Hushfort
Menu

Locked out? Here's the way back in.

Updated

Take a breath. Nothing is broken. Hushfort hides the door, but it always leaves you a key. Pick the first option that fits your situation.

You will need one of these: access to wp-config.php (through your host's file manager, FTP or SSH), or your 2FA recovery codes.

1. You forgot the hidden login URL

Open wp-config.php in your site's root folder and add this line above /* That's all, stop editing! */:

define( 'GATEKEEPER_LOGIN_SLUG', 'new-path' );

Save the file. The login form now opens at yoursite.com/new-path. Replace new-path with any path you like, using letters, numbers and hyphens.

You can leave the line in place. While it is there, it sets the login path. To go back to the path in your settings, delete the line.

Tip: once you're in, open the Hushfort dashboard. The "If you lose access" card shows your current login URL. Save it in your password manager.

2. You lost the phone with your authenticator app

Use a recovery code. On the code screen, enter one of the recovery codes you downloaded or printed when you set up two-factor. Each code works once.

No recovery codes left? Add this line to wp-config.php:

define( 'GATEKEEPER_2FA_DISABLE', true );

This switches two-factor off for the whole site. Log in, open your profile, set up two-factor again on your new phone, save the new recovery codes, then remove the line. Leaving it in place keeps two-factor off for everyone.

Another admin can help too. Any administrator can reset two-factor for your account from your user profile.

3. Your IP is locked out after too many attempts

Wait for the lockout to end. You set how long it lasts in Login Limits. If you can't wait, try from another network, such as your phone's mobile data, or ask another administrator to add your IP to the allowlist.

4. Nothing else works: remove the plugin folder

Using your host's file manager or FTP, open /wp-content/plugins/ and delete (or rename) the hushfort-security folder. WordPress switches the plugin off, and wp-login.php opens again as normal.

Your settings stay in the database. When you reinstall and activate Hushfort, check the login path before you log out.

After you're back in

  • Save your login URL somewhere private, such as your password manager.
  • Download fresh recovery codes if you used any.
  • Add your own IP to the allowlist if you work from a fixed address.
  • Test new settings in a private browser window before you log out of your main one.

Still stuck?

Email [email protected]. Tell us what you see (a 404, a lockout message, a code screen) and your WordPress version. Never send passwords or recovery codes by email.