Locked Out of Your Own Website? How to Get Access Back

If you are locked out of your website, start by working out which lock you are actually standing in front of, because how to get access to my website has four completely different answers depending on the door. People say "I lost my website login" and mean any of these: the content system where you edit pages, the hosting account where the files live, the registrar account that holds the domain, or the email address every reset link gets sent to. Sort that out first and the rest is procedure.

The good news, and it is real news: nothing here is usually lost. Your site is still online while you sort this out. Every provider involved has a documented recovery path, and none of them require your old developer's cooperation, though it certainly helps.

Which door are you locked out of?

If the email address is the problem, deal with that before anything else. A reset link sent to an inbox nobody can open is not progress. If the mailbox was at a former employee's address, whoever administers your business email can usually restore access or forward the address to you.

Locked out of my website on WordPress: four routes back in

WordPress is the common case and it has the most options, roughly in order of how much access you already have.

1. The password reset email

Go to yoursite.com/wp-login.php and click "Lost your password?". Enter either the username or the email address on that user account and WordPress mails a reset link to the address on file. Two conditions have to hold, and the documentation says so plainly: you need access to that account's email address, and the site's email has to be working.

That second one catches people. If the site's mail is misconfigured, the reset page still shows a cheerful confirmation and the message never arrives. A silent failure looks exactly like a wrong email address. If nothing lands within a few minutes, including in spam, stop retrying and move down this list.

2. Log in from the hosting control panel

This is the route most people do not know about, and it is the easiest. Many hosts run a WordPress manager in the control panel, such as WP Toolkit, that includes a button to log into WordPress as an administrator directly. You never need the WordPress password. If you can get into your hosting account, look for the WordPress section of the panel and check for a Log in button next to your site.

Which is also the security lesson buried in here: hosting access is website access. Anyone with the host login owns the site regardless of what the WordPress user list says.

3. WP-CLI, if you have server access

If your host gives you SSH and WP-CLI is available, this is a two-command fix. Run wp user list to see the accounts, then wp user update with the user ID and a new user_pass value. To give yourself a fresh account instead, wp user create takes a login and an email plus a role flag set to administrator. This is what a developer would do, and it is worth asking your host's support whether they will run it for you.

4. Change the password in the database

The last resort, still officially documented by WordPress, is editing the database directly through phpMyAdmin in your hosting panel. Open the WordPress database, find the wp_users table, browse it, edit your own row, clear the existing value in user_pass, type your new password as plain text, then select MD5 in the function dropdown next to that field before saving. WordPress still accepts a password hashed that way and upgrades it to its current hashing on your next login.

Squarespace and Wix account recovery

Hosted platforms work differently. There is no database to edit and no server to log into, so the entire question is whether the platform believes you are who you say you are.

On Squarespace, the login page has a "Can't log in?" link with a "Forgot the email address?" option where you enter your domain, and recovery mail goes to the site owner's address on record. If that fails, support will ask you to prove ownership, and their documented evidence includes government photo ID, business documentation, billing records such as the last four digits of the card on file, and the account ID. Recovery and ownership-transfer requests run through a third-party identity check with a government ID and a selfie video.

On Wix the equivalent is the Wix Account Recovery form. You answer questions about the account, then verify with a photo of yourself and a photo of your ID, and you have to supply a working email you do control so Wix can reply. Wix then decides ownership on its own reading of the evidence.

When your developer holds the only admin account

Very common, and usually not sinister. Someone set everything up under their own logins because it was faster, then the relationship ended or simply faded out.

1. 1Ask once, in writing, for specific things. Not "can I have access" but: an administrator account on the CMS in my name, the hosting login, the registrar login, and a copy of the files and database. A written request is also the record you may need later.
2. 2Go to the providers in parallel. Do not wait. Open a ticket with the hosting company and the registrar and ask what proof of ownership they need. Business formation documents, a matching address, paid invoices and control of the business email all count.
3. 3Check the renewal date immediately. If the domain is registered under someone you cannot reach and it is close to expiring, that is the emergency in the room. What happens if your domain name expires has the timeline.
4. 4If you are still paying them, think before you cancel. Stopping payment can trigger a takedown on some setups. What happens if I stop paying my web developer covers what is actually legal and what is not.
5. 5If they have vanished entirely, follow what to do when your web developer disappears, which is written for exactly this order of operations.

The hour after you get back in

Getting in is the hard part. Not getting locked out again is a checklist.

• Take a full backup. Files and database, downloaded and dated, stored somewhere off the server. Do this before you change anything else.
• Audit the user list. Remove admin accounts belonging to people who no longer work on the site. Look for accounts with names you do not recognize, which is also how you spot a compromise.
• Move every account onto an email address you own. A permanent role address like accounts@yourdomain.com, not a personal Gmail and definitely not an address at your old agency's domain.
• Turn on two-factor authentication at the registrar and the host first, since those are the accounts that can take everything down.
• Put the credentials in a shared password manager vault so the next person who needs them does not repeat this week.

Then verify the plumbing. If your reset email never arrived, the mail records for your domain are worth checking properly, because the same fault that blocked your reset link is blocking contact form notifications and customer replies.

Once you are back in, the wider question is what you should hold permanently. Our website ownership checklist is the list we walk new clients through, and how to find out who manages your website hosting covers reading the public records that name each company.

If you would rather have someone do the recovery calls and the cleanup, that is a normal takeover for us. We pick up website maintenance on sites we did not build, and part of the onboarding is getting every account into your name rather than ours. If the hosting turns out to be the weak link, our managed hosting includes moving the site over from wherever it is. We are in Mill Creek, north of Seattle, and have been doing this since 2011. Plenty of owners work through the steps above on their own and never need to call anybody, which is a perfectly good outcome too.