Just got your hands on an old WordPress site whose password you don't remember anymore? Sending a new login by email didn't work? This is a situation every WordPress developer has already run into: here's the solution!

To find the administrator's username, you can dig through the wp_users table in the site's database. However, changing a password without admin access is a bit more complicated: indeed, it's not straightforward to manually hash a password based on the security keys defined in WordPress.

WP Backdoor User to the rescue!

Thanks to the WP Backdoor User tool, we're going to be able to regain administrator access to our WordPress site. This PHP script is a toolbox that will let you, as you choose:

  • Recreate a new user (choosing their password)
  • Change the password and/or role of an existing user (very handy if you already have access but with insufficient permissions)
  • Log in directly to an account without knowing the password

Incidentally, this tool can also be used to deactivate a plugin or remove an mu-plugin if the site is stuck. It's a feature I consider useless, since it's already doable directly via FTP, simply by renaming the folder of the plugin in question.

WP BackDoor User interface

Using WP Backdoor User to recover your WordPress password

  1. Download the PHP script located at this address: WP Backdoor User
  2. I recommend renaming the file, by adding characters to the end of the file name, so it can't be guessed by a third party
  3. Upload the file via FTP or SSH inside the WordPress install
  4. Access the script via your web browser : https://www.nomdusite.com/wp-backdoor-user-0x4r5o974.php
  5. You can use the tool to change the password of whichever account you choose
  6. Once you're done, the file should delete itself automatically. Still, make sure that's actually the case!

Congrats, you've just regained access to your WordPress site!

Careful, be cautious!

By the very nature of its mission, WP Backdoor User is a powerful tool that, if used improperly, can compromise the security of the site in question: needless to say, it should be used only exceptionally and with caution.

Don't forget to completely remove it from your server once you're done using it!