phpMyAdmin is an alternative recovery method. It should not be the normal way if the built-in WordPress password recovery works.
Use phpMyAdmin, for example, when:
- you no longer have access to the registered email address
- the password recovery email does not arrive
- WordPress mail sending does not work
- you cannot reset the user via normal recovery
- you still have access to cPanel and the WordPress database
If you can reach the stored email address, you should first use the standard WordPress function „Forgot password?“ use.
We explain the regular way in detail in our manual Forgot WordPress password: Recover admin access.
What is phpMyAdmin? #
phpMyAdmin is a web-based management interface for MySQL or MariaDB databases. WordPress stores a large portion of its data not in files, but in a database.
This includes, for example:
- Posts and pages
- Comments
- User accounts
- Website settings
- Plugin settings
- Theme-related settings
- Metadata
With phpMyAdmin, you can view and edit this database directly. Exactly for this reason, the tool is powerful, but also risky if operated incorrectly.
Important: Changes in phpMyAdmin affect the database directly. There is no normal WordPress trash for accidentally deleted or overwritten database values. Therefore, only work on the entries described in this guide.
Create a backup before making changes #
Before making changes directly to a production WordPress database, you should ensure that a recent backup is available.
Although changing a password only modifies a single database value, a backup is still advisable because accidentally interfering with the wrong table or database can have more severe consequences.
When dealing with multiple WordPress installations in the same hosting environment, special attention is required. Make sure you are actually working with the database of the affected website.
Step 1: Log in to cPanel #
First, log in to your CURIAWEB hosting or into cPanel one.
If you no longer know your cPanel password, you can reset the main cPanel account password via the CURIAWEB customer center. The WordPress password and the cPanel password are independent of each other.
After logging into cPanel, you look for the databases section and open phpMyAdmin.
Step 2: Open phpMyAdmin #
Click in cPanel on phpMyAdmin. The database management is then opened.
On the left side you will normally see the available databases. If your hosting contains only a single WordPress website, the mapping may be straightforward. However, with multiple websites or applications, there may be several databases.
Do not just pick any database at random.
How do I find the right WordPress database? #
If you are not sure which database belongs to your WordPress installation, you can find the database name in the file:
wp-config.php
This file is typically located in the root directory of your WordPress installation.
You can, for example, via the File Manager in cPanel open. Search it for the entry for DB_NAME.
He looks roughly like this:
define( 'DB_NAME', 'database_name' );
The value at DB_NAME is the database name that WordPress uses for this installation.
Attention: The file
wp-config.phpcontains sensitive access credentials and configuration values. Never publish its content and do not change any values there if you only want to look up the database name.
Step 3: Select correct WordPress database #
Switch back to phpMyAdmin and select the database on the left side that you via DB_NAME identified.
After opening, phpMyAdmin displays the tables of this database.
In a WordPress installation, you typically find tables like:
wp_posts
wp_options
wp_users
wp_usermeta
However, the table prefix does not have to wp_ loud.
Why is the user table not always named wp_users? #
WordPress uses a so-called for its database tables table prefix. In a standard installation, this is often:
wp_
The user table is then called:
wp_users
However, the prefix may have been changed during installation. The table could therefore also be named, for example:
abc_users
or:
cw1_users
What is crucial is not the prefix, but the table name with the ending:
_users
You can also find the actually used table prefix in the file wp-config.php identify. There you will find an entry like:
$table_prefix = 'wp_';
Step 4: Open WordPress user table #
Open in phpMyAdmin the table that points to _users ends.
For an installation with the standard prefix, that would be:
wp_users
Then select the view in phpMyAdmin „View“ or rather „Browse“, if the data records are not already displayed.
Now you should see the users present in this WordPress installation.
How do I identify the correct WordPress user? #
There are several columns in the user table. The following fields are particularly helpful for identifying the correct account:
ID- internal user IDuser login– WordPress usernameuser_email– registered email addressdisplay_name– Public display name
Carefully check which user account you want to change.
If there are multiple users, do not simply change the first entry in the table.
Important: The table
_usersdoes not directly indicate whether a user is an administrator, editor, or author. The WordPress roles and permissions are stored in the associated_usermeta-Table saved. Therefore, identify the account using username and email address, or additionally check the user role if necessary.
Step 5: Edit user in phpMyAdmin #
Once you have clearly identified the correct user, click on the corresponding record „Edit“.
phpMyAdmin now shows you the individual fields of this user.
Look for the field:
user password
There is the stored password hash of the WordPress user.
The existing value does not look like your normal password. This is correct and as it should be.
Why can't I read the existing WordPress password? #
WordPress does not store user passwords as plain text. Instead, it uses a cryptographic process to turn the password into a Password hash generated and saved in the database.
That means: You cannot simply remove the existing password from the field user password deduce.
Therefore, if the password is forgotten, a new password set. The old password will not be made visible again.
Step 6: Set new password with MD5 #
For manual restoration via phpMyAdmin, WordPress continues to support the option to initially set a new password as MD5 hash in user password to save.
Change password in phpMyAdmin #
- Search for the line in the selected user
user password. - Select in the column „Function“ the entry
MD5. - Delete the existing password hash in the value field.
- Enter your desired new password in plain text one.
- Check again whether you are editing the correct user.
- Save the change using the corresponding button in phpMyAdmin.
phpMyAdmin applies the selected function upon saving MD5 to your entered password. As a result, the entered plaintext password is not stored in the database, but rather its MD5 value.
Isn't MD5 outdated for WordPress passwords? #
Yes. MD5 alone is not a modern method for securely storing passwords and should not be used as a permanent password hashing method.
The process described here is a WordPress-supported Recovery method. WordPress can recognize an MD5 password value set in this way upon login.
If you subsequently log in successfully with the new password, the WordPress password hash will be regenerated using the currently used stronger password hashing algorithm and saved in the database.
Important: We do not use MD5 here as a recommendation for password storage. It is used exclusively to pass a new known password to WordPress via the database for recovery purposes. After a successful login, WordPress updates the stored hash.
Step 7: Log in to WordPress #
After saving the change, open the WordPress login page.
In a standard installation, you can find them under:
or:
Log in with the previously identified username or the permitted login ID and the new password you just set.
If the login works, WordPress access is restored.
Change the password again after a successful login? #
That is not strictly necessary if you have already set a strong and unique password via phpMyAdmin and WordPress has re-hashed it upon successful login.
You can still change the password directly in the WordPress dashboard if you used only a temporary recovery password via phpMyAdmin, for example.
To do this, open your WordPress profile and set a strong, permanent password there.
We explain how to change your password normally in the dashboard in detail at Change WordPress password: Securely update admin password in dashboard.
What is a good temporary recovery password? #
Even a temporary password should not simply admin123, password or be the name of your website.
A weak password can pose an unnecessary risk even during the short time until the next change.
Therefore, use a long, random, and unique password for the recovery as well.
The easiest way to generate and save this is with a password manager.
Password changed, but login still doesn't work #
If the login still fails after the change, you should not immediately modify any more database values.
First check the most common causes:
- Did you edit the correct WordPress database?
- Did you select the correct user?
- Did you actually [have/make] the field
user passwordchanged? - Was the function active during saving
MD5selected? - Do you use the newly set password when logging in?
- Does your browser or password manager automatically fill in an old password?
- Are you trying to log into the correct WordPress installation?
Test the login in a private or incognito browser window if necessary, so that no old login credentials are automatically filled in.
Multiple WordPress installations in the same hosting #
If multiple WordPress websites are hosted in your account, the correct assignment of the database is particularly important.
Each independent WordPress installation can use its own database. It is also technically possible for multiple installations to use tables within the same database with different prefixes.
Therefore, do not rely solely on the name of a database. In case of doubt, check both:
DB_NAMEin the respectivewp-config.php$table_prefixin the same file
This allows you to identify both the correct database and the correct WordPress tables.
What to do if the wp_users table does not exist? #
If you don't have a table named wp_users you find, doesn't that automatically mean that something is missing.
Very likely, your installation uses a different table prefix.
Looking for a table based on:
_users
ends and compares the prefix with the entry $table_prefix in your wp-config.php.
Do not simply edit a similarly named user table if multiple WordPress installations use the same database.
How do I know if the user is really an administrator? #
The actual user role is not directly in the field user password or in the _users-Table saved.
WordPress stores role information in the table:
wp_usermeta
or correspondingly for another prefix:
deinpraefix_usermeta
The mapping is done via the user ID. You do not need to modify this table for a normal password reset.
If you merely want to reset the password of a known administrator, leave the role information unchanged.
Do not do: Do not change values on suspicion in
_usermeta, to grant a user administrator rights. This is neither necessary nor sensible for a normal password reset.
Do not simply adopt an unknown administrator #
If you discover an unknown administrator account while searching for your user, you should not simply use it or just change its password.
An unknown administrator can have various causes. The account may belong to an employee, developer, or a former agency. However, it can also be an indication of unauthorized access.
Check first to whom the account belongs.
We explain how to properly manage WordPress users, roles, and permissions in our guide Managing WordPress users: Properly setting up accounts, roles, and permissions.
What to do if you suspect a hacked WordPress account? #
If you are not resetting your password because you forgot it, but rather because you suspect unauthorized access, simply changing the password might not be enough.
For example, an attacker with administrator privileges could:
- have created additional user accounts
- installed or modified plugins
- manipulated theme files
- have set up redirects
- have injected malicious code into files or database contents
In such a case, you should treat the website as a potential security incident and not merely replace the password.
Do not store WordPress password directly in plain text #
Never just enter a new password into user password and save it as plain text without the intended hash function.
WordPress does not expect a normal readable password value there.
For the recovery described in these instructions, you therefore explicitly select the following function in phpMyAdmin:
MD5
and enter the new password in the corresponding value field.
Do not use third-party online MD5 generators #
You don't need to convert your new password into an MD5 value on just any website.
We expressly advise against that.
When you enter a password on a third-party online service, you are revealing your password to that service. You cannot reliably determine whether the provider stores, logs, or otherwise processes it.
phpMyAdmin can apply the required MD5 function directly when saving. There is therefore no reason to transmit your new WordPress password to an external hash generator.
Safety rule: Never enter passwords into unknown online generators, password checkers, or hash websites. phpMyAdmin handles the necessary conversion locally on the server for this process.
Check WordPress email sending after restoration #
If you had to use phpMyAdmin because the password recovery email didn't arrive, you should fix the cause of this after successfully logging in.
Otherwise, the next time you forget your password, you might face the same problem again.
First, check whether the email address associated with the WordPress user is correct and reachable.
For more reliable delivery of WordPress system messages, a correctly configured SMTP sending method is also recommended.
CURIAWEB customers have access to this for GoSMTP PRO free We explain how to set it up in our manual Send WordPress emails via SMTP.
Check user and email address after restoration #
When you can log in again, open:
User → Profile
Check there in particular:
- the stored e-mail address
- your display name
- whether the new password is stored securely
- whether you have permanent access to the stored email address
As an administrator, you should additionally under Users → All Users verify whether all existing accounts are known and still required.
Why database access needs to be specially protected #
Access to phpMyAdmin enables much more than just resetting a WordPress password. Anyone who gains access to the database can view or modify numerous contents and settings of a website.
Therefore, also protect your cPanel access with a strong and unique password, and only share hosting credentials with individuals who actually need them.
WordPress users, cPanel, FTP, and other technical access should generally use separate passwords.
Why you won't find the password in wp-config.php #
It is occasionally assumed that the WordPress administrator password must be in wp-config.php to be. That is wrong.
The file contains access credentials for the WordPress database, not the normal WordPress user passwords.
There you will find, for example:
- Database name
- Database user
- database password
- Database server
- table prefix
These data have a different function and should not be modified to reset a WordPress user password.
Common mistakes during password reset via phpMyAdmin #
- selecting the wrong WordPress database
- ignore the table prefix
- edit the wrong user
- the field
user passwordconfuse with another field - save the new password without a hash function
- use an external online MD5 generator
- unnecessary values in
_usermetachange - update multiple database values simultaneously
- perform extensive changes without a backup
- after the restoration, ignore the cause of failed WordPress emails
Note: For a normal password reset via phpMyAdmin, you just need to identify the correct WordPress user and their
user passwordcorrectly reset. Do not change any other database values unless necessary for the recovery.
Summary #
If the normal WordPress password recovery does not work, you can reset a user's password with access to cPanel via phpMyAdmin reset.
First identify via DB_NAME in the wp-config.php the correct database and observe the one defined there $table_prefix. Then open the spreadsheet _users, select the correct user and edit the field user password. For the restoration, you can use the function in phpMyAdmin MD5 select and set a new password. After a successful login, WordPress updates the saved password hash using its current method.
If you still have access to the stored email address, you should first use the normal instead of phpMyAdmin WordPress password recovery use. After a successful login, you can change your password at any time regularly via the Change WordPress dashboard.
Then check your WordPress users and administrators. If you had to use phpMyAdmin because no recovery email arrived, you should also WordPress email sending via SMTP configure correctly.
