Sometimes you can't remember your access key and you're locked out of your Joomla backend. No worries! Just follow one of these steps.

a) Do you have FTP access?

Go to the folder ROOT > Plugins > System and rename the folder accesskey to something else, like --accesskey. You can now enter the backend without any access key (e.g. https://www.website.com/administrator).

After logging in, go to System > Manage > Extensions, find the Access Key plugin, and uninstall it. Then go to System > Install > Extensions and install it again.

b) Do you have database access?

You can disable the Access Key plugin with this SQL query:

UPDATE #__extensions SET enabled = "0" WHERE name = "PLG_SYSTEM_ACCESSKEY"

(replace #__extensions with the database prefix your site uses, e.g. abc_extensions)

With the plugin disabled, you can enter the backend without any access key (e.g. https://www.website.com/administrator).

Go to System > Plugins > Access Key Plugin, choose a new access key, and enable the plugin again.

Are you sure the key is wrong?

There are four reasons why a key that is correct can fail to work. Check these before you go looking for FTP or database access.

• You tried too often. After ten failed attempts within fifteen minutes from the same IP address, that address is blocked and the key is no longer checked at all: you keep getting the message, the redirect or the 404 page, even once you type the right key. Wait fifteen minutes without trying again and the block lifts by itself.
• Your access expired. Entering the key grants access for twelve hours, tied to the address you came from. After that, or from another network, you have to add the key to the URL again. That is normal, not a lockout.
• The key is in the wrong place in the address. The key is the whole parameter: /administrator?OpenSesame. An address like /administrator?key=OpenSesame does not work, because there the parameter is called key.
• The key contains a dot, a space or a bracket. PHP rewrites those characters in an address before the plugin sees them, so such a key can never be matched. Since version 2.4.0 the plugin refuses a key like that when you save it, but a key saved in an earlier version is still there. In that case use one of the two routes above to get in, and choose a key with only letters, numbers, dashes and underscores.

Prevention for next time: put your own IP address in the Whitelist IP Addresses field. Whitelisted addresses reach the backend without the key and are checked before the block, so they keep working even while a block is active.