Create a WordPress admin user via FTP when you are locked out

Locked out of wp-admin but you still have FTP, SFTP, or hosting file manager access? You can temporarily bootstrap a new administrator from the active theme’s functions.php, log in, then delete the code.

This is emergency recovery for a site you own or are authorized to fix. It is not a permanent “backdoor.”

Related: login security, hacked site recovery.

Before you start

1. Confirm you are allowed to recover this site.
2. Prefer a host backup or staging clone if the site looks compromised.
3. Note the active theme (check wp-content/themes/ for the one in use, or look in the database option template / stylesheet if you can).
4. Use a unique username, email, and strong password. Do not reuse admin.

If you would rather not edit PHP, some hosts and tools offer emergency login resets. The steps below work on almost any install with file access.

Add a temporary admin creator

1. Connect with FTP/SFTP or open the host file manager.
2. Go to wp-content/themes/your-active-theme/.
3. Download a backup copy of functions.php first.
4. Open functions.php and paste the following at the end of the file:

<?php
/**
 * TEMPORARY emergency admin. Remove this entire block after you log in.
 */
function sn_emergency_create_admin() {
	$username = 'recover_admin'; // change me
	$password = 'replace-with-a-long-unique-password'; // change me
	$email    = 'you@example.com'; // change me

	if ( username_exists( $username ) || email_exists( $email ) ) {
		return;
	}

	$user_id = wp_create_user( $username, $password, $email );
	if ( is_wp_error( $user_id ) ) {
		return;
	}

	$user = new WP_User( $user_id );
	$user->set_role( 'administrator' );
}
add_action( 'init', 'sn_emergency_create_admin' );

5. Save and upload the file if you edited it locally.
6. Load the site once in a browser (any front-end URL is enough) so init runs.
7. Log in at /wp-login.php with the new credentials.
8. Delete the entire temporary block from functions.php immediately and save again.

Leaving this code in place recreates or re-checks the account on every request. That is a security problem, not a feature.

After you are back in

• Reset the password on the original admin account if it still exists.
• Review Users for unknown administrators.
• Enable 2FA on privileged accounts.
• If the lockout followed a hack, continue with malware cleanup rather than assuming the site is clean.

Losing access to one admin account does not delete that user’s posts. Content stays in the database. Create a recovery admin, then fix or reassign the original account.

Safer habits so you need this less often

• Unique passwords in a manager
• 2FA for administrators
• Offsite backups
• Fewer administrator accounts (user roles guide)

For a different emergency pattern (one-time URL trigger), see emergency access recovery. Prefer removing any recovery code the moment you regain control.