Add a New User via functions.php

If you’re locked out of wp-admin, have only FTP or file manager access, and can’t reset the password from phpMyAdmin, you can add an admin user from functions.php with a few lines of PHP.

The snippet also shows how username_exists(), email_exists(), wp_create_user() and WP_User::set_role() work together when you create a WordPress user programmatically.

Security Warning: Use Once, Then Delete

This code stores a plain-text password in a PHP file. Treat it as a one-time recovery tool, not something that lives in your theme.

• Remove the code as soon as you’ve logged in once.
• Use a long, unique password, then change it again from Users > Profile after you log in.
• Never commit it to Git or leave it on a staging or backup copy of the site.
• If you found a snippet like this on a site you didn’t add it to, treat the site as compromised. Injected code that creates admin accounts is a common backdoor, see how to fix a hacked WordPress site.

Add an Admin User via functions.php

Add this to the active theme’s functions.php. If the theme is broken or you’re not sure which one is active, save it as a PHP file (starting with <?php) in wp-content/mu-plugins/ instead, since must-use plugins load regardless of the theme.

function sv_wp_admin_account() {
	$user  = 'Username';
	$pass  = 'Password';
	$email = '[email protected]';

	if ( ! username_exists( $user ) && ! email_exists( $email ) ) {
		$user_id = wp_create_user( $user, $pass, $email );

		if ( ! is_wp_error( $user_id ) ) {
			$user = new WP_User( $user_id );
			$user->set_role( 'administrator' );
		}
	}
}
add_action( 'init', 'sv_wp_admin_account' );

Replace the username, password and email with values no existing user has. Then load any page on the site, front end or login screen, and log in with the new details. Delete the code right after.

How It Works

The init hook fires on every request, so the account is created on the first page load after you save the file. The checks stop it from running twice.

• username_exists( $username ) returns the user ID if that login is taken, or false.
• email_exists( $email ) does the same for the email address.
• wp_create_user( $username, $password, $email ) creates the user with the site’s default role and hashes the password. It returns the new user ID, or a WP_Error on failure.
• new WP_User( $user_id ) loads the user, and set_role( 'administrator' ) removes any existing roles and assigns the new one.

The is_wp_error() check matters: if creation fails, WP_User would otherwise receive an error object instead of a user ID.

Safer Alternative: WP-CLI

If you have SSH access, skip the file edit entirely. One command creates the admin user and nothing is saved to disk:

wp user create newadmin [email protected] --role=administrator

Leave out --user_pass and WP-CLI generates a random password and prints it once. See the wp user create reference for all options, or the WP-CLI guide if you haven’t used it before.

Create a User With Any Role in One Call

For plugins and imports, wp_insert_user() accepts the role directly, so you don’t need the separate set_role() step:

$user_id = wp_insert_user( array(
	'user_login' => 'editor1',
	'user_email' => '[email protected]',
	'user_pass'  => wp_generate_password( 24 ),
	'role'       => 'editor',
) );

if ( is_wp_error( $user_id ) ) {
	error_log( $user_id->get_error_message() );
}

Use any registered role slug: administrator, editor, author, contributor, subscriber, or a custom one.

FAQs

Common questions about adding WordPress users with code: