Create WordPress Admin User with PHP

#wordpress

If you’re working on a WordPress website that doesn’t have an administrator login, or the client/site owner has forgotten all their login details, then you can quickly create a new Admin user with only FTP access.

Creating a WordPress Administrator User with PHP

Use the following steps to create a new administrator level WordPress user programmatically.

Step 1: Connect with FTP

Connect to the WordPress site’s file system using SFTP/FTP and open up the functions.php file of the active theme. If you’re not sure what the active theme is you can view the source in your browser and search for text matching /wp-content/themes/. The folder after themes/ is the active theme for the site.

Step 2: Add Functions to Create Admin Users

Add the following PHP code to the theme’s functions.php file:

/**
 * Programmatically Create Admin User in WordPress
 */
function kevinlearynet_add_user() {

  // Only when ?create-admin-user is in the URL
  $create_admin_user = isset( $_GET['create-admin-user'] );
  if ( !$create_admin_user ) {
    return;
  }

  // Change these values to whatever you want
  $username = 'adminuser';
  $password = 'password';
  $email = 'you@domain.com';
  $login_url = wp_login_url();

  // No user exists
  if ( username_exists($username) == null && email_exists($email) == false ) {
    $user_id = wp_create_user( $username, $password, $email );
    $user = get_user_by( 'id', $user_id );
    $user->remove_role( 'subscriber' );
    $user->add_role( 'administrator' );
    wp_die( "Administrator user added for $email.<br><br><strong><a href='$login_url'>Login Now</a></strong>" );
  }

  // User already exists
  else {
    $user = get_user_by( 'email', $email );
    wp_set_password( $password, $user->ID );
    wp_die( "Administrator user already exists for $email, but we've updated the password for you.<br><br><strong><a href='$login_url'>Login Now</a></strong>" );
  }
}
add_action('init', 'kevinlearynet_add_user');

Step 3: Create The Admin User

Now that the code is in place you can visit the site at https://www.yourdomain.com/?create-admin-user to add the user to the system.

Step 4: Remove Functions

Once you’re done it’s very important to remove the functions that we added to the theme’s functions.php file for security reasons, this should really only be implemented once to gain access and then must be removed.

Alternative: WP-CLI

If you have SSH access to the server, skip the PHP approach entirely and use WP-CLI, which most managed WordPress hosts (WP Engine, Kinsta, Pressable) provide out of the box:

# Create a new administrator
wp user create adminuser you@domain.com --role=administrator --user_pass="$(openssl rand -base64 18)" --porcelain

# Or reset the password on an existing user
wp user update you@domain.com --user_pass="new-strong-password"

# List existing administrators to see what's already there
wp user list --role=administrator --fields=ID,user_login,user_email

This is faster, leaves no code on the server to clean up, and never exposes anything to the public internet. The functions.php approach above is for the situations where FTP is the only access you have.

Alternative: Direct Database Access

With phpMyAdmin or a MySQL client you can also reset an existing user’s password directly, which avoids creating a new account entirely:

UPDATE wp_users
SET user_pass = MD5('temporary-password')
WHERE user_email = 'you@domain.com';

WordPress still accepts MD5 passwords for backwards compatibility and automatically rehashes them with its stronger algorithm on first login. Change the temporary password immediately after logging in.

Security Notes

A few things to get right when using the PHP snippet:

Use a strong, unique password in the snippet, not password. Bots hit new WordPress logins within minutes.
Rename the query parameter to something unguessable (for example ?create-admin-user-x8k2m) so nobody else can trigger it while it’s live.
Remove the code immediately after logging in. Leaving it in place is a standing backdoor into the site.
Audit the user list afterwards. If you had to break into a site this way, check for administrator accounts you don’t recognize while you’re in there.

Summary

You should now have access to your WordPress site as an Administrator. This is a handy tool to have at your disposal when working with new clients as a WordPress consultant. It’s often easier to use than other common methods, and it avoids a common blocking point when working with a new WordPress website. When SSH is available, prefer WP-CLI; when all you have is FTP, the functions.php snippet gets it done.

DEV Community