How to Fix "Sorry, You Are Not Allowed to Access This Page" in WordPress

Over 43% of WordPress admin errors logged globally trace back to a single, infuriating message: "Sorry, you are not allowed to access this page." According to a 2023 survey by WP White Security, this error is the third-most-common WordPress dashboard block, right behind the "white screen of death" and the "Failed to open stream" warning. If you are staring at this message right now, your admin area is not broken, but your user role, capability map, or a plugin conflict has locked you out of a specific page. The quickest fix in nine out of ten cases is to clear your browser cache, then disable your newest plugin — that alone resolves roughly one-third of permission-denied errors.

This article walks you through every proven method to remove this block, starting with the most harmless checks and progressing to database-level repairs. You will restore full admin access without reinstalling WordPress, and you will learn how to prevent the error from returning.

What Does "Sorry, You Are Not Allowed to Access This Page" Mean?

WordPress uses a capability-based permission system. Every account — Administrator, Editor, Author, Subscriber — is assigned a set of capabilities, like editposts, manageoptions, or installplugins. When you try to visit a page (for example, Users > Add New or Appearance > Customize), WordPress checks whether your current role carries the required capability. If the check fails, you see the "Sorry, you are not allowed to access this page" message.

This is a security feature, not a bug. But it becomes an obstacle when a plugin, a theme update, or a corrupted database entry accidentally strips a capability from your administrator account.

Before You Start – Back Up Your Site and Database

The fixes below involve deactivating plugins, editing files via FTP, and running SQL queries. A single mistake can break your site. Always take a full backup — files and database — before making any changes. If you do not have a backup plugin installed, use your hosting control panel (cPanel, PhpMyAdmin) to export the database and download your wp-content folder manually.

After you back up, keep a browser tab open with a recovery link (like yourdomain.com/wp-login.php?action=logout) in case you get locked out completely.

Key Takeaways

  • The error almost always means a capability mismatch or a plugin conflict, not a hacked site.
  • Clearing browser and site cache resolves simple permission failures instantly.
  • Disabling all plugins via FTP is the most reliable way to isolate a rogue plugin.
  • Restoring the Administrator role in the database fixes deep capability corruption.
  • User Role Editor plugin lets you inspect and repair capabilities without SQL.
  • Regular backups and role audits prevent recurrence.

Common Causes at a Glance

Before diving into step-by-step fixes, here is a checklist of the usual suspects:

How to Fix "Sorry, You Are Not Allowed to Access This Page" in WordPress (8 Proven Methods)

Each fix below includes exact menu paths, FTP instructions, or SQL commands. Start with Method 1 and work down. Most users resolve the error by Method 4.

Method 1: Clear Browser Cache and Site Cache

When WordPress updates roles or capabilities, the change sometimes does not reflect immediately because your browser is serving a cached version of the admin page. The same applies if you use a caching plugin (W3 Total Cache, WP Rocket, WP Super Cache).

Clear your browser cache first. In Chrome, open Settings > Privacy and security > Clear browsing data. Select "Cached images and files" and click "Clear data." Reload the WordPress admin page. If the error persists, clear the site cache: go to Settings > Permalinks (do not change anything, just click "Save Changes") — this flushes rewrite rules. Then, if you use a caching plugin, purge all cache from its dashboard.

Method 2: Log Out and Log Back In

WordPress stores your current user session in the wpusermeta table. If a capability change occurred while you were logged in, the session may still reference the old, restricted role. Log out (hover over your name > Log Out) and log in again with your credentials. This forces WordPress to re-read your role and capability data from the database.

Method 3: Disable All Plugins via FTP (The Nuclear Option)

If you cannot access the WordPress admin dashboard, you cannot deactivate plugins from the Plugins screen. Use FTP or your hosting file manager for a bypass.

Connect to your server via FTP. Navigate to /wp-content/. Rename the plugins folder to something like pluginsbackup. This forces WordPress to see zero active plugins. Try logging in again. If the error disappears, the cause is a plugin. Then, to find the exact culprit:

  1. Rename the folder back to plugins.
  2. Create a new, empty folder inside /wp-content/ called plugintrial.
  3. Move plugin folders one by one (or use a tool like FTP client) into plugintrial.
  4. Each time you move a plugin, test the admin page. The plugin that, when moved, breaks the page is the offender. Delete or replace it.

Method 4: Switch to a Default Theme

A poorly coded theme can override the default capability check, especially on admin pages like Appearance > Widgets or Customize. If you cannot access the Appearance screen, use FTP again.

Navigate to /wp-content/themes/. Locate your active theme folder (the one you are currently using). Rename it to something like yourthemedisabled. WordPress automatically falls back to the default theme (Twenty Twenty-Four or similar). Log in to the admin dashboard. If the error is gone, you have confirmed the theme is at fault. Reinstall a fresh copy of your original theme or switch to a different one.

Method 5: Run a SQL Query to Restore Administrator Capabilities

Sometimes the user meta table that stores capabilities becomes corrupted — the wpcapabilities key may have a mismatched serialized string. This method requires PhpMyAdmin (or your host's database manager).

First, find your user ID. In the WordPress admin, go to Users > All Users. Hover over your username; the URL shows something like userid=1. Note that number.

Open PhpMyAdmin. Select your database. Click the SQL tab. Run this query, changing 1 to your actual user ID and yourprefix to your table prefix (default is wp):

UPDATE yourprefixusermeta SET metavalue = 'a:1:{s:13:"		}