Website Security
Security Plugin Locked Me Out
Last reviewed
Direct answer
A WordPress security plugin lockout is almost always an IP, country, or failed-login block—not a deleted admin account. Recover by renaming the plugin folder via FTP or file manager, logging in once, allowlisting your current IP, then re-enabling protection so the site is never left unprotected.
WordPress Repair for a security lockout starts with getting you back into wp-admin without gutting the firewall for days. Bot storms, travel, VPNs, and aggressive login limits commonly block the real owner. This guide covers safe temporary disable via hosting files, whitelist recovery, and how to harden limits again—plus when to hand rescue to a pro so protection stays on while access is restored.
Key facts
Verifiable numbers and definitions — each claim links to its source.
- WordPress documents multiple password-reset methods, including database and file-based recovery when wp-admin login fails. (Resetting Your Password)
- Hardening WordPress documentation covers login and access protections that, if misconfigured, can block legitimate administrators. (Hardening WordPress)
- WordPress advanced-administration security docs describe layered auth and firewall practices used by security plugins. (WordPress security)
What the error means
Security suites (Wordfence, Solid Security / iThemes, All-In-One WP Security, Sucuri, and similar) sit in front of wp-login.php and often wp-admin. After repeated failures, a new IP, or a country rule, they return a lockout page, 403, or “too many attempts” message even when the password is correct. The plugin’s own allowlist and lockout tables live in the database or plugin storage, so the recovery path is file-level: rename the plugin directory under `wp-content/plugins` so WordPress stops loading it, authenticate, whitelist your IP (and office ranges), then re-enable. Deleting the plugin permanently or leaving firewall rules off is the wrong trade—you trade a lockout for an open login. If lockouts coincide with unknown admins, odd redirects, or malware notices, treat access recovery as step one of a compromise response, not the whole job.
Common symptoms
- wp-login shows “too many failed attempts,” blocked IP, or locked out even with the right password
- Browser receives HTTP 403 on /wp-login.php or /wp-admin/ while the public site still loads
- Country, VPN, or “forbidden location” message from the security plugin
- Lockout email or dashboard alert arrived before you lost access
- Login works from a phone hotspot but fails on office or home Wi-Fi (or the reverse)
- Front end is fine; only admin and login URLs are blocked
- Captcha or 2FA challenge never appears because the IP is denied first
Most likely causes
- 01 Brute-force protection locked your IP after bots hammered wp-login or xmlrpc.php
- 02 Travel, mobile network, or VPN changed your public IP outside the allowlist
- 03 Country or geoblock rules exclude where you now connect from
- 04 Aggressive “immediately lock after N failures” settings with a short window
- 05 Shared office NAT: a coworker’s failed attempts locked the whole building IP
- 06 Security plugin update tightened defaults or re-enabled a previously disabled rule
- 07 WAF/CDN (Cloudflare, host ModSecurity) stacked on top of the plugin’s own lockout
What changed before the problem started
- Security plugin installed, updated, or reconfigured after a bot attack
- You traveled, switched VPN/proxy, or changed ISP and got a new IP
- Failed login storm from scanners triggered automated lockouts
- Country block or “block non-US” style rule enabled
- Hosting or Cloudflare firewall rules added that also deny admin paths
- Staff tried many password guesses and locked the shared office IP
Troubleshooting steps
- 01
Confirm it is a lockout, not a password or redirect problem
Note the exact message: lockout/blocked IP vs invalid password vs redirect loop vs white screen. Try a second network (phone hotspot). If hotspot works and home Wi-Fi does not, you almost certainly have an IP block—not a bad password. Stop guessing passwords; more failures deepen the lockout.
- 02
Rename the security plugin folder via FTP or file manager
Connect with SFTP or the host file manager. Under `wp-content/plugins`, rename the security plugin directory (for example `wordfence` → `wordfence.off`). Do not delete it. Reload `/wp-login.php` and sign in with a known-good admin. Success signal: login form accepts you without the lockout interstitial.
- 03
Allowlist your current IP before re-enabling the plugin
Once inside wp-admin, open the security plugin’s allowlist / whitelist / trusted IP settings and add your current public IP. If you use a VPN for work, add that egress IP too. Save, then rename the folder back to its original name (or reactivate from Plugins). Confirm you can still log in from a private window.
- 04
Tune lockout thresholds instead of disabling protection
Raise “failures before lockout” slightly if bots share your NAT, shorten lockout duration for accidental lockouts, and ensure xmlrpc or login rate limits still exist. Prefer allowlisting known offices over turning the firewall off. Re-check that 2FA remains enabled for administrators.
- 05
Clear stacked CDN or host WAF blocks on admin paths
If renaming the plugin was not enough, check Cloudflare Firewall Events, host ModSecurity hits, or “block wp-login” rules. Temporarily challenge or allowlist your IP at the CDN, then put a durable allow rule for your office ranges—not a permanent global disable of the WAF.
- 06
Rotate the password if the lockout followed a credential stuffing wave
After access returns, set a new strong admin password and review Users for unknown administrators. Enable or confirm 2FA. If reset email is also blocked by the same security rules, use hosting tools or WP-CLI instead of waiting on mail.
When to stop troubleshooting
Escalate when you cannot reach hosting files or the database, lockouts persist after the plugin is renamed, CDN/host WAF still returns 403 on wp-login, or you see signs of compromise. Do not leave every security layer disabled “until later.” Request a WordPress Repair rescue that restores admin access while keeping firewall coverage in place for visitors and bots.
Information to collect before requesting help
- 01 Exact lockout or 403 message text and screenshot
- 02 Security plugin name and version if known
- 03 Whether a phone hotspot or second network can log in
- 04 Hosting provider and whether you have SFTP / file manager / WP-CLI
- 05 Recent travel, VPN use, or office IP changes
- 06 Cloudflare or host WAF in front of the site
- 07 Whether unknown users, redirects, or malware alerts appeared around the same time
How a professional repairs the problem
Rescue 404 recovers wp-admin through hosting-level file or WP-CLI steps, allowlists the rightful operators, and re-enables the security plugin with sane lockout thresholds—so the site is not left open while you wait. If malware indicators are present, access recovery folds into a full cleanup and hardening pass rather than a permanent firewall bypass.
Frequently asked questions
Will renaming the security plugin delete my settings? +
Is it safe to delete the security plugin to get back in? +
Why did I get locked out when I know the password? +
Can Cloudflare lock me out even after I fix Wordfence? +
Should I turn off login protection permanently? +
Can Rescue 404 unlock the site without me leaving it unprotected? +
Repair dispatch
Still Need Help Fixing Your Website?
If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.
- You will receive a clear explanation of the likely cause.
- We will tell you if the issue falls outside our repair scope.
- No additional work will be performed without approval.
- A backup should be created whenever access and website condition allow it.
Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.