Sometimes you can't remember your access key and you're locked out of your Joomla backend. No worries! Just follow one of these steps.

a) Do you have FTP access?

Go to the folder ROOT > Plugins > System and rename the folder accesskey to something else, like --accesskey. You can now enter the backend without any access key (e.g. https://www.website.com/administrator).

After logging in, go to System > Manage > Extensions, find the Access Key plugin, and uninstall it. Then go to System > Install > Extensions and install it again.

b) Do you have database access?

You can disable the Access Key plugin with this SQL query:

UPDATE #__extensions SET enabled = "0" WHERE name = "PLG_SYSTEM_ACCESSKEY"

(replace #__extensions with the database prefix your site uses, e.g. abc_extensions)

With the plugin disabled, you can enter the backend without any access key (e.g. https://www.website.com/administrator).

Go to System > Plugins > Access Key Plugin, choose a new access key, and enable the plugin again.

Are you sure the key is wrong?

Since version 2.3.0 there are two reasons why a key that is correct can suddenly stop working. Check these before you go looking for FTP or database access.

• You tried too often. After ten failed attempts within fifteen minutes from the same IP address, that address is blocked and the key is no longer checked at all: you keep getting the message, the redirect or the 404 page, even once you type the right key. Wait fifteen minutes without trying again and the block lifts by itself.
• Your access expired. Entering the key grants access for twelve hours, tied to the address you came from. After that, or from another network, you have to add the key to the URL again. That is normal, not a lockout.

Prevention for next time: put your own IP address in the Whitelist IP Addresses field. Whitelisted addresses reach the backend without the key and are checked before the block, so they keep working even while a block is active.