How to Recover a Hacked WordPress Admin Account When the Email is Changed

It is every website owner's worst nightmare. You wake up, type in your WordPress login URL, enter your password, and it says "Incorrect Password." You click the "Lost your password?" link and type in your email address, only to see an even more terrifying error:

"There is no account registered with that email address."

Panic sets in. A hacker hasn't just guessed your password; they have broken into your dashboard, deleted your admin email, and replaced it with their own. You are completely locked out of the front door of your own website.

Don't panic. As long as you still have access to your web hosting account (like Hostinger, Bluehost, or SiteGround), the hacker has not won. You hold the master keys to the database, and we are going to use them to force our way back in.

Today, I am going to show you exactly how to bypass the WordPress login screen and recover your hijacked admin account directly through the database in under five minutes.

1. Why Did the "Lost Password" Link Fail?

When hackers use brute-force attacks or exploit a vulnerable plugin to gain access to your dashboard, their first goal is persistence. If they only change your password, you could easily reset it via your email. By changing the administrator email address associated with your user ID, they ensure that any password reset links go directly to their inbox, not yours.

Because the WordPress login screen is now useless to us, we have to go through the "back door." Every piece of data on your website—including usernames, emails, and passwords—is stored in a MySQL database on your web server. By editing that database directly, we can override whatever the hacker changed.

2. Method 1: The Database Fix (phpMyAdmin)

This is the most reliable way to get your website back. You will need to log into your web hosting control panel (cPanel, hPanel, etc.).

1. Log into your Hosting Account: Navigate to your host's dashboard and look for a section called "Databases."
2. Open phpMyAdmin: Click the icon for phpMyAdmin. This is the visual interface that lets you edit your database.
3. Select Your Database: On the left-hand sidebar, you will see a list of databases. Click the one that belongs to your WordPress site. (If you don't know which one it is, you can check your wp-config.php file in the File Manager).
4. Find the Users Table: Look for a table named wp_users. (Note: Your table prefix might be different for security reasons, like wpabc_users, but it will always end in `_users`). Click on it.
5. Edit Your Account: You will see a list of registered users. Find your admin username in the list and click the Edit button (usually a pencil icon) on that row.

Changing the Email and Password

You are now looking at the raw data for your admin account. We need to fix two specific fields:

1. Fix the Email: Look for the user_email field. Delete the hacker's email address and type in your actual, secure email address.

2. Fix the Password (The MD5 Trick): Look for the user_pass field. You will notice it looks like a long string of random gibberish. This is because WordPress encrypts passwords. You cannot just type "MyNewPassword123" here.

• Delete the gibberish text in the `user_pass` field.
• Type your new, highly secure password into the box.
• CRITICAL STEP: In the Function column directly to the left of your password, click the dropdown menu and select MD5. This tells the database to encrypt your new password so WordPress can read it.

Scroll to the bottom of the page and click the Go button to save your changes. Open a new tab, go to your WordPress login screen, and log in with your new credentials!

3. Method 2: The Emergency Functions.php Hack

If you find phpMyAdmin confusing or you are afraid of breaking the database, there is an alternative method using your File Manager or an FTP client.

We can inject a temporary piece of code into your theme that forces WordPress to reset your password the moment the website loads.

1. Open your hosting File Manager.
2. Navigate to public_html/wp-content/themes/your-active-theme/.
3. Find the file named functions.php. Right-click and choose Edit.
4. Add the following code snippet immediately after the opening <?php tag at the top:

(Replace 'YourNewPasswordHere' with a strong password. The '1' assumes your admin user ID is 1. If you are not the original creator of the site, your ID might be different.)

5. Save the file.
6. Open a new browser tab and visit your website's homepage. The moment the homepage loads, the code executes and forces the password reset.
7. IMMEDIATELY GO BACK to the `functions.php` file and delete that line of code. If you leave it there, it will reset the password every single time a visitor loads a page!
8. Log into your dashboard using your new password. Go to Users > Profile, and change the email address back to your own.

4. Crucial Next Steps: Securing Your Site After Recovery

Congratulations, you are back in! But the hacker might have left backdoors. You must secure the perimeter immediately.

• Delete Rogue Admin Accounts: Go to Users > All Users. Hackers often create a secondary "Ghost" admin account to get back in if you recover the main one. Delete any user you don't recognize immediately.
• Change Your WordPress Salts: Log into your File Manager, open wp-config.php, and replace the security keys (Salts). This forces every single user currently logged into the site (including the hacker) to be instantly logged out.
• Install a Security Plugin: Install Wordfence or Solid Security. Run a deep malware scan immediately to find the backdoor script the hacker used to get in.
• Enable 2FA: Turn on Two-Factor Authentication for your admin account. This ensures that even if a hacker steals your password again, they cannot log in without your physical smartphone.

The Bottom Line

A hacked WordPress dashboard feels catastrophic, but it is highly reversible. Because you own the hosting server, you always have the ultimate authority over the database. By using phpMyAdmin to overwrite the hacker's changes, you can reclaim your digital property in minutes and get back to business.