Locked Out of WordPress? AuthDock Recovery Options
Every way back into WordPress when AuthDock locks you out: recovery keys, the wp-admin bypass key, backup codes, and IP lockouts.
On this page
Being locked out of WordPress by your own security plugin has four common causes — a forgotten custom login URL, wp-admin access control, a 2FA device you no longer have, and an IP lockout — and AuthDock ships a designed recovery path for each one. None of them requires editing the database or deactivating the plugin over FTP, though that option always remains as a last resort.
Forgot the custom login URL
When you move the login form off wp-login.php, AuthDock generates a recovery key at the moment you enable the feature. Visit your site with the query parameter:
https://example.com/?authdock_recover=YOUR_KEYThis restores access to the login form. If you never stored the key, the fallback is deactivating the plugin by renaming its folder over FTP or your host's file manager — access returns to the default wp-login.php immediately, and your settings survive deactivation.
Blocked by wp-admin access control
Access control by role or IP range has a matching emergency bypass key, used the same way:
https://example.com/?authdock_bypass=YOUR_KEYTwo design decisions make this lockout rarer than it sounds: administrators are always immune to the access-control rules, and AJAX, WP-Cron, and admin-post.php stay exempt so the front end keeps working while you sort it out. If you restricted wp-admin to an IP whitelist and your ISP changed your address, the bypass key is the intended path — then update the whitelist, preferably to a CIDR range rather than a single address.
Lost your second factor
If your authenticator app is gone, sign in with one of the ten single-use backup codes issued when you enrolled in two-factor authentication. Another administrator can also reset your 2FA enrolment from the dashboard. If you are the only administrator and both options are gone, the FTP rename is the honest answer — and the reminder to store backup codes off-site next time.
Locked out by your own brute-force rules
Mistyping your password past the failure threshold (five attempts by default) triggers a fifteen-minute lockout, escalating on repeats. The simplest fix is patience — the first lockout expires on its own. To prevent recurrence, add your own IP to the whitelist, which exempts it from lockouts using exact, CIDR, or wildcard matching. If your site sits behind Cloudflare or a reverse proxy, configure trusted proxies so AuthDock reads the real client address from X-Forwarded-For; otherwise every visitor shares the proxy's IP and lockouts misfire.
Before enabling any lockout feature, do a dry run: store the recovery and bypass keys in your password manager, whitelist your IP, and keep one browser session signed in while you test from a private window.
Next steps
AuthDock
Hardened WordPress authentication — login protection, brute-force defence, and access control without a bloated security suite.
See also
Related documentation
- Getting Started With AuthDockInstall AuthDock and lock down your WordPress login with brute-force lockouts, 2FA, social login, and a full audit trail.
- Setting Up Two-Factor Authentication in AuthDockEnable TOTP or email two-factor authentication on WordPress with AuthDock, enforce it per role, and issue backup codes.