WordPress Login Redirect Loop
WordPress Errors
Right password, no error, and straight back to the login screen.
You submit correct credentials at wp-login.php. There is no “wrong password” message — the page simply reloads the login form. Repeat forever.
What it actually means
A login has two halves. WordPress checks the password, then sets a cookie proving you are signed in, then sends you to the dashboard. The dashboard checks the cookie, finds nothing, and sends you back to log in.
So the password is almost never the issue. Something is preventing the session cookie from being set, stored, or read on the next request — and each round trip looks exactly like a failed login even though authentication itself is succeeding.
What usually causes it
Most likely first.
- 1
Site URL and browser URL disagree
The cookie is set for one hostname while you are browsing another — www versus non-www, or http versus https. The browser will not send it back.
- 2
A plugin interfering with cookies or redirects
Security, caching, membership, and multilingual plugins all touch this path and can break it after an update.
- 3
Caching serving a logged-out page
A page cache or CDN returns the cached anonymous version of the dashboard, which redirects you straight back to the login.
- 4
Corrupted cookies in your browser
A stale cookie from an earlier session conflicts with the new one. Affects only you, which makes it easy to misdiagnose.
- 5
A .htaccess or permalink problem
A malformed rewrite rule sends admin requests somewhere they should not go.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Clear cookies for your domain
Delete cookies and site data for the domain, or open a private window. If that lets you in, the cause was local and you are done.
Step 2 — Check the site address settings
Confirm WP_HOME and WP_SITEURL match exactly how you browse the site, including www and https. A mismatch here is the single most common cause.
Step 3 — Disable plugins over SFTP
Rename wp-content/plugins to plugins-off, then try logging in. If it works, restore and re-enable one at a time to find the offender.
Step 4 — Bypass caching
Clear all caches, and exclude wp-admin and wp-login.php from caching at the plugin and CDN. Admin pages should never be cached.
Step 5 — Regenerate .htaccess
Rename it and let WordPress write a fresh one. If the loop clears, the old file held the bad rule.
When to stop and call someone
Call someone if you are locked out with no SFTP access, if the loop affects every administrator rather than just you, or if it started alongside other unexplained changes — a login you cannot reach is also how a compromise is sometimes noticed.
Frequently asked
Because the session cookie set at login is not being read on the next request, so the dashboard treats you as logged out. The password is being accepted — the failure is in storing or reading the cookie, most often due to a site URL mismatch, a plugin, or caching.
Use SFTP. Rename wp-content/plugins to disable everything at once, and define WP_HOME and WP_SITEURL explicitly in wp-config.php so the cookie domain matches how you browse. Both changes are reversible and neither touches your content.
Yes, and it is a frequent cause. If a page cache or CDN serves a cached logged-out version of the dashboard, WordPress sees no session and redirects to login. Admin URLs should always be excluded from caching.
That points at stale cookies in your normal browser profile rather than a fault on the site. Clearing cookies and site data for the domain usually resolves it permanently, and means other users are unaffected.
Very much. Cookies are bound to a specific hostname, so a cookie set for example.com is not sent to www.example.com. If your site settings and the address you type disagree, WordPress loops every time.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing WordPress PluginsOne bad plugin can take your whole site down. We fix plugin conflicts, fatal errors, and security holes fast — and build custom plugins when the off-the-shelf ones fall short.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.