Locked out? WordPress maintenance starts with access
Being locked out of WordPress admin is irritating at the best of times. It is worse when you need to publish an urgent update, change a price, fix a contact form, or remove something that should never have gone live. For Dubai, UAE, UK and Liverpool businesses, the temptation is usually the same: get someone to create a new administrator and crack on.
Not ideal.
If you are locked out of WordPress, the safest first step is to verify ownership and identify why access failed before creating any new administrator accounts. Common causes include password resets not arriving, two-factor authentication problems, security plugin lockouts, changed login URLs, hosting or database faults, incorrect user roles, or compromised credentials. Recovery should follow the least risky verified route, then include a security review and credential cleanup.
The false fix: just create another admin account
Creating another administrator can feel like progress. Sometimes it is necessary as part of a verified recovery. But it is not the diagnosis.
An extra admin account might get you into the dashboard, while the original fault remains untouched. Worse, that emergency account can sit there for months with full privileges, no named owner, no two-factor authentication and a password someone pasted into WhatsApp during a mild panic.
That is usually where the fun starts.
Restoring access is only half the job. The cause determines whether the account is safe to keep using.
A safer access recovery decision guide
Use this as a practical flow before anyone starts prodding the database or installing rescue plugins. The aim is to regain control without making the site easier to abuse later.
| Decision | Ordinary login fault | Possible compromise or ownership issue |
|---|---|---|
| Can the business prove ownership? | Domain, hosting, billing, company email and named decision-maker line up. | Former developer, old agency or unknown email owns the only working admin account. |
| Does password reset work? | Email arrives and the reset link works. | No email arrives, reset goes to an old inbox, or the admin email is unfamiliar. |
| Is two-factor authentication blocking access? | Recovery codes, authenticator access or a verified admin can reset it. | 2FA is attached to a former employee, lost phone or unknown device. |
| Is a security plugin involved? | Temporary lockout after failed logins or IP change. | Multiple unknown failed logins, unexpected admin users, or changed permissions. |
| Is host or database access available? | Hosting account is under company control and backups exist. | Hosting is controlled by someone else, backups are missing, or files look altered. |
This is the split that matters. A normal login fault needs careful recovery. A suspected compromise or ownership problem needs recovery plus investigation.
Decision 1: who actually owns the route back in?
Start with ownership, not cleverness.
Check who controls the domain, hosting account, WordPress admin email, business email inboxes and backup location. If the only working administrator belongs to a former developer, the business has an access governance problem as well as a login problem.
One common scenario: a company director cannot receive a password reset because WordPress mail is failing, while the former developer still owns the only working administrator account. The dashboard is not broken in a dramatic way. The business simply does not control the path back in.
Before attempting recovery, gather the boring evidence: hosting login, domain registrar access, company email access, recent backup details, invoices, and the list of known users. Boring saves time.
Decision 2: is the password reset actually being delivered?
WordPress can say a reset email was sent when no useful email reached the person who needs it. The message might be handed to the server, then vanish because SMTP is not configured, DNS records are poor, the mailbox is full, or the email goes to an old admin address.
Check the actual admin email address. Check spam. Check the old inbox nobody has opened since 2021. Check whether other WordPress emails are sending, such as form notifications, WooCommerce emails or new user emails.
If email delivery is the fault, creating another administrator misses the point. Password resets, contact forms and account emails may all be unreliable. That belongs inside proper WordPress maintenance in Dubai, not as a one-off annoyance to ignore once you get back in.
Decision 3: is two-factor authentication expired, lost or misassigned?
Two-factor authentication is useful until it is attached to the wrong person, a lost device, or a shared admin login that should not have existed in the first place.
Use legitimate recovery codes or another verified administrator where available. If neither exists, use the hosting or support route only after ownership is clear. Do not ask a random freelancer to bypass 2FA because someone is in a rush. That may fix today and weaken tomorrow.
After recovery, each real person should have their own account. Shared admin accounts are convenient until nobody can say who changed what.
Decision 4: is a security plugin blocking you?
Security plugins can lock users out after failed logins, IP changes, country restrictions, changed login paths or suspicious activity. The plugin might be guilty. It might also just be standing closest to the scene of the crime.
Look for recent changes. Was a plugin updated during business hours? Did someone change the login URL? Has the office IP changed? Is the hosting firewall blocking the admin area?
If there are unknown admin users, strange file changes, unfamiliar redirects, or repeated login attempts from unexpected locations, treat it as a possible security incident rather than a normal lockout. Do not keep using the same credentials and hope the mood improves.
Decision 5: should hosting or database access be used?
Host-level or database-level recovery can be valid, but only when ownership is verified and a backup or restore point exists. It is not the first toy out of the box.
The practical detail people skip: take a backup before making access changes, and record exactly what changed. If someone alters a user role, password hash, plugin folder or security setting, you need a trail. Otherwise the repair becomes another mystery for the next person.
For urgent access recovery where the site may also need repair, use a controlled route through WordPress website repair in Dubai rather than piling on new users and hoping nothing bites later.
After you get back in, remove the access debt
This is where a lot of businesses stop. They are back in, the update is done, everyone calms down, and the emergency account stays active until the next surprise.
Do the cleanup while the incident is fresh:
- Remove temporary administrator accounts that are no longer needed.
- Change passwords for all privileged users.
- Enable or reset two-factor authentication for real named users.
- Check administrator email addresses and ownership.
- Review recent users, roles, plugin changes and file changes.
- Confirm password reset emails and contact form notifications are delivering properly.
- Document who controls hosting, domain, backups and WordPress admin.
Proper maintenance is boring until it is the only thing that saves the site.
The smallest sensible next action
Stop changing things until you know what changed first. List the known access routes: WordPress admin, hosting, domain registrar, business email, backup provider and developer or agency contact. Then test the least invasive recovery route you can verify.
If the business cannot prove who owns the active admin account, fix that governance problem once access is restored. A website used for enquiries, bookings, property leads, clinic requests or agency client work should not depend on one former developer’s inbox.
FAQs about being locked out of WordPress
Why is my WordPress password reset email not arriving?
It may be going to the wrong admin email, landing in spam, or failing because WordPress mail is not properly configured. SMTP settings, DNS records and mailbox access all matter. WordPress can report that it handed off the message without proving the email reached the right inbox.
Can a Dubai business recover WordPress admin access without the old developer?
Often, yes, if the business controls the domain, hosting, company email or backups. The safest route depends on what ownership evidence exists. If the only working administrator belongs to the old developer, recover control carefully and then remove any unnecessary privileged access.
Is a WordPress security lockout the same as being hacked?
No. A lockout can happen because of failed logins, IP changes, changed login URLs or two-factor authentication problems. But unknown admin users, altered files, strange redirects or unfamiliar email addresses should be treated as warning signs that need a security review after access is restored.
Should website maintenance include admin access checks?
Yes. WordPress maintenance should include checking named administrators, backups, update routes, email delivery and recovery options. It cannot guarantee nothing will ever fail, but it reduces the chance that a routine login issue becomes an ownership panic during an urgent update.
If you are locked out and under pressure, do not create three new admin accounts and call it sorted. Message Standish Services on WhatsApp to recover access through the safest verified route and then find out why it failed.