WordPress Hacker Changed Admin Email, URL & Password Fix

Establish Direct Database Access

Before you can fix anything, you need direct access to your WordPress database. This is usually done via phpMyAdmin in your hosting control panel (cPanel, Plesk, etc.) or by connecting via SSH and using a command-line client like MySQL CLI. Ensure you have your database credentials (database name, username, password) from your wp-config.php file.

// Locate your database credentials in wp-config.php
define( 'DB_NAME', 'your_database_name' );
define( 'DB_USER', 'your_database_user' );
define( 'DB_PASSWORD', 'your_database_password' );
define( 'DB_HOST', 'localhost' ); // Or your specific database host

✓ Time Estimate: 5-10 minutes. Safety Note: Be extremely careful when editing the database directly. Always make a backup first if possible.

Force Reset Your Administrator Password

The hacker likely changed your admin password. You can force a reset directly in the database. Navigate to the wp_users table (your table prefix might be different, e.g., wp_123_users). Find your administrator user (usually ID=1 or the username you typically use). Edit the user_pass field. Instead of entering the password directly, you need to hash it. In phpMyAdmin, select the MD5 function from the dropdown next to the user_pass field and then type your new password into the value field. Alternatively, use MySQL's PASSWORD() function.

UPDATE `your_db_name`.`wp_users` SET `user_pass` = MD5('YourNewStrongPassword') WHERE `user_login` = 'your_admin_username';

-- Or using MySQL's PASSWORD() function (more secure for some setups)
UPDATE `your_db_name`.`wp_users` SET `user_pass` = PASSWORD('YourNewStrongPassword') WHERE `user_login` = 'your_admin_username';

✓ Time Estimate: 2-5 minutes. Safety Note: Choose a strong, unique password immediately. Do not reuse old passwords.

Revert Changed Admin Email Address

A common tactic is for a wordpress hacker changed admin email to prevent you from receiving password reset links. You need to update both the individual user's email and the site's general admin email. In the wp_users table, find your administrator user and update the user_email field to your correct email address. Then, in the wp_options table, find the option name admin_email and set its option_value to your correct email. There might also be a pending _new_admin_email option, which you should delete or set to your correct email.

UPDATE `your_db_name`.`wp_users` SET `user_email` = 'your_correct_email@example.com' WHERE `user_login` = 'your_admin_username';
UPDATE `your_db_name`.`wp_options` SET `option_value` = 'your_correct_email@example.com' WHERE `option_name` = 'admin_email';
DELETE FROM `your_db_name`.`wp_options` WHERE `option_name` = '_new_admin_email'; -- If a pending change exists

✓ Time Estimate: 3-7 minutes. Safety Note: This bypasses WordPress's email confirmation, so ensure the email is correct.

Correct Site URL Settings

If the wordpress hacker changed site url, your site might be redirecting to a malicious domain or simply not loading correctly. In the wp_options table, locate option_name entries for siteurl and home. Ensure their option_value fields are set to your correct WordPress installation URL (e.g., https://yourdomain.com). If your site is loading but redirecting, this is a critical fix.

UPDATE `your_db_name`.`wp_options` SET `option_value` = 'https://yourdomain.com' WHERE `option_name` = 'siteurl';
UPDATE `your_db_name`.`wp_options` SET `option_value` = 'https://yourdomain.com' WHERE `option_name` = 'home';

✓ Time Estimate: 2-5 minutes. Safety Note: Incorrect URLs can break your site entirely. Double-check for trailing slashes or incorrect protocols (http vs. https).

Identify and Remove Unauthorized Admin Users

Often, a hacker will create new administrator accounts to maintain access. Check the wp_users table for any unfamiliar usernames. Then, cross-reference with the wp_usermeta table, looking for entries where meta_key is wp_capabilities (or your_prefix_capabilities) and meta_value contains administrator. If you find any unauthorized users, delete them from both wp_users and wp_usermeta. For a deeper dive into this specific issue, refer to our guide on WordPress Unknown Admin User Created by Hacker.

SELECT ID, user_login, user_email FROM `your_db_name`.`wp_users`; -- Identify all users

-- To delete an unauthorized user (replace 'hacker_user' and ID):
DELETE FROM `your_db_name`.`wp_users` WHERE `user_login` = 'hacker_user';
DELETE FROM `your_db_name`.`wp_usermeta` WHERE `user_id` = 'HACKER_USER_ID';

✓ Time Estimate: 5-10 minutes. Safety Note: Be absolutely certain you are deleting the correct user. Deleting your own admin account will lock you out.

Scan for Persistent Backdoors and Malware

Changing settings is a symptom, not the root cause. The hacker gained access through a vulnerability and likely left behind a backdoor to regain access. This is why you're seeing wordpress unauthorized changes to site settings. You need to perform a thorough scan of your file system for malicious code, webshells, and backdoors. Common places to check include wp-content/themes/your-theme/functions.php, wp-content/plugins/, wp-includes/, and even wp-config.php. Look for unfamiliar files, obfuscated PHP code (e.g., eval(base64_decode(...))), or files with recent modification dates that you didn't touch. For more detailed instructions on finding and removing these, see our guides on WordPress Backdoor Found in Files and WordPress Hackers Keep Getting Back In.

// Example of a common backdoor location
/wp-content/mu-plugins/malicious-plugin.php
/wp-content/uploads/2023/01/shell.php
/wp-includes/pomo/streams.php // Often injected here

// Look for suspicious code patterns in PHP files:
grep -r "eval(base64_decode" /path/to/wordpress
grep -r "shell_exec" /path/to/wordpress

✓ Time Estimate: 30-60+ minutes. Safety Note: This requires technical expertise. Incorrect removal can break your site or leave the backdoor active.