Account recovery guide

Reset a WordPress password with WP-CLI.

For an administrator with authorized shell access, WP-CLI is the cleanest way to reset a password. WordPress creates and stores the compatible hash for you.

5 min readUpdated 26 July 2026For authorized administrators
01No database value to build.

Pass the new password to WordPress and it writes the right hash for the installation.

02Keep the password out of history.

Use WP-CLI’s prompt option instead of placing a password on the command line.

03Target the right site.

Specify the WordPress path or site URL before changing an account on a busy server.

When WP-CLI is the right recovery path

Use WP-CLI when you administer the server or have approved shell access to the WordPress installation. It is usually safer than editing user_pass in phpMyAdmin because the normal WordPress user-update path handles password hashing. It is not a shortcut for accessing a site you do not administer.

Preferred

WP-CLI available

Reset the specific authorized account from the WordPress directory.

Fallback

No shell access

Use the normal reset email, then the careful phpMyAdmin path only if needed.

Stop and check

External login

SSO, LDAP, or a membership plugin may own authentication instead of WordPress.

Reset one account without exposing the password

First move to the directory containing the site’s wp-config.php. Confirm the account before you touch it; WP-CLI accepts a login, email, or numeric user ID. Listing a small set of fields is a useful preflight check.

Confirm the account wp user list --fields=ID,user_login,user_email,roles

Then use the prompt flag. It asks for the new password interactively, keeping the value out of shell history and the command itself.

Reset the authorized user wp user update USERNAME --prompt=user_pass

Replace USERNAME with the login, email, or ID you confirmed. Enter a unique, strong password when prompted and store it in a password manager. Do not paste it into a shared terminal, support ticket, or recorded session.

Choose the target before running the command

1 Open site directory2 Identify account3 Prompt for password4 Sign in and confirm

On a server with several WordPress installs, add --path=/path/to/site to make the target explicit. On multisite, use --url=https://example.com when the account belongs to a particular site. The goal is simple: identify the site and account first, then make one deliberate change.

If the command does not work

An error before WordPress loads often means you are in the wrong directory, the path is incorrect, or the command cannot read the configuration. A successful update followed by a failed sign-in can point to a security plugin, an external identity provider, a different site in a network, or a browser session issue.

Do not keep repeating changes. Review the exact command output, confirm the user with wp user list, and then use the password reset troubleshooting guide to narrow down the next check.

After the reset

  1. Sign in to the intended site using a private browser window or a clean session.
  2. Confirm the user’s role and dashboard access; do not make unrelated account changes during recovery.
  3. Remove terminal output, temporary notes, and any copied password from the recovery workflow.
  4. Repair reset-email delivery and review two-factor recovery options for the next incident.

Primary references: WordPress password recovery guidance and WP-CLI: wp user update.