WordPress 'Sorry, You Are Not Allowed to Access This Page' Fix (2026)

You log in successfully - then wp-admin greets you with "Sorry, you are not allowed to access this page." Authentication works; authorization broke. Your account lost its capabilities. Three real causes: a plugin conflict, a table-prefix mismatch after migration, or a hacked demotion. Diagnose in this order.

Step 1: Rule Out a Plugin (2 Minutes)

Via FTP, rename wp-content/plugins to plugins_off and reload wp-admin. Dashboard opens? A plugin - usually a role editor, security, or membership plugin - corrupted capabilities. Rename back, reactivate one by one. Still blocked? Keep going.

Step 2: Check the Table Prefix (Post-Migration Cases)

Capabilities are stored in the usermeta table with keys named after the table prefix: wp_capabilities for the default wp_ prefix. If your tables were renamed (to abc_ during a migration or security hardening) but wp-config's $table_prefix was later changed back, or the rename was partial - every role silently disappears.

• Open wp-config.php - note $table_prefix (e.g., 'abc_')
• In phpMyAdmin, open [prefix]_usermeta and look at the meta_key values
• Keys say wp_capabilities but prefix is abc_? Update them: meta_key must be abc_capabilities, abc_user_level, etc.

Step 3: Check for a Hack

In phpMyAdmin open [prefix]_users. Unknown administrator accounts, or your account missing? Compromised. Then check your row in usermeta - the capabilities value should exist. If a hacker demoted you, fix the site properly before restoring access or they'll do it again: hacked site recovery.

Step 4: Restore Admin via phpMyAdmin

1. 1.In wp_users, find your user ID
2. 2.In wp_usermeta, find the row: user_id = yours, meta_key = [prefix]_capabilities
3. 3.Set meta_value to: a:1:{s:13:"administrator";b:1;}
4. 4.Set the matching [prefix]_user_level row to 10. Reload wp-admin.

Step 5: Create a Fresh Admin via WP-CLI

Cleaner than editing serialized data - if your host offers SSH/WP-CLI:

Log in as the new admin, then fix or delete the broken account from Users > All Users.

Related Errors

Redirected to login instead of an access-denied message? That's a session problem: login redirect loop fix. Seeing a permission warning on a specific file operation: 403 Forbidden fix.