Skip to main content

Recover your login

Before you start​

Login recovery restores access to your WordPress account. To restore a lost or compromised website, use Restore a WordPress site.

You need your normal account login details and either an unused backup code or access to the email address already saved on your account. If you have neither, ask the site owner for support-assisted recovery.

Use a backup code​

  1. Sign in until Awthy asks for your second factor.
  2. Choose the backup-code method and enter one unused code from your private saved set.
  3. After signing in, open your account-security settings and replace the lost factor.
  4. Generate and save a new set of backup codes if your existing set is lost or exposed.

Expected result: you can access your account and register a working factor. A used backup code cannot be reused.

Example: if your phone breaks, use one saved backup code from another secure location, register your replacement authenticator, and check it before signing out.

  1. Reach the second-factor prompt after your normal login.
  2. Choose the recovery-email option.
  3. Open the mailbox already associated with your WordPress account.
  4. Follow the single-use link before it expires.
  5. Return to account security to repair your second factor and save fresh backup codes.

The link goes only to the address already on the account. You cannot redirect it from the login screen. It contains no password or backup codes. Recovery signs you in once; it does not disable your second factor.

Check spam and the account's email address. Ask the site owner to check transactional-email delivery if nothing arrives. If the link expired, request a new one and use the latest message.

Repeated requests can trigger a temporary account limit. Wait for the displayed delay before requesting another. The source-IP delay for wrong second-factor attempts does not block the recovery-email request.

Never send a recovery link, backup code, password, or authenticator QR code to support.

Prepare before requiring 2FA​

  1. Confirm critical users have working email addresses and saved backup codes outside WordPress.
  2. Use a non-critical account to test a real recovery email and sign-in.
  3. Verify that an administrator can help if a user loses both the factor and mailbox.
  4. Agree how the last administrator will regain access through an authorized hosting operator if necessary.

Do not rely on a configured email setting until a recovery message has actually arrived and its link has worked.

Last updated on