Can’t Login Due to Missing Verification Email – Stuck in Login Loop

The login loop issue resolved itself automatically, but the main issue remains. It has been over three days, and I still can’t access my website. I have the correct username and password, but when I try to log in, it asks for additional verification via email. However, I’m not receiving the verification email for some reason.

I’m the owner/admin of the website, and the email connected to it previously received these verification emails without any issue. Now, I’m completely locked out and unable to bypass this step.

Can someone please help me resolve this?

Hello,

It has been nearly a week, and I am still unable to access my website because I am not receiving the verification email required for login. I have also noticed unusual activity that may be connected to this issue.

What Happened Before the Lockout:

• I was working on a ticketing system for my website. After beta testing, I launched it and briefly tested it.
• Later that night, I left it running and went to sleep.
• The next morning, I noticed what appeared to be a bot attack on the ticketing system. While I am unsure if it was a bot or a real user, the activity looked suspicious.
• When I tried to log in to check, I was locked out due to email verification, which I never received.

Strange Observations & Backup Failure:

• On my testing account, I received a WordPress email containing the test account’s username and email.
• That same email also included the custom login URL I had set, along with the recovery/reset password link.
• The most concerning part is that, on the same night, my backup system also stopped sending confirmation emails. This is unusual because my storage is far from full, and backups always generate email notifications—but I haven’t received any since the lockout.
• Other connected services (e.g., forums, HubSpot) are working fine, which suggests that the issue is specific to WordPress.

Current Situation:

• I have my username and password, but without email verification, I can’t log in.
• I still have 2FA enabled and backup codes from Wordfence, but without email access, I cannot proceed with recovery.
• There is a possibility that my admin email was changed, which would explain why I’m not receiving verification or backup emails. This could also mean someone else might have partial access.
• Since I am completely locked out, I cannot verify if anything else has been altered on my website.

Request for Assistance:

Is there a way to manually disable email verification or regain access another way? If the admin email was changed, is there a way to confirm or reset it? Any guidance would be greatly appreciated.

Thanks!

Hi @expertcontentnest,

Thank you for reaching out! From what you reported, it sounds like there may be an issue with WordPress sending emails. If you are not receiving any emails, you might want to check:

• The emails (they come from [email protected]) are getting sent to your junk mail folder by your email client or provider. Make sure and whitelist or add your website to the list of safe domains so you get emails consistently.
• Your web server is having a problem with the email software on it. This isn’t like regular emails you send and receive, but rather server alert messages. Usually, a restart of postfix or sendmail (whichever is installed) can fix it. Your hosting provider may need to help with this.
• Your hosting provider has disabled SMTP from the server for some reason like preventing the server from being used to spam people.
• You have a third party plugin for sending emails with another service, like Gmail, which isn’t working. Reaching out to the plugin author for support can help.

If you’re not receiving the verification emails to log in, you can temporarily deactivate Wordfence by doing the following:

• Please use FTP/SFTP — or any file manager your web host provides via their administration panel.
• Look inside the /wp-content/plugins/ directory and rename the wordfence directory to wordfence.bak.
• Once you have logged in to your WordPress admin you can name the folder back to wordfence again.
• Refresh your dashboard and you should be able to see Wordfence Active again. If not, go to the Plugins page and Activate it.

Once in the dashboard, please review the reCAPTCHA settings in Wordfence. In particular, check what scores you see in Score Statistics in Wordfence > Login Security > Settings > reCAPTCHA. We don’t receive inside information from Google about why a human may sometimes receive a low enough score to always require verification, but in some cases, you may need to adjust the threshold to .3 or .4.

Please let me know if you have any questions!

Thanks,
Margaret

Hi Margaret,

I’m not exactly sure what happened, but this morning, I received two emails in my Gmail account—one notifying me that a new user registered in the ticketing system (which I have now disabled, as it wasn’t working properly and I’ll fix it later), and another about a backup for ExpertContentNest.

At first, I was confused since backup emails had stopped arriving ever since the lockout. So, I quickly got on my laptop, attempted to log in, and this time, I finally received the verification email. Once logged in, I whitelisted my IP to bypass restrictions.Steps I Took After Logging In:

? Updated all plugins and the theme to ensure everything is up to date.
? Performed a security scan after making the necessary changes—no issues were found.
? Lowered the reCAPTCHA threshold for login, but it still blocked me, so I had to unblock myself via the dashboard and reset it to its original state.
? Removed all auto-created users that were added through the ticketing system.
? Changed my login URL, as WordPress had shared it via email with everyone who logged into the ticketing system.

That’s everything I’ve done for now. If there’s anything else I should check or perform, please let me know!

Thanks again for your help—I truly appreciate it! ??

Best,
ExpertContentNest

Hi ExpertContentNest,

Thanks for following up, I’m glad to hear you were able to log in and that emails are working now!?

Due to possible differences in form fields and the login flow, our 2FA and reCAPTCHA features are currently only officially supported for the default WordPress/WooCommerce login and registration pages. In the reCAPTCHA?Score Statistics?table, if you see only entries with a score of 0 or fewer entries than expected, it’s possible that the custom login plugins are interfering with the reCAPTCHA functionality.

Thanks,
Margaret