# Recipe: recovering administrator access

Work down this list. Stop at the first one that succeeds.

## 1. The administrator path

`/admin` returning 404 usually means the path was changed, not that the panel is gone. Check `site.admin_path` in the `settings` table, or `config/site.local.php` if the operator kept it out of the database.

The physical `admin/` directory is never renamed, so its presence tells you nothing about the URL.

## 2. Password reset

Use the normal reset flow. If the email never arrives, mail is the actual problem — see [SMTP and email](../03-configuration/SMTP-EMAIL.md). Fixing mail is usually faster than any database surgery.

## 3. Rate limiting

Repeated failures throttle sign-in. Wait out the window rather than hammering the form, or clear the relevant `rate_limits` rows if you have database access.

## 4. Verify the account is usable

With database access, check the account:

```sql
SELECT id, email, role, status, account_type, login_disabled
FROM users WHERE email = 'you@example.com';
```

Sign-in requires:

- `role` = `admin`
- `status` = `active`
- `account_type` = `member`
- `login_disabled` = `0`
- `email_verified_at` not null

An `editorial` or `system` account **cannot** sign in by design. Converting one into your administrator account is not the fix — create or restore a real member account instead.

## 5. Repair the account

```sql
UPDATE users
SET role = 'admin', status = 'active', account_type = 'member',
    login_disabled = 0, email_verified_at = NOW()
WHERE email = 'you@example.com';
```

Then use the password-reset flow. Do not paste a hash you generated elsewhere unless you are certain it matches the algorithm and cost the application uses.

## 6. Last resort

Restore from backup. This is why the backup exists, and why rehearsing a restore before you need it matters. See [Backup and restore](../01-getting-started/BACKUP-RESTORE.md).

## Afterwards

- [ ] Confirm SMTP works and a reset email actually arrives
- [ ] Record the administrator path somewhere your team can reach it
- [ ] Keep at least two administrator accounts on different mailboxes
- [ ] Check the audit log for how access was lost

Two administrators on two independent mailboxes prevents almost every lockout in this list.
