Emergency Admin Access Recovery

Overview

When security features lock you out of your own site, quick recovery is critical. This guide provides emergency access methods when 2FA, IP blocking, or other security features prevent admin login.

---

Emergency Access Methods

Method 1: Disable via wp-config.php

Fastest recovery - Add to wp-config.php:

// Add BEFORE "That's all, stop editing!" line

// Disable ALL Attributes security features temporarily
define('ATTRUA_EMERGENCY_DISABLE', true);

// Or disable specific features:
define('ATTRUA_DISABLE_2FA', true);
define('ATTRUA_DISABLE_IP_BLOCKING', true);
define('ATTRUA_DISABLE_PASSWORD_POLICIES', true);

Access wp-config.php via:

• FTP (FileZilla, WinSCP)
• cPanel File Manager
• SSH/command line

After regaining access:

1. Fix the security configuration
2. Remove emergency disable lines
3. Test access still works
4. Re-enable security features properly

---

Method 2: Rename Plugin Folder

Via FTP or File Manager:

1. Connect to server via FTP
2. Navigate to: /wp-content/plugins/
3. Find folder: attributes-user-access-pro/
4. Rename to: attributes-user-access-pro-disabled/
5. WordPress will deactivate plugin automatically
6. Log in via wp-admin
7. Rename folder back to original name
8. Reactivate plugin
9. Fix configuration

Pros:

• Completely disables plugin
• No code changes needed
• Instant access

Cons:

• Temporarily removes all plugin functionality
• Settings preserved but features disabled
• Requires FTP access

---

Method 3: Database Disable

Via phpMyAdmin or MySQL command line. Replace wp_ with your own prefix, and take a backup first.

Turn two-factor off:

-- every account
DELETE FROM wp_usermeta WHERE meta_key LIKE 'attrua_2fa%';

-- or one account (ID 1 is usually the first administrator)
DELETE FROM wp_usermeta
WHERE user_id = 1
  AND meta_key LIKE 'attrua_2fa%';

That clears attrua_2fa_enabled, attrua_2fa_secret, attrua_2fa_method and attrua_2fa_backup_codes in one go. Add attrua_ptl_backup_codes if anyone uses the passwordless authenticator.

Turn IP blocking off:

-- empty both lists
UPDATE wp_options SET option_value = 'a:0:{}' WHERE option_name = 'attrua_blocked_ips';
UPDATE wp_options SET option_value = 'a:0:{}' WHERE option_name = 'attrua_allowed_ips';

a:0:{} is an empty serialised array, which is what the plugin expects to read back. Do not write 0 or an empty string there.

Switching the feature off is a setting inside attrua_pro_security_settings, not an option of its own, so it is not safely edited with a single UPDATE — that option holds every security setting in one serialised array. Emptying the two lists above is enough to unblock yourself. If you want the feature off as well, use WP-CLI:

wp option patch delete attrua_pro_security_settings enable_ip_blocking

Password expiry:

-- stop expiry prompts for one account by recording the password as set now
UPDATE wp_usermeta
SET meta_value = UNIX_TIMESTAMP()
WHERE user_id = 1 AND meta_key = 'attrua_password_time';

-- and let the next warning be sent again when the time comes
DELETE FROM wp_usermeta
WHERE user_id = 1 AND meta_key = 'attrua_expiration_notified';

Those two together are what the plugin itself does when a password is changed. The value is a Unix timestamp, which is why UNIX_TIMESTAMP() and not NOW().

---

Method 4: Create Emergency Admin

When primary admin locked out:

-- Create new admin user via database

-- Insert new user
INSERT INTO wp_users (
    user_login,
    user_pass,
    user_email,
    user_registered
) VALUES (
    'emergency_admin',
    MD5('TempPass123!'),  -- Change immediately after login!
    'emergency@yoursite.com',
    NOW()
);

-- Get new user ID (use highest number from query)
SELECT ID, user_login FROM wp_users ORDER BY ID DESC LIMIT 5;

-- Grant administrator role (replace 999 with actual ID)
INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (999, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (999, 'wp_user_level', '10');

Login details:

Username: emergency_admin
Password: TempPass123!  (change immediately!)

After login:

1. Go to Users → All Users
2. Fix original admin account
3. Delete emergency_admin account
4. Or change emergency_admin password to secure one for future emergencies

---

### Method 5: WP-CLI Recovery

**If you have SSH/command-line access:**

```powershell
# Navigate to WordPress root directory
cd /path/to/wordpress

# Disable 2FA for user
wp user meta delete admin_username attrua_2fa_enabled

# Reset password
wp user update admin_username --user_pass="NewSecurePassword123!"

# Create new admin user
wp user create recovery recovery@yoursite.com --role=administrator --user_pass="TempPass123!"

# Deactivate plugin temporarily
wp plugin deactivate attributes-user-access-pro

# Reactivate after fixing
wp plugin activate attributes-user-access-pro

---

Preventing Future Lockouts

1. Maintain Emergency Access

Keep emergency admin account:

Create backup admin account:
Username: backup_admin_[random]
Role: Administrator
2FA: Disabled
IP Whitelist: Exempt

Store credentials securely:
- Password manager
- Encrypted document
- Secure company vault

---

2. Whitelist Your IPs

Before enabling IP security:

Add these to whitelist FIRST:
1. Your office IP
2. Your home IP
3. Your VPN exit IP
4. Backup access location IP
5. Server/hosting IP (for cron jobs)

Test access after each addition

---

3. Configure 2FA Properly

Safety measures:

✓ Enable 2FA for admins gradually
✓ Test with secondary admin account first
✓ Generate recovery codes for each admin
✓ Keep one admin without 2FA initially
✓ Ensure email delivery working before enabling

---

4. Document Access Procedures

Create runbook:

Emergency Access Runbook

FTP Access:
Host: ftp.yoursite.com
Username: [encrypted]
Password: [in vault]

phpMyAdmin:
URL: https://yoursite.com/phpmyadmin
Username: [encrypted]
Password: [in vault]

Emergency Contacts:
Hosting Support: [phone]
Backup Admin: [email/phone]

---

5. Regular Backups

Backup before security changes:

Before enabling:
- 2FA
- IP blocking
- Password policies
- Force login

Take full backup:
1. Database backup
2. wp-content folder
3. wp-config.php

Store securely offsite

---

Recovery Testing

Test Emergency Procedures

Quarterly drill:

1. Simulate lockout (use test site/staging)
2. Practice each recovery method
3. Time how long each takes
4. Update documentation
5. Ensure backups accessible
6. Verify FTP credentials still work

---

Staging Environment

Always test on staging first:

1. Clone production to staging
2. Enable security features on staging
3. Test all access scenarios
4. Verify recovery procedures work
5. Document any issues
6. Then deploy to production

---

Common Lockout Scenarios

Scenario 1: IP Change

Problem: Office IP changed, now whitelisted IP invalid
Recovery: Method 1 (wp-config.php disable) or Method 2 (FTP rename)
Prevention: Whitelist IP range (/24) instead of single IP

Scenario 2: 2FA Email Issues

Problem: Email server down, can't receive 2FA codes
Recovery: Method 3 (database disable 2FA)
Prevention: Configure SMTP, test regularly, keep recovery codes

Scenario 3: Password Expired

Problem: Password expired, can't reset due to email issues
Recovery: Method 3 (database remove expiration)
Prevention: Longer expiration period for admins, SMTP configured

Scenario 4: Multiple Security Features

Problem: Locked by 2FA + IP blocking + expired password
Recovery: Method 1 (wp-config.php - disables all)
Prevention: Enable one security feature at a time, test thoroughly

---

When to Contact Support

Seek professional help if:

---

Best Practices

---

articleRelated articles

• User Locked Out (2FA)
• IP Blocking Issues
• White Screen Recovery
• Debug Mode Instructions