Some hosting environments do not allow SSH access to the web server where a Drupal site is installed which makes it impossible to recover the Drupal 8 administrator account password via the command-line. The following method should be employed as a "last resort" when the command-line based password recovery techniques do not work.
The password reset method described below uses a PHP script that must be uploaded to the web server to reset the administrator password. The ability to upload a PHP file to the server where the site is hosted is required for successful execution of this method.
Under the hood, the PHP script executes a full Drupal bootstrap in order to obtain access to the necessary functions that generate the administrative password and then update the database with the new password that you specify via the URL when you execute the script through the web browser.
Note: leaving this password reset script on your server after resetting the password constitutes a highly critical security hole that enables anyone to reset your administrator password. Use this script carefully, and always delete the script after you're finished using it.
- First, copy a file into zip admin-pass-reset.zip.
- Copy and paste the following contents into the file, and save the file.
- Upload the file to the root of the Drupal installation directory (i.e., where index.php, update.php, robots.txt and other files and directories exist).
- Execute the script, by requesting the file in a web browser using the following URL pattern:
In the above URL,
example.comwith your actual domain name,
gh34tu9.phpwith the actual file name that you specified in step one above,
mypasswordwith the desired new password.
Note: It is highly recommended you choose a password that contains upper and lowercase letters and numbers, and is at least 12 digits in length.
- If the script executes successfully, you will see the text "Done" in your web browser. The password of the administrative account created when installing Drupal (i.e., user/1) will be changed to "mypassword" (or whatever value you specify).
- Finally, delete the file from the Drupal installation root directory.
Reset administrator account username
If you can't remember (or simply do not know) the username of the administrator account, in the script above, change
// 'name' => 'admin', to
'name' => 'admin', and the username will also be changed to "admin". You may also reset the administrator's email address in the same way, by "uncommenting" (remove the
//) the line for the email address in the script above.
For your convenience, the source file of the script above is attached below inside a ZIP file. You may download the zip file, unzip it, and upload the file to the server. Make sure you change the file name to something other than the original name. Finally, don't forget to delete the file as soon as you have changed the password.
This document contains insecure code
Your edits to this page are welcome. But please do not change its status to anything other than "Insecure code".
Login blocked after 5 failed login attempts
DELETE FROM `flood`;