How to Add an Admin User in WordPress

Adding an administrator to WordPress takes about thirty seconds if you can log in. If you cannot, it takes a database query or an SSH command, and both are perfectly doable. The part worth slowing down for is the question nobody asks first: whether this person needs to be an administrator at all. Most of the time they do not, and handing out admin by default is how sites end up with nine of them and no idea who owns which.

Start here

Three situations, and they need completely different instructions.

How to add an admin user in WordPress

The normal route, for when you have access.

1. Log in and go to Users, then Add New. On newer versions the button reads Add User.
2. Fill in a username and email address. Both must be unique on the site, and the username can never be changed afterwards.
3. Set a password, or leave the generated one alone. It will be strong and nobody needs to memorise it.
4. Tick Send the new user an email about their account so they get their own credentials rather than you sending a password over WhatsApp.
5. Choose Administrator from the Role dropdown, if that is genuinely the right role. The next section is about deciding that.
6. Click Add New User.

That is the whole process, and it is the same screen whatever access you are granting. To add a WordPress user who is not an administrator, the only step that changes is step five: pick Editor, Author, Contributor or Subscriber from the same dropdown.

Three things about this screen that are worth knowing before you use it.

The username is permanent. WordPress has no rename function in the dashboard. Changing it later means creating a second account, reassigning the content, and deleting the first. Get it right the first time.

Never use "admin" as the username. Automated attacks try it on every WordPress site on the internet, which means a weak password is the only thing between them and your dashboard. Any other username removes half the attack for free.

Two accounts cannot share an email address. If you need a second login for yourself, most mail providers accept a plus suffix, so [email protected] reaches the same inbox and counts as different to WordPress.

Changing an existing user to admin

Often what people actually want. Go to Users, All Users, tick the person, choose Administrator in the "Change role to" dropdown, and click Change. No new account and nothing to reassign.

You cannot demote your own account while it is the only administrator, which is WordPress preventing you from locking yourself out.

WordPress user roles: which one should you give?

WordPress ships with six roles and most sites use two of them. Handing out Administrator because it is the one you recognise is the most common mistake in this whole subject.

The Roles and Capabilities handbook page lists exactly which of the sixty-odd capabilities each role carries, if you need to be precise.

The line that matters

An Administrator can install plugins and edit theme files, which means an Administrator can run arbitrary code on your server. An Editor cannot. That is the real boundary, and everything else is detail.

So the question is not "how much do I trust this person" but "does this person need to install software on my server". A copywriter does not. A marketing agency updating pages does not. A developer building a feature does.

Temporarily is doing work in that last row. If you give a contractor admin access for a two week job, put a note in your calendar to remove it when they finish. Old admin accounts belonging to people who left are one of the most common findings in our security audits, and they are usually protected by a password somebody chose in 2019.

If the six roles are not granular enough, a role editor plugin lets you build one. Worth it on a site with a real team, and overkill on a site with three users.

How to access WordPress admin and log in

Worth covering plainly, because "how do I get into WordPress" is where a good number of people start.

Your login page is your domain with /wp-admin/ on the end:

https://example.com/wp-admin/

If you are not logged in, WordPress redirects that to /wp-login.php, which is the same thing. Both work, and it is worth bookmarking whichever you land on.

Once you are logged in, /wp-admin/ takes you straight to the dashboard, which is why the link is worth keeping to hand rather than typing the whole thing each time.

How to log into WordPress

The form itself takes a username or the email address on the account, which is worth knowing when somebody cannot remember which username they chose.

The Remember Me tick box matters more than it looks. Leave it unticked and WordPress signs you out after two days, or when you close the browser, whichever comes first. Tick it and the session lasts fourteen days by default. On your own machine that is the difference between logging in occasionally and logging in constantly; on a shared or public computer, leave it alone.

Three login problems come up far more than the rest.

• "Error: cookies are blocked or not supported". WordPress signs you in with a cookie, so it cannot log you in without one. Allow cookies for the site, or clear the existing ones and try again. Private browsing and aggressive tracking blockers both cause this.
• A redirect loop between the login page and the dashboard. You submit correct details, land back on the login form, and nothing says why. This is almost always a mismatch between the address you visited and the one WordPress has stored, typically www against no www. Visit the version that matches Settings, then General.
• The password manager filling in an old password. Common after a password change, and it looks exactly like the password being wrong. Type it by hand once to rule it out.

When that address does not work

A fair number of sites move it. Security plugins offer a custom login URL as a way of dodging automated attacks, so the page may be at /login, /secret-door or anything else the person who set it up chose.

If /wp-admin/ gives you a 404 rather than a login form, work through these:

• Check for a redirect. Some setups send you to a custom page rather than erroring.
• Look in your email. The welcome message from whoever built the site usually contains the real URL.
• Ask your host. They can see the installed plugins and will recognise a login-hiding one immediately.
• Rename the plugins folder. Over FTP, rename wp-content/plugins to plugins-off. Every plugin deactivates, including the one moving your login, and /wp-admin/ comes back. Rename it to restore them.

And if you have the address but not the password, that is a different job, covered in our guide to resetting a lost WordPress password.

Creating an admin user when you are locked out

No dashboard access at all. Three routes, in order of how much access each one needs.

Before any of them, take a backup. Two of the three write directly to your database.

1. WP-CLI, if you have SSH

One command, and by far the cleanest option because WordPress creates the account itself:

wp user create newadmin [email protected] --role=administrator

It prints a generated password. To choose your own, and email the details:

wp user create newadmin [email protected] --role=administrator \
  --user_pass='ChooseSomethingLong' --send-email

The wp user create documentation lists the rest of the options. To promote somebody who already exists instead:

wp user set-role bob administrator

2. phpMyAdmin, if you have your hosting panel

The route most people end up on, since almost every host offers phpMyAdmin and almost nobody has SSH.

Open phpMyAdmin, select your site's database, and open the SQL tab. Then run this, changing the four values at the top:

INSERT INTO wp_users
  (user_login, user_pass, user_nicename, user_email,
   user_registered, user_status, display_name)
VALUES
  ('newadmin', MD5('ChooseSomethingLong'), 'newadmin',
   '[email protected]', NOW(), 0, 'New Admin');

SET @uid = LAST_INSERT_ID();

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (@uid, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (@uid, 'wp_user_level', '10');

Check your table prefix first. This is the step that catches everybody. If your tables are named xyz_users rather than wp_users, you must change the table names and the two meta keys, which become xyz_capabilities and xyz_user_level. The meta key carries the prefix too, and a mismatched one produces a user who exists and has no permissions at all.

You can now log in at /wp-admin/ with that username and password.

The MD5() part looks alarmingly outdated and it does still work. WordPress moved to bcrypt for new passwords, but wp_check_password() still contains a branch that checks MD5 whenever the stored hash is 32 characters or shorter, regardless of the current hashing mechanism. WordPress will rehash it properly the first time you log in.

3. functions.php over FTP, as a last resort

When you have neither SSH nor database access, only file access. It works, and it deserves a warning rather than a flourish.

Add this to the very end of your active theme's functions.php:

add_action( 'init', function () {
    $login = 'newadmin';
    $pass  = 'ChooseSomethingLong';
    $email = '[email protected]';

    if ( ! username_exists( $login ) && ! email_exists( $email ) ) {
        $id = wp_create_user( $login, $pass, $email );
        ( new WP_User( $id ) )->set_role( 'administrator' );
    }
} );

Load any page on the site once, which fires the code and creates the account. Log in to confirm it worked.

Then delete those lines immediately. Not later, not at the end of the day. While that code sits in your theme it recreates the account on every page load, so deleting the user in the dashboard achieves nothing, and anybody who can read your theme files can read the password sitting in plain text.

This is not a hypothetical risk. Injecting exactly this into a theme file is a standard move once an attacker gets file access, which is why an unexplained administrator is treated as evidence of compromise rather than an oddity.

The security side

Adding an administrator is a security event. A few habits keep it a boring one.

An admin you did not create is an incident, not a mystery. If a new administrator appears and nobody on your team added it, treat the site as compromised. Changing that password is not enough, because whatever let them create it is still there. Our guide to running a WordPress security audit covers finding the entry point, and a nulled theme is the single most common one we see.

Audit the list twice a year. Open Users, All Users, sort by role, and ask who each administrator is. Most sites we take over have between two and four nobody can account for: a former developer, an agency that finished in 2021, a plugin that created a service account.

Send credentials properly. Use the "send the new user an email" tick box so WordPress generates a password reset link and you never see or transmit the password.

Turn on two factor authentication for administrators. A strong password stops guessing. It does nothing about a password that leaked in somebody else's data breach, and reused passwords are the norm rather than the exception.

Use separate accounts. If you write posts and also administer the site, having an Editor account for daily writing means a stolen session from a coffee shop is not an admin session. Fussy, cheap, and occasionally the thing that saves you.

Removing an admin user without losing their work

The counterpart, and the step people get wrong in a hurry.

Go to Users, All Users, hover the account and click Delete. WordPress then asks what to do with anything they wrote, and this is the part that matters:

• Attribute all content to another user keeps their posts and pages, reassigned to whoever you pick. Almost always the right answer.
• Delete all content removes every post and page they authored. Occasionally correct, usually a disaster, and there is no undo.

Media is attached to posts, so reassigning keeps images in place. If you are removing somebody in a hurry because access needs revoking now, change their role to Subscriber first and delete the account properly later. That removes every capability instantly and gives you time to think about the content.

The short version

If you can log in, it is Users then Add New, and it takes under a minute. Give Editor rather than Administrator unless the person genuinely needs to install software on your server.

If you are locked out, use wp user create with SSH, or the SQL above in phpMyAdmin, checking your table prefix before you run it. Keep the functions.php route for when you have nothing else, and delete the code the moment it has worked.

Then put a reminder in the calendar to look at the user list in six months, because that is the step that actually prevents the problem.

Frequently asked questions