# How do I recover my website content when locked out of the CMS? > If your website is still live but you are locked out of the admin, you recover your content by capturing it from the published pages, because anything that is publicly visible can be read and saved without any login. Being locked out, whether you lost the credentials, an agency or former developer controls the account, or the platform is abandoned, blocks the back end, but it does not hide the front end, and the front end contains your content: the text, images, and metadata that visitors and search engines already see. So a crawler can read the live site page by page and return those as files, giving you your content, your images, and a full list of your URLs, which you then rebuild on a platform you control. The one thing capture cannot reach is anything that was never public, such as drafts, private pages, or the database behind the login, but for most sites the public content is the content that matters. Once rebuilt, you point your domain at the new site, ideally keeping the same URLs so nothing is lost. WPBuildAI scans your live site and returns the content, images, and URL list as files, so you can rebuild even when you cannot get into the admin. Source: https://wpbuildai.com/how-to-recover-a-website-when-locked-out-of-the-cms/ By lawrence-arya ยท 2026-06-06 --- If your website is still live but you are locked out of the admin, you recover your content by capturing it from the published pages, because anything that is publicly visible can be read and saved without any login. This is the key that turns a stressful lockout into a solvable problem. Being locked out, whether you lost the credentials, an agency or former developer controls the account, or the platform is abandoned, blocks the back end, but it does not hide the front end, and the front end contains your content: the text, images, and metadata that visitors and search engines already see. So a crawler can read the live site page by page and return those as files, giving you your content, your images, and a full list of your URLs, which you then rebuild on a platform you control. The one thing capture cannot reach is anything that was never public, such as drafts, private pages, or the database behind the login, but for most sites the public content is the content that matters. Once rebuilt, you point your domain at the new site, ideally keeping the same URLs so nothing is lost. WPBuildAI scans your live site and returns the content, images, and URL list as files, so you can rebuild even when you cannot get into the admin. Lockouts often follow a compromise rather than a forgotten password, and the window is short: Patchstack reports a [weighted median time to first exploit of five hours](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) for heavily targeted WordPress vulnerabilities, which is usually faster than anyone notices they have lost access. ## Locked out of the back end, not the front end The insight that solves this is the separation between the admin and the public site. Being locked out means you cannot log in to manage the site, but the site itself is still serving pages to the world, because that is what a live site does. Every visitor and every search engine is reading your content right now without logging in, which means your content is reachable without the admin. So the lockout, painful as it is, blocks your ability to edit, not your ability to retrieve what is published. This reframes the situation from your content is trapped to your content is on display and can be copied. The recovery, then, is not about breaking back into the admin; it is about reading what the site already shows everyone. ## What you can capture without admin Working from the public pages, you can recover the substance of your site. The text of every page and post is there to be read and saved. The images are loaded by the pages, so they can be downloaded as files. The titles and meta descriptions sit in each page's markup, so they come across as metadata. And by following the links, a crawler builds a full list of your URLs, which matters both to capture every page and to keep your addresses when you rebuild. Web Almanac 2024 ([HTTP Archive](https://almanac.httparchive.org/en/2024/)) is a reminder of how much a site holds, especially in images, so a systematic capture recovers more than gathering pages by hand. This is the same capture approach as [exporting a site with no export button](/how-to-export-a-website-with-no-export-button), applied to a lockout instead of a closed platform. ## What capture cannot reach It is essential to be honest about the boundary, so you plan around it. Capturing from public pages recovers what is public, and only that. It cannot reach drafts, private or members only pages, or the database behind the login, because those are not served to the world, and the lockout genuinely blocks them. It also cannot recover settings, user accounts, or anything that lived only in the admin. So if your unrecovered material includes private content or database records, capture will not retrieve it, and that part depends on regaining actual access. For most sites, though, the public content, the pages that rank and that visitors use, is the bulk of the value, so capture recovers what matters even though it cannot recover everything. Knowing the limit lets you set the right expectation and pursue access separately if private data is at stake. ## Rebuild on a platform you control With the content captured, you rebuild on a platform you control, free of the lockout. Recreate your pages and posts from the captured content, bring in the images so they are hosted on the new site, and restore the titles and descriptions. The goal is a working site that you own and can edit, holding everything that was public on the old one. This is ordinary site building from recovered material, the same as [rebuilding a site from scratch](/rebuild-wordpress-site-from-scratch-no-data-loss), except your source is the captured public content rather than a backup. Prioritize the pages that matter most, since traffic concentrates on a minority of them, as the [Ahrefs study](https://ahrefs.com/blog/search-traffic-study/) shows, so your most valuable pages are rebuilt and verified first, and the rest follow. ## Keep your URLs and point the domain To preserve your SEO through the recovery, keep your URLs the same on the rebuilt site wherever you can, so the addresses search has indexed and others have linked still resolve. That is why capturing the full URL list matters: it is your map for recreating the same structure. Then point your domain at the new site so visitors reach it. The domain is separate from the CMS, and regaining or retaining control of it is the more important access fight, because without the domain you cannot direct people to your rebuild, no matter how complete it is. If any URLs do change in the rebuild, set 301s as in any [site move](https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes), but keeping them identical is cleaner. The platform is not a ranking factor, as the [Backlinko analysis](https://backlinko.com/search-engine-ranking) shows, so a faithful rebuild at the same URLs keeps your rankings. ## Capture now, while the site is live The most important practical point is timing: capture while the site is still up. A lockout can become a takedown, the platform could be shut off, or whoever controls the admin could remove content, and once the site is no longer live, the easy public capture is gone and you are left with the harder, partial route of archive recovery, covered in [recovering old content from the Wayback Machine](/recover-old-website-content-wayback-machine). So the first move on discovering a lockout is not to spend weeks fighting for admin access while the clock runs; it is to capture your public content immediately, so you hold it no matter what happens to the live site. Pursue access in parallel, but secure the content first, because a live site is the best source you will ever have and it may not stay live. ## Steps to recover when locked out 1. **Confirm the site is still live** and serving your content publicly. 2. **Capture immediately:** content, images, metadata, and the full URL list. 3. **Accept the limit:** public content only, not drafts or the database. 4. **Rebuild on a platform you control** from the captured content. 5. **Keep the same URLs** where possible, and 301 any that change. 6. **Regain or retain the domain** and point it at the new site. ## Worked example: recovering from a lost account Imagine a business that can no longer access its website admin because a former developer controls the account and is unresponsive, while the site is still live. Rather than waiting indefinitely for access, the team captures the public site immediately: a crawler reads every page, saving the text, downloading the images, recording the titles and descriptions, and building the full URL list. They accept that a few draft posts in the admin are unrecoverable, but everything public, which is nearly all their value, is now in hand as files. They rebuild on a platform they control, recreating the pages at the same URLs, and they work in parallel to regain control of the domain. Once the rebuild is verified, they point the domain at it. Their content and rankings survive because they captured the live site while they still could, instead of losing it if the old site had been taken down mid dispute. ## Limitation: capture is public-only and not a substitute for access It is honest to bound this clearly. Capturing from the live site recovers your public content and lets you rebuild, but it is not a full account recovery: it cannot retrieve private content, drafts, user data, or settings locked behind the admin, and it does not resolve the underlying access or ownership dispute. So treat it as rescuing what is public and getting you back to a site you control, while access or domain disputes are pursued through their own channels. It is also strictly dependent on the site still being live; once it is gone, only partial archive recovery remains. Capture is the fast, reliable way to secure the content that matters most, not a replacement for regaining proper access where private data or the domain itself is at stake. ## Common mistakes - Fighting for admin access for weeks while the live site, your best source, sits uncaptured. - Assuming the content is trapped because the admin is locked, when the front end is public. - Capturing text but missing images, which break when the old site goes down. - Changing URLs in the rebuild without 301s, losing rankings unnecessarily. - Recovering the content but neglecting the domain, so visitors cannot reach the rebuild. ## Key points If you are locked out of the CMS but the site is still live, you recover your content by capturing it from the published pages, because being locked out blocks the back end, not the public front end where your content already is. A crawler returns your content, images, metadata, and full URL list as files, with no login needed, which you rebuild on a platform you control, keeping the same URLs where possible and pointing your domain at the new site. Capture reaches only public content, not drafts, private pages, or the database, so pursue actual access separately if private data is at stake. Above all, capture immediately while the site is live, because once it is taken down only partial archive recovery remains. The domain is the access fight that matters most, since without it you cannot direct visitors to your rebuild. WPBuildAI scans your live site and returns the content, images, and URL list as files, so you can rebuild even when you cannot get into the admin. Send your web address for a free analysis. Not affiliated with WordPress, Lovable, Webflow, Shopify, Wix, or Squarespace.