Emergency WordPress admin recovery with a one-time URL hook

If you own the site (or are hired to recover it) and every administrator login is gone, but you still have FTP, SFTP, or file manager access, you can temporarily create a new admin with a secret URL, log in, then delete the code.

Do not leave this in place “for later.” Do not install it on client sites as a hidden permanent entry. Attackers look for exactly this pattern. A forgotten recovery hook is a backdoor.

Prefer the simpler flow when you can: create an admin via functions.php and remove it after one login. Use the URL hook below only when you want the account created on an explicit visit.

Rules of engagement

1. Only use this on sites you are authorized to recover.
2. Choose secret query names that are not the examples in this post.
3. Create the account once, log in, then delete the code.
4. If the site was hacked, treat recovery as step one of cleanup, not the finish line.

Temporary URL hook (remove after use)

1. Back up the active theme’s functions.php.
2. Append this block at the end (child theme preferred so parent updates do not surprise you):

<?php
/**
 * TEMPORARY authorized recovery hook. Delete after you log in once.
 * Visit: https://example.com/?sn_recover=your-long-secret
 */
function sn_emergency_url_admin() {
	if ( ! isset( $_GET['sn_recover'] ) ) {
		return;
	}

	// Change both values before upload.
	if ( 'your-long-secret' !== $_GET['sn_recover'] ) {
		return;
	}

	$username = 'recover_admin'; // change me
	$password = 'replace-with-a-long-unique-password'; // change me
	$email    = 'you@example.com'; // change me

	if ( username_exists( $username ) || email_exists( $email ) ) {
		return;
	}

	$user_id = wp_create_user( $username, $password, $email );
	if ( is_wp_error( $user_id ) ) {
		return;
	}

	$user = new WP_User( $user_id );
	$user->set_role( 'administrator' );
}
add_action( 'init', 'sn_emergency_url_admin' );

3. Upload the file.
4. Visit your secret URL once, for example https://yoursite.com/?sn_recover=your-long-secret.
5. Log in at /wp-login.php with the new credentials.
6. Remove the entire block from functions.php and save.

Change sn_recover, the secret string, username, password, and email before you deploy anything.

After recovery

• Audit Users for unknown admins
• Reset passwords on remaining privileged accounts
• Turn on 2FA
• Review login security
• If admins vanished because of malware, continue with hacked site steps

What this is not

• Not a substitute for backups
• Not permission to access someone else’s site
• Not “fun” or “safe” to leave running
• Not a reason to edit WordPress core files (never edit core for this)

Keep access boring: unique passwords, 2FA, few administrators, and offsite backups. Recovery hooks are last resort tools, not day-to-day workflow.