Locked out of your own website: how to get back in

Most website lockouts are fixed by a password reset at your site’s admin address, and it takes about ten minutes. Before assuming it is serious or paying anyone, work through the ladder below. Each step goes one level deeper, and most people are back in at step one or two.

The recovery ladder

Steps one to three solve the vast majority. Step four solves most of the rest.

The most common actual cause

It is rarely a forgotten password. In my experience the usual cause is that the admin account was set up under someone else’s email address, normally whoever built the site.

That means every reset email goes to them. You are not locked out because you forgot something; you are locked out because the account was never really yours.

The fix is the same either way, via hosting, and the lesson afterwards is to change the admin email to yours so this cannot recur.

If you cannot get into hosting either

Now you have a bigger question, and it is worth answering in the right order.

Check who owns your domain first, with a free WHOIS lookup. If the domain is registered to you, you are in a strong position regardless of what happens with the old site: a new site can be built and pointed at the same address, and your search rankings largely survive because they attach to the domain.

If the domain is registered to someone else, that becomes the priority. My web guy disappeared covers recovery in order.

Also check your bank statements for recurring payments to hosting companies. If you have been paying the host directly, you almost certainly have an account there that a password reset will recover, even if you have never logged in.

Once you are back in, do these four things

Ten minutes of work that prevents this happening again:

1. Change the admin email to yours. In WordPress this is under Settings, General for the site email and under Users for the account. This is the single fix that matters most.
2. Save the login in a password manager. Not a note on a phone, not a memory.
3. Create a second admin user for a trusted colleague or your provider, so one person losing a password never locks the business out.
4. Check what other accounts exist. Old admin users from previous developers should be removed, which is both tidy and safer.

What this reveals about your setup

A lockout is inconvenient. What it usually exposes is more useful: that you do not have clear ownership of your own accounts.

The test worth applying is simple. Could you, today, without asking anyone, log into your domain registrar, your hosting, your website admin and your Google Business Profile? If any answer is no, that is a gap worth closing while nothing is on fire.

Do you own your website covers what you should hold and how to check. Website security checklist covers the rest of keeping access sensible.

If you are locked out right now and stuck, tell us your web address and what you have tried and we will point you at the likely route back in. Usually it is the hosting panel, and usually it is free.