Get Started

Emergency administrator access

One URL that reaches wp-login.php whatever your redirect setting says. What it bypasses, what it does not, and where to keep it.

  • Beginner
  • 4 min read
  • Applies to 2.0

Get your link

User Access → Authentication, in the emergency access panel. The link is created the first time you look at it.

Copy it somewhere that is not on this site: a password manager, a note on your phone, anywhere you can reach when the site will not let you in.

The emergency access panel, with the link and the regenerate button.

  • The link is saved outside the site
  • You have opened it once, in a private window, and reached the classic WordPress form
  • Anyone else who administers the site has it too

What it does, and what it does not

The link carries a token, and a request carrying a valid one is not redirected to your custom login page, even with that switch on. You land on wp-login.php itself.

That is what it is for: the way back when your custom login page is broken, missing, or looping.

It does not switch off the active sign-in method.

Only the redirect guard reads the parameter. A method that draws its own fields onto the login form still draws them, and two-factor still applies. If your authenticator is what has locked you out, this link will not get you past it — use a backup code, or reset the enrolment over WP-CLI.

Making it work the other way would mean a URL parameter that disables two-factor authentication, which is a far worse problem than the lockout it would solve.

What happens when you open it

  1. The token is checked and exchanged for a cookie that lasts fifteen minutes.
  2. You are redirected to the same page without the token in the address.
  3. The use is written to the audit log; so is every refused attempt.

Step 2 matters more than it looks. A secret in a query string does not stay there: it is written to the server's access log, kept in browser history, offered as a Referer to anything the page loads from elsewhere, and read by any corporate proxy in between. This link is bookmarked and pasted about precisely because it is for emergencies, so exchanging it for a cookie and dropping it from the address keeps it out of exactly those places.

The link itself keeps working afterwards — it is the same token, and your bookmark is still good.

Regenerating it

The regenerate button issues a new token and invalidates the previous one. Use it if the link has been shared, pasted somewhere public, or sent to someone who no longer administers the site.

Only administrators can regenerate it. Everyone who relies on the old link needs the new one.

Anyone holding this link reaches a working login form. That is exactly what makes it useful, and exactly why it belongs in a password manager rather than in an email thread or a shared document.

Related articles

Something missing or out of date? Tell support.