Admin accounts can become locked for security reasons. Learn how to unlock them quickly.
Why Accounts Get Locked
Admin accounts lock automatically when:
- Multiple failed login attempts
- Too many incorrect password tries
- Security policy triggered
- Suspicious activity detected
- Manual admin lock
Unlock Via Admin Panel
- Log in as different admin user
- Go to System > Permissions > All Users
- Find the locked user
- Click to edit
- Click "Unlock User Account"
- Save changes
Unlock Using Database
- Access phpMyAdmin or database client
- Go to admin_user table
- Find user by username
- Set is_active = 1
- Clear failures column if present
- Update lockouts field
Database Query
Code implementation available in the full documentation.
Unlock Via Command Line
If you have SSH access:
Code implementation available in the full documentation.
Reset Password
If you can't access admin panel:
- Unlock account via database
- Reset password via database or command
- Generate new password hash
- Update admin_user table
Generate New Password
Code implementation available in the full documentation.
Prevent Account Lockouts
- Use strong passwords
- Enable two-factor authentication
- Configure login failure limits
- Set appropriate lockout duration
- Monitor login attempts
- Use IP whitelisting
Security Configuration
Go to Stores > Configuration > Advanced > Admin:
- Maximum Login Failures: Set limit
- Lockout Time: Duration of lock
- Password Lifetime: Force changes
- Admin Account Sharing: Limit to one IP
Troubleshooting
- Clear browser cache
- Try incognito/private mode
- Check caps lock
- Verify admin URL
- Check server logs
- Review error messages
Recovery Best Practices
- Keep backup admin user
- Document admin credentials securely
- Use password manager
- Enable notifications
- Monitor failed attempts
- Have database access ready