How To Add An Admin User To The WordPress Database Via MySQL

Last modified: July 23, 2026

FAQ

More than half of small businesses are targeted by hackers each year. When an attacker gains access to your WordPress site, one of their first moves may be to delete your admin account from the database, leaving you completely locked out with no way to log in.

The good news is that you can bypass the front-end login entirely and add a new admin user directly through MySQL. This same technique works if you’re migrating a site and the admin email no longer exists, if a plugin bug corrupted the user table, or if you simply can’t access the registered email to trigger a password reset. As long as you have access to phpMyAdmin (through your hosting control panel), Adminer, or a direct MySQL connection, you can restore admin access in a few minutes.

Before you start, make a full backup of your MySQL database. Your hosting panel usually offers a one-click database export. Do that first. If something goes wrong during the process, you’ll be able to restore from the backup rather than dealing with a broken database.

Three Ways to Access Your WordPress Database

The steps below use phpMyAdmin, which is available through most hosting control panels (cPanel, Plesk, Kinsta, WP Engine). If phpMyAdmin is not available on your host, you have three alternatives:

Adminer: A single-file PHP database manager that you can upload to your site root and run from a browser. See the Adminer section below for the full process.
WP-CLI: If you’re on a managed host with SSH access and WP-CLI installed, you can add an admin user in one command: wp user create newadmin [email protected] --role=administrator --user_pass=YourSecurePassword. Replace the username, email, and password with your own. This is faster than the phpMyAdmin method and skips the database editing entirely.
SSH + MySQL CLI: If you have SSH access but no WP-CLI, connect via SSH and run: mysql -u DB_USERNAME -p DB_NAME (replace with your values from wp-config.php). Once connected, you can run INSERT queries directly against wp_users and wp_usermeta. This is the same logical process as the phpMyAdmin steps below, just without the GUI.

If none of these apply, continue with the phpMyAdmin method in the steps below.

Add an Admin User With One SQL Query

If you are comfortable running SQL directly (through the phpMyAdmin SQL tab, the MySQL command line, or a tool like Adminer), you can skip the manual field entry and create the account with three queries. Change the username, email, and password to your own values first:

INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
VALUES ('newadmin', MD5('ChangeThisPassword'), 'newadmin', '[email protected]', '2026-01-01 00:00:00', '0', 'New Admin');

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (LAST_INSERT_ID(), 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (LAST_INSERT_ID(), 'wp_user_level', '10');

Run all three together. The first query creates the user and lets MySQL assign the ID automatically. LAST_INSERT_ID() then carries that ID into the two usermeta rows, so the capabilities and user level attach to the right account.

If your tables use a custom prefix such as wpab1_, update both the table names and the two meta_key values to match, for example wpab1_capabilities and wpab1_user_level. The wp_ inside the meta keys follows your prefix, not the literal text “wp_”, and getting it wrong is the most common reason the user is created but still has no admin rights.

A note on MD5 and passwords: The query above uses MD5 to hash the password, which is what WordPress understands at login time. WordPress since version 2.5 actually stores passwords using its own phpass implementation (stronger than raw MD5), but it also accepts MD5 hashes inserted directly into the database and upgrades them on the next login. So the MD5 approach works reliably for emergency access. Once you’re back in, WordPress automatically re-hashes your password with the stronger algorithm the next time you log in.

Prefer a point-and-click interface? Follow the phpMyAdmin walkthrough below, which does the same thing one field at a time.

Using Adminer Instead of phpMyAdmin

Adminer is a single PHP file that acts as a full database manager, similar to phpMyAdmin but without the multi-file installation. If your hosting control panel does not include phpMyAdmin, Adminer is a practical alternative you can run without any server configuration.

Here is how to use it:

Download the latest adminer.php file from adminer.org (single file, no install needed).
Upload it to your site’s root directory via FTP or your hosting file manager. Rename it to something non-obvious, like db-tool-temp.php, so it is not a permanent security exposure.
Open https://yoursite.com/db-tool-temp.php in your browser.
Log in with your database credentials (find them in wp-config.php: DB_HOST, DB_USER, DB_PASSWORD, and DB_NAME).
Click SQL command in the left sidebar.
Paste the three INSERT queries from the section above and click Execute.
After verifying that the new admin account works, delete db-tool-temp.php immediately. Leaving a database tool accessible on a live site is a serious security risk.

Adminer is particularly useful on shared hosting plans where phpMyAdmin is not installed or has been disabled by the host.

WordPress Multisite: Adding a Super Admin

If your site runs WordPress Multisite, a regular administrator account only has access to a single site within the network. To restore full network control, you need a super admin, not just an administrator.

After following the phpMyAdmin steps (Steps 1 through 3) to create a standard admin user, add one additional row to wp_usermeta:

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (YOUR_NEW_USER_ID, 'wp_user_level', '10');

Then open the wp_sitemeta table, find the row where meta_key = 'site_admins', and edit the meta_value. It contains a serialized PHP array of super admin usernames, like this:

a:1:{i:0;s:5:"admin";}

Add your new username to the array. For example, if your new username is newadmin, update the value to:

a:2:{i:0;s:5:"admin";i:1;s:8:"newadmin";}

The number after s: is the character count of the username. “admin” has 5 characters; “newadmin” has 8. Getting this count wrong breaks the serialized string and the network admin page will not load. Count carefully, or use an online PHP serializer to generate the correct string.

After saving, log in to yoursite.com/wp-admin/network/ with the new account to confirm network admin access.

* This button will show the rest of the post and open up an offer from a vendor

Step 1 – phpMyAdmin

Open your hosting control panel (cPanel, Plesk, or your host’s custom dashboard) and click phpMyAdmin. If you’re on a managed host like Kinsta or WP Engine, you’ll find phpMyAdmin access within their site dashboard.

Once you’re in phpMyAdmin, look at the left sidebar for a list of databases. Click the one associated with your WordPress site. If you’re not sure which database your site uses, open your wp-config.php file (in your site’s root folder) and look for the DB_NAME value; that’s your database.

With the database selected, you’ll see a list of tables. Most WordPress installations use the default wp_ prefix, but some use a custom prefix chosen during installation. If you don’t see wp_users, look for a table ending in _users; that’s the one you need. If you’re unsure of your prefix, open wp-config.php and look for the $table_prefix variable.

Step 2 – wp_users

Click on the wp_users table (replace wp_ with your custom prefix if needed) and click the Insert tab at the top. Fill in each field as follows:

ID: Pick a number not already in use. Scroll through the existing rows to find the highest ID, then use the next number up.
user_login: The username for your new admin account. Keep it simple and unique.
user_pass: Your password. In the Function column next to this field, select MD5 from the dropdown. WordPress stores passwords as hashed values, and selecting MD5 here handles that automatically. On your first login, WordPress will upgrade the hash to a stronger format.
user_nicename: A URL-friendly version of your name: lowercase, hyphens instead of spaces (e.g. john-smith).
user_email: The email address for this account.
user_url: Optional. Your site URL or leave it blank.
user_registered: Today’s date and time in this format: 2026-05-20 12:00:00
user_activation_key: Leave blank.
user_status: Set to 0 (active).
display_name: How your name appears publicly on the site. Can match user_nicename or be your full name.

Click Go to save. Write down the ID you used; you’ll need it in the next step.

Step 3 – wp_usermeta

Click on wp_usermeta in the left sidebar (again, substitute your custom prefix if needed) and click the Insert tab. You need to add two separate rows to grant full administrator access.

Row 1, Capabilities:
umeta_id: Leave blank (auto-generated).
user_id: The same ID you used in Step 2.
meta_key: wp_capabilities (or yourprefix_capabilities if you have a custom table prefix)
meta_value: Paste this exactly: a:1:{s:13:"administrator";b:1;}

Click Go, then click Insert again to add the second row.

Row 2, User Level:
umeta_id: Leave blank.
user_id: Same ID as above.
meta_key: wp_user_level
meta_value: 10

Click Go. The wp_user_level value of 10 ensures compatibility with older themes and plugins that check this field when determining admin access.

Now try logging in to WordPress with the username and password you created in Step 2. If it works, move on to Step 4 to finish the setup.

Step 4 – Clean Up

Once logged in, go to Users in the WordPress admin sidebar and click on your new account. Scroll to the bottom and click Update User without changing anything. This prompts WordPress to rebuild the user’s capability data in its own serialized format, replacing the raw database value you inserted with a properly structured version.

While you’re in the Users section, review all existing accounts. Delete any unfamiliar usernames; attackers often create backdoor admin accounts alongside the damage they do. Then go to Settings > General and confirm the admin email address is correct.

If a hacker deleted your account, treat the entire site as compromised and complete this checklist before doing anything else:

Change your database password: In cPanel or your host dashboard, regenerate the MySQL user password and update the DB_PASSWORD value in wp-config.php immediately.
Scan for backdoors: Install a security plugin such as Wordfence or Malcare and run a full scan. Attackers frequently plant PHP backdoor files in wp-content/uploads/ or rename them to look like WordPress core files.
Rotate all passwords: Change your hosting account password, your FTP/SFTP credentials, and any email accounts associated with the site.
Check file modification dates: Via FTP, sort files by modification date. Any PHP file modified around the time of the attack that is not a plugin or theme update is suspicious.

Finally, head to Dashboard > Updates and apply any pending WordPress core, theme, or plugin updates. A site that was successfully attacked almost always had an unpatched vulnerability; staying up to date is the most effective way to prevent it from happening again.

After Restoring Access: Security Steps

Getting back in is only half the job. After you’ve logged into WordPress with your new admin account, work through these steps before you do anything else:

Change the password immediately. The emergency password you used was created in plain text in a query. Go to Users, find the new account, and set a proper strong password from the WordPress admin.
Check for unauthorized user accounts. Attackers often create backdoor accounts alongside the damage they cause. Review all accounts in Users and delete any you do not recognize.
Review wp_usermeta for unexpected roles. Sometimes attackers escalate existing accounts rather than creating new ones. In phpMyAdmin, check the wp_capabilities values for every user to confirm no regular subscriber has been quietly upgraded to administrator.
Scan for malware. Use a plugin like Wordfence or Malcare to run a full site scan. A locked-out admin situation usually means something was already compromised.
Rotate your database credentials. In cPanel or your host’s panel, change the database user password. Then update DB_PASSWORD in wp-config.php to match.
Delete Adminer if you used it. If you uploaded adminer.php to run the queries, remove it from your server immediately. A public database tool is a major vulnerability.

Added the User but Still Can’t Log In?

If the new account does not work on the first try, one of these is almost always the reason:

Wrong table prefix in the meta keys. On a site with a custom prefix, the two wp_usermeta rows have to use it too: yourprefix_capabilities and yourprefix_user_level. A mismatch leaves the user in place but with no role, so WordPress treats them as a subscriber.
Password saved as plain text. In phpMyAdmin you must pick MD5 in the Function dropdown next to user_pass. Skip it and the password is stored unhashed and never matches at login. Edit the row, choose MD5, and save again.
A persistent object cache. Sites running Redis or Memcached can serve stale user data. Flush the cache from your hosting panel or restart the service, then retry the login.
A typo in the serialized capabilities string. The value has to be exactly a:1:{s:13:"administrator";b:1;}. The 13 is the character count of the word “administrator”, so paste the string rather than typing it manually.
The wp_user_level row is missing. Some tutorials only tell you to add the wp_capabilities row. WordPress also needs the wp_user_level row (value 10) in wp_usermeta, or the account will not have full admin access in older WordPress APIs that still check this value.

Final Word: How to Add an Admin User to the WordPress Database via MySQL

If your login details have been deleted and you can’t access the backend of WordPress, use the steps above to create a new admin account directly in the database. The phpMyAdmin method works on nearly all hosting providers. Adminer covers the cases where phpMyAdmin is not available. WP-CLI is the fastest option if you have SSH access. All three accomplish the same result.

Once you’re back in, take site security seriously. Install one of the better WordPress security plugins and review your WordPress user roles to make sure no accounts have unnecessary admin privileges.

Recap: