{"id":22354,"date":"2026-08-27T16:00:28","date_gmt":"2026-08-27T14:00:28","guid":{"rendered":"https:\/\/www.curiaweb.ch\/?post_type=docs&#038;p=22354"},"modified":"2026-08-27T16:00:29","modified_gmt":"2026-08-27T14:00:29","password":"","slug":"change-wordpress-password-phpmyadmin","status":"publish","type":"docs","link":"https:\/\/www.curiaweb.ch\/en\/hilfe\/wordpress\/wordpress-passwort-phpmyadmin-aendern\/","title":{"rendered":"Change WordPress password via phpMyAdmin: Restore admin access via the database"},"content":{"rendered":"<p class=\"wp-block-paragraph\">If you your <strong>Forgot WordPress admin password<\/strong> If you have and normal password recovery did not work, you can reset a WordPress user's password directly via the database. With CURIAWEB hosting, you have <strong>phpMyAdmin<\/strong> available via cPanel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This method is particularly helpful if you no longer have access to the email address associated with the WordPress user or if WordPress cannot deliver a password reset email. However, you will need access to your hosting or cPanel and must identify the correct database for your WordPress installation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since you are accessing the WordPress database directly with phpMyAdmin, you should proceed with caution. An incorrect change can affect the website or individual functions. In this guide, we will therefore only change the entry relevant to the user password.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Briefly explained:<\/strong> Open in cPanel <strong>phpMyAdmin<\/strong>, select the database of your WordPress installation and open the users table. Edit the desired user and set for <code>user password<\/code> a new password using the function <code>MD5<\/code>. After the first successful login, WordPress processes the password further using its current password hashing method.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">When should you change the WordPress password via phpMyAdmin?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Making the change via phpMyAdmin is an alternative recovery method. It should not be the normal way if the built-in WordPress password recovery works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use phpMyAdmin, for example, when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>you no longer have access to the registered email address<\/li>\n\n\n\n<li>the password recovery email does not arrive<\/li>\n\n\n\n<li>WordPress mail sending does not work<\/li>\n\n\n\n<li>you cannot reset the user via normal recovery<\/li>\n\n\n\n<li>you still have access to cPanel and the WordPress database<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you can reach the stored email address, you should first use the standard WordPress function <strong>\u201eForgot password?\u201c<\/strong> use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain the regular way in detail in our manual <a href=\"\/en\/help\/wordpress\/recover-wordpress-admin-password\/\">Forgot WordPress password: Recover admin access<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is phpMyAdmin?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>phpMyAdmin<\/strong> is a web-based management interface for MySQL or MariaDB databases. WordPress stores a large portion of its data not in files, but in a database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This includes, for example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Posts and pages<\/li>\n\n\n\n<li>Comments<\/li>\n\n\n\n<li>User accounts<\/li>\n\n\n\n<li>Website settings<\/li>\n\n\n\n<li>Plugin settings<\/li>\n\n\n\n<li>Theme-related settings<\/li>\n\n\n\n<li>Metadata<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">With phpMyAdmin, you can view and edit this database directly. Exactly for this reason, the tool is powerful, but also risky if operated incorrectly.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> Changes in phpMyAdmin affect the database directly. There is no normal WordPress trash for accidentally deleted or overwritten database values. Therefore, only work on the entries described in this guide.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Create a backup before making changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before making changes directly to a production WordPress database, you should ensure that a recent backup is available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although changing a password only modifies a single database value, a backup is still advisable because accidentally interfering with the wrong table or database can have more severe consequences.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When dealing with multiple WordPress installations in the same hosting environment, special attention is required. Make sure you are actually working with the database of the affected website.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Log in to cPanel<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First, log in to your CURIAWEB hosting or into <strong>cPanel<\/strong> one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you no longer know your cPanel password, you can reset the main cPanel account password via the CURIAWEB customer center. The WordPress password and the cPanel password are independent of each other.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After logging into cPanel, you look for the databases section and open <strong>phpMyAdmin<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Open phpMyAdmin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click in cPanel on <strong>phpMyAdmin<\/strong>. The database management is then opened.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the left side you will normally see the available databases. If your hosting contains only a single WordPress website, the mapping may be straightforward. However, with multiple websites or applications, there may be several databases.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not just pick any database at random.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How do I find the right WordPress database?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure which database belongs to your WordPress installation, you can find the database name in the file:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp-config.php<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This file is typically located in the root directory of your WordPress installation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can, for example, via the <strong>File Manager in cPanel<\/strong> open. Search it for the entry for <code>DB_NAME<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He looks roughly like this:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>define( 'DB_NAME', 'database_name' );<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The value at <code>DB_NAME<\/code> is the database name that WordPress uses for this installation.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Attention:<\/strong> The file <code>wp-config.php<\/code> contains sensitive access credentials and configuration values. Never publish its content and do not change any values there if you only want to look up the database name.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Select correct WordPress database<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Switch back to phpMyAdmin and select the database on the left side that you via <code>DB_NAME<\/code> identified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After opening, phpMyAdmin displays the tables of this database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a WordPress installation, you typically find tables like:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_posts<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_options<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_usermeta<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the table prefix does not have to <code>wp_<\/code> loud.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why is the user table not always named wp_users?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress uses a so-called for its database tables <strong>table prefix<\/strong>. In a standard installation, this is often:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The user table is then called:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the prefix may have been changed during installation. The table could therefore also be named, for example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>abc_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>cw1_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What is crucial is not the prefix, but the table name with the ending:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also find the actually used table prefix in the file <code>wp-config.php<\/code> identify. There you will find an entry like:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>$table_prefix = &#x27;wp_&#x27;;<\/code><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Open WordPress user table<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open in phpMyAdmin the table that points to <code>_users<\/code> ends.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an installation with the standard prefix, that would be:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then select the view in phpMyAdmin <strong>\u201eView\u201c<\/strong> or rather <strong>\u201eBrowse\u201c<\/strong>, if the data records are not already displayed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now you should see the users present in this WordPress installation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How do I identify the correct WordPress user?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are several columns in the user table. The following fields are particularly helpful for identifying the correct account:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>ID<\/code> - internal user ID<\/li>\n\n\n\n<li><code>user login<\/code> \u2013 WordPress username<\/li>\n\n\n\n<li><code>user_email<\/code> \u2013 registered email address<\/li>\n\n\n\n<li><code>display_name<\/code> \u2013 Public display name<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Carefully check which user account you want to change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If there are multiple users, do not simply change the first entry in the table.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> The table <code>_users<\/code> does not directly indicate whether a user is an administrator, editor, or author. The WordPress roles and permissions are stored in the associated <code>_usermeta<\/code>-Table saved. Therefore, identify the account using username and email address, or additionally check the user role if necessary.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Edit user in phpMyAdmin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have clearly identified the correct user, click on the corresponding record <strong>\u201eEdit\u201c<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">phpMyAdmin now shows you the individual fields of this user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the field:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>user password<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is the stored password hash of the WordPress user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The existing value does not look like your normal password. This is correct and as it should be.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why can't I read the existing WordPress password?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress does not store user passwords as plain text. Instead, it uses a cryptographic process to turn the password into a <strong>Password hash<\/strong> generated and saved in the database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That means: You cannot simply remove the existing password from the field <code>user password<\/code> deduce.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, if the password is forgotten, a <strong>new password set<\/strong>. The old password will not be made visible again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Set new password with MD5<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For manual restoration via phpMyAdmin, WordPress continues to support the option to initially set a new password as <strong>MD5 hash<\/strong> in <code>user password<\/code> to save.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Change password in phpMyAdmin<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Search for the line in the selected user <code>user password<\/code>.<\/li>\n\n\n\n<li>Select in the column <strong>\u201eFunction\u201c<\/strong> the entry <code>MD5<\/code>.<\/li>\n\n\n\n<li>Delete the existing password hash in the value field.<\/li>\n\n\n\n<li>Enter your desired <strong>new password in plain text<\/strong> one.<\/li>\n\n\n\n<li>Check again whether you are editing the correct user.<\/li>\n\n\n\n<li>Save the change using the corresponding button in phpMyAdmin.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">phpMyAdmin applies the selected function upon saving <code>MD5<\/code> to your entered password. As a result, the entered plaintext password is not stored in the database, but rather its MD5 value.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Isn't MD5 outdated for WordPress passwords?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. <strong>MD5 alone is not a modern method for securely storing passwords<\/strong> and should not be used as a permanent password hashing method.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The process described here is a WordPress-supported <strong>Recovery method<\/strong>. WordPress can recognize an MD5 password value set in this way upon login.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you subsequently log in successfully with the new password, the WordPress password hash will be regenerated using the currently used stronger password hashing algorithm and saved in the database.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> We do not use MD5 here as a recommendation for password storage. It is used exclusively to pass a new known password to WordPress via the database for recovery purposes. After a successful login, WordPress updates the stored hash.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Log in to WordPress<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After saving the change, open the WordPress login page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a standard installation, you can find them under:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/deine-domain.ch\/wp-login.php\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/deine-domain.ch\/wp-admin\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Log in with the previously identified username or the permitted login ID and the new password you just set.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the login works, WordPress access is restored.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Change the password again after a successful login?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">That is not strictly necessary if you have already set a strong and unique password via phpMyAdmin and WordPress has re-hashed it upon successful login.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can still change the password directly in the WordPress dashboard if you used only a temporary recovery password via phpMyAdmin, for example.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, open your WordPress profile and set a strong, permanent password there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain how to change your password normally in the dashboard in detail at <a href=\"\/en\/help\/wordpress\/change-wordpress-admin-password\/\">Change WordPress password: Securely update admin password in dashboard<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is a good temporary recovery password?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Even a temporary password should not simply <code>admin123<\/code>, <code>password<\/code> or be the name of your website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A weak password can pose an unnecessary risk even during the short time until the next change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, use a long, random, and unique password for the recovery as well.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The easiest way to generate and save this is with a password manager.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Password changed, but login still doesn't work<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the login still fails after the change, you should not immediately modify any more database values.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First check the most common causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Did you edit the correct WordPress database?<\/li>\n\n\n\n<li>Did you select the correct user?<\/li>\n\n\n\n<li>Did you actually [have\/make] the field <code>user password<\/code> changed?<\/li>\n\n\n\n<li>Was the function active during saving <code>MD5<\/code> selected?<\/li>\n\n\n\n<li>Do you use the newly set password when logging in?<\/li>\n\n\n\n<li>Does your browser or password manager automatically fill in an old password?<\/li>\n\n\n\n<li>Are you trying to log into the correct WordPress installation?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Test the login in a private or incognito browser window if necessary, so that no old login credentials are automatically filled in.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Multiple WordPress installations in the same hosting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If multiple WordPress websites are hosted in your account, the correct assignment of the database is particularly important.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each independent WordPress installation can use its own database. It is also technically possible for multiple installations to use tables within the same database with different prefixes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, do not rely solely on the name of a database. In case of doubt, check both:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>DB_NAME<\/code> in the respective <code>wp-config.php<\/code><\/li>\n\n\n\n<li><code>$table_prefix<\/code> in the same file<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This allows you to identify both the correct database and the correct WordPress tables.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do if the wp_users table does not exist?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you don't have a table named <code>wp_users<\/code> you find, doesn't that automatically mean that something is missing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Very likely, your installation uses a different table prefix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Looking for a table based on:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>_users<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ends and compares the prefix with the entry <code>$table_prefix<\/code> in your <code>wp-config.php<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not simply edit a similarly named user table if multiple WordPress installations use the same database.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How do I know if the user is really an administrator?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The actual user role is not directly in the field <code>user password<\/code> or in the <code>_users<\/code>-Table saved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress stores role information in the table:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp_usermeta<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">or correspondingly for another prefix:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>deinpraefix_usermeta<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The mapping is done via the user ID. You do not need to modify this table for a normal password reset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you merely want to reset the password of a known administrator, leave the role information unchanged.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Do not do:<\/strong> Do not change values on suspicion in <code>_usermeta<\/code>, to grant a user administrator rights. This is neither necessary nor sensible for a normal password reset.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Do not simply adopt an unknown administrator<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you discover an unknown administrator account while searching for your user, you should not simply use it or just change its password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An unknown administrator can have various causes. The account may belong to an employee, developer, or a former agency. However, it can also be an indication of unauthorized access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check first to whom the account belongs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain how to properly manage WordPress users, roles, and permissions in our guide <a href=\"\/en\/help\/wordpress\/manage-wordpress-users\/\">Managing WordPress users: Properly setting up accounts, roles, and permissions<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do if you suspect a hacked WordPress account?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not resetting your password because you forgot it, but rather because you suspect unauthorized access, simply changing the password might not be enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, an attacker with administrator privileges could:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>have created additional user accounts<\/li>\n\n\n\n<li>installed or modified plugins<\/li>\n\n\n\n<li>manipulated theme files<\/li>\n\n\n\n<li>have set up redirects<\/li>\n\n\n\n<li>have injected malicious code into files or database contents<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In such a case, you should treat the website as a potential security incident and not merely replace the password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not store WordPress password directly in plain text<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Never just enter a new password into <code>user password<\/code> and save it as plain text without the intended hash function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress does not expect a normal readable password value there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the recovery described in these instructions, you therefore explicitly select the following function in phpMyAdmin:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>MD5<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">and enter the new password in the corresponding value field.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not use third-party online MD5 generators<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You don't need to convert your new password into an MD5 value on just any website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We expressly advise against that.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When you enter a password on a third-party online service, you are revealing your password to that service. You cannot reliably determine whether the provider stores, logs, or otherwise processes it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">phpMyAdmin can apply the required MD5 function directly when saving. There is therefore no reason to transmit your new WordPress password to an external hash generator.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Safety rule:<\/strong> Never enter passwords into unknown online generators, password checkers, or hash websites. phpMyAdmin handles the necessary conversion locally on the server for this process.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Check WordPress email sending after restoration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you had to use phpMyAdmin because the password recovery email didn't arrive, you should fix the cause of this after successfully logging in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Otherwise, the next time you forget your password, you might face the same problem again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, check whether the email address associated with the WordPress user is correct and reachable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more reliable delivery of WordPress system messages, a correctly configured SMTP sending method is also recommended.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CURIAWEB customers have access to this for <strong>GoSMTP PRO free<\/strong> We explain how to set it up in our manual <a href=\"\/en\/help\/wordpress\/how-to-set-up-wordpress-smtp\/\">Send WordPress emails via SMTP<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check user and email address after restoration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When you can log in again, open:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>User \u2192 Profile<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check there in particular:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>the stored e-mail address<\/li>\n\n\n\n<li>your display name<\/li>\n\n\n\n<li>whether the new password is stored securely<\/li>\n\n\n\n<li>whether you have permanent access to the stored email address<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As an administrator, you should additionally under <strong>Users \u2192 All Users<\/strong> verify whether all existing accounts are known and still required.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why database access needs to be specially protected<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Access to phpMyAdmin enables much more than just resetting a WordPress password. Anyone who gains access to the database can view or modify numerous contents and settings of a website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, also protect your cPanel access with a strong and unique password, and only share hosting credentials with individuals who actually need them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress users, cPanel, FTP, and other technical access should generally use separate passwords.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why you won't find the password in wp-config.php<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is occasionally assumed that the WordPress administrator password must be in <code>wp-config.php<\/code> to be. That is wrong.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The file contains access credentials for the <strong>WordPress database<\/strong>, not the normal WordPress user passwords.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There you will find, for example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Database name<\/li>\n\n\n\n<li>Database user<\/li>\n\n\n\n<li>database password<\/li>\n\n\n\n<li>Database server<\/li>\n\n\n\n<li>table prefix<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These data have a different function and should not be modified to reset a WordPress user password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common mistakes during password reset via phpMyAdmin<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>selecting the wrong WordPress database<\/li>\n\n\n\n<li>ignore the table prefix<\/li>\n\n\n\n<li>edit the wrong user<\/li>\n\n\n\n<li>the field <code>user password<\/code> confuse with another field<\/li>\n\n\n\n<li>save the new password without a hash function<\/li>\n\n\n\n<li>use an external online MD5 generator<\/li>\n\n\n\n<li>unnecessary values in <code>_usermeta<\/code> change<\/li>\n\n\n\n<li>update multiple database values simultaneously<\/li>\n\n\n\n<li>perform extensive changes without a backup<\/li>\n\n\n\n<li>after the restoration, ignore the cause of failed WordPress emails<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong> For a normal password reset via phpMyAdmin, you just need to identify the correct WordPress user and their <code>user password<\/code> correctly reset. Do not change any other database values unless necessary for the recovery.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the normal WordPress password recovery does not work, you can reset a user's password with access to cPanel via <strong>phpMyAdmin<\/strong> reset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First identify via <code>DB_NAME<\/code> in the <code>wp-config.php<\/code> the correct database and observe the one defined there <code>$table_prefix<\/code>. Then open the spreadsheet <code>_users<\/code>, select the correct user and edit the field <code>user password<\/code>. For the restoration, you can use the function in phpMyAdmin <code>MD5<\/code> select and set a new password. After a successful login, WordPress updates the saved password hash using its current method.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you still have access to the stored email address, you should first use the normal instead of phpMyAdmin <a href=\"\/en\/help\/wordpress\/recover-wordpress-admin-password\/\">WordPress password recovery<\/a> use. After a successful login, you can change your password at any time regularly via the <a href=\"\/en\/help\/wordpress\/change-wordpress-admin-password\/\">Change WordPress dashboard<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then check your <a href=\"\/en\/help\/wordpress\/manage-wordpress-users\/\">WordPress users and administrators<\/a>. If you had to use phpMyAdmin because no recovery email arrived, you should also <a href=\"\/en\/help\/wordpress\/how-to-set-up-wordpress-smtp\/\">WordPress email sending via SMTP<\/a> configure correctly.<\/p>","protected":false},"excerpt":{"rendered":"<p>Wenn du dein WordPress-Admin-Passwort vergessen hast und die normale Passwort-Wiederherstellung nicht funktioniert, kannst du das Passwort eines WordPress-Benutzers direkt \u00fcber die Datenbank neu setzen. Bei einem CURIAWEB Hosting steht dir daf\u00fcr phpMyAdmin \u00fcber cPanel zur Verf\u00fcgung. Diese Methode ist besonders hilfreich, wenn du keinen Zugriff mehr auf die beim WordPress-Benutzer hinterlegte E-Mail-Adresse hast oder WordPress [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_joinchat":[],"footnotes":""},"doc_category":[80],"doc_tag":[],"class_list":["post-22354","docs","type-docs","status-publish","hentry","doc_category-wordpress"],"year_month":"2026-10","word_count":2845,"total_views":"25","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Silvio Mazenauer","author_nicename":"admin-curia","author_url":"https:\/\/www.curiaweb.ch\/en\/author\/admin-curia\/"},"doc_category_info":[{"term_name":"WordPress","term_url":"https:\/\/www.curiaweb.ch\/en\/hilfe-kategorie\/wordpress\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/comments?post=22354"}],"version-history":[{"count":1,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22354\/revisions"}],"predecessor-version":[{"id":22356,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22354\/revisions\/22356"}],"wp:attachment":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/media?parent=22354"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/doc_category?post=22354"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/doc_tag?post=22354"}],"curies":[{"name":"WP","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}