The password works and the login goes through, then the dashboard, or one page of it, answers "Sorry, you are not allowed to access this page." WordPress knows who you are but no longer believes you are an administrator. Where the message appears tells you why: on every admin page it is almost always a database detail left behind by a host move or a security tweak; on one page only it is usually a plugin page that no longer exists. Below is a rebuilt example (not a real client), then how to tell the cases apart and the fix for each.
/wp-admin/ itself, not a bookmark. If the dashboard loads and only a saved link fails, skip to fix 3: that page belonged to a plugin that is switched off, removed or renamed.wp_capabilities. If the tables were renamed to a new prefix (say wpk3_) and $table_prefix in wp-config.php was updated to match, those stored names still start with the old one, so WordPress finds no role for anybody. Take a database backup first. Then in phpMyAdmin (from the host's control panel):
wpk3_options), rename the row wp_user_roles to wpk3_user_roles;wpk3_usermeta), rename every meta_key that starts with the old prefix: at least wp_capabilities and wp_user_level, plus wp_user-settings and similar.UPDATE wpk3_usermeta SET meta_key = CONCAT('wpk3_', SUBSTRING(meta_key, 4)) WHERE meta_key LIKE 'wp\_%'; (the 4 is the old prefix's length plus one). If only some tables were renamed, or $table_prefix does not match the tables, fix that first: $table_prefix must equal the prefix the tables actually carry.wp_usermeta (your prefix), find the rows for your user ID (in wp_users), and check wp_capabilities. For an administrator it reads a:1:{s:13:"administrator";b:1;} and wp_user_level reads 10. Set them, log out and in again. Then ask how it changed: a role-editor plugin, another admin, or someone who should not have had access. If you find administrators you do not know in Users, treat it as a hacked site, not a settings slip.admin.php?page=some-plugin belong to a plugin. If that plugin is deactivated, deleted or renamed its page, the old link gives this message. Open the dashboard and find the plugin's menu again; reactivate it in Plugins if you still need it. Nothing is broken.wp-config.php such as define('DISALLOW_FILE_MODS', true); or define('DISALLOW_FILE_EDIT', true); switches those screens off for everyone, often added by the host or a security checklist. That is a sensible lock; change it only if you mean to, and put it back afterwards.| What you see | Usual cause | Usual fix |
|---|---|---|
| Every admin page refuses you, right after a host move or a "change the prefix" tip | Role stored under the old table prefix | Rename user_roles in options and the capabilities and user_level keys in usermeta to the new prefix |
| Every admin page refuses you, prefix unchanged | Your account has no administrator role | Set capabilities and user_level back to administrator and 10; find out why it changed |
| One bookmarked admin page refuses you, dashboard is fine | Plugin page no longer exists | Use the menu; reactivate the plugin if you need it |
| "Not allowed to install plugins" or "edit templates" | DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT in wp-config.php | Deliberate lock: lift it only while you need it |
| Network screens refuse a site admin | Multisite needs a super admin there | A super admin grants it |
| Unknown administrators in Users | Someone else got in | Hacked-site clean-up, new passwords everywhere |
Fixes 1 and 2 are a few rows in the database and usually take minutes once the cause is clear. If the database is unfamiliar ground, that is what the box below is for. Related: a login page that keeps reloading and "403 Forbidden".