Can't Log In to WordPress? We Fix the Login Problem

You know the password, and WordPress still will not let you in

Login problems are rarely dramatic. You go to the usual address to write a post or check an order, and something small goes wrong. The page reloads and asks for the password again. A message says cookies are blocked. The login page has moved and you cannot remember where. Or a security plugin says too many attempts were made and you have to wait.

In most of these cases nobody has attacked the site. A setting, a plugin or a browser is getting in the way. This page covers those ordinary login faults, as part of our broader WordPress error fix guide. If anything suggests someone else has been in the site, such as a password changed without you, an administrator you did not create or a changed admin email address, please treat it as a security incident instead. Our admin access recovery service is built for that case, because getting back in is only half the job when an attacker held the keys.

The login faults we see most

The login page keeps reloading

You enter the right details, the page refreshes and you are back at the login form, with no error. This is usually a cookie that cannot be set or read. Common reasons: the WordPress Address and Site Address do not match the address you are using (www versus non-www, http versus https), a caching layer is serving a cached copy of the login page, or a redirect rule on the server or CDN is fighting with WordPress. We explain the loop itself in more depth in our post on the WordPress login redirect loop. When the browser shows “too many redirects” instead, see ERR_TOO_MANY_REDIRECTS in WordPress.

“Cookies are blocked” messages

WordPress shows an error about cookies being blocked or not supported when it cannot set its test cookie. Sometimes the browser really is blocking cookies. More often, a plugin or theme file outputs something before WordPress sends its headers, which stops the cookie from being set. That same cause produces the “headers already sent” warning, and our post on “Cannot modify header information” walks through finding the file responsible.

The login address has changed

Plugins that hide the login page move it from wp-login.php or /wp-admin/ to a custom address. That is a reasonable choice, until the person who set it up leaves and nobody wrote the address down. Visiting the normal login address then gives a 404 or sends you to the home page. The site is fine. You just need the custom address back, or the plugin switched off.

Locked out by a security plugin

Limit-login and firewall plugins block an IP address after a number of failed attempts. In an office where several people share one internet connection, one person mistyping a password can lock out everyone. Some plugins also block whole countries, which catches owners who are travelling or a developer working from another country.

Two-factor codes not working

A lost phone, a reset authenticator app or a clock that is out of sync on the phone can all stop two-factor codes working. Most two-factor plugins offer backup codes for exactly this reason, but few people saved theirs. Our post on two-factor authentication for WordPress covers setting it up so this does not happen again.

Password reset emails never arrive

You click “Lost your password?” and wait. Nothing comes. This is very often a site email problem, not a login problem, because the site cannot send any mail reliably. Fixing the login without fixing the mail leaves the next person locked out in the same way. Our email delivery fix page covers that side.

You log in, but get nowhere

The login works, but WordPress answers with a message that you lack permission to view the page, or the dashboard is missing most of its menus. That usually points to a role or capability problem rather than the login itself, and our post on the “not allowed to access this page” error goes through the causes.

What you can try first

These steps are safe for most owners. Before you edit any file on the server, download a backup of the site files and database, and keep that copy on your own computer.

1. Try a private window. Open a private or incognito window and log in there. If it works, clear cookies for your site in your normal browser.
2. Check the exact address. Try the same login page with and without www, and with https. A mismatch with the site’s settings is a classic cause of reloading logins.
3. Try another network. If a security plugin blocked your office IP, logging in from mobile data usually works. That also confirms the cause.
4. Look for the custom login address. Check old handover notes or emails from the developer, or ask whoever built the site.
5. Switch off plugins from the file manager. In your hosting file manager or over FTP, rename wp-content/plugins to something like plugins-off. WordPress deactivates all plugins. If you can then log in, rename the folder back and turn plugins on one by one from the dashboard to find the one at fault. When two plugins only fail together, the method on our plugin conflict page helps.
6. Check the site address constants. If you know your way around wp-config.php, the WP_HOME and WP_SITEURL constants override the address settings. Defining them correctly can get you back in when the settings in the database are wrong. If you are not comfortable editing that file, stop here.

One thing we would avoid: guessing at passwords repeatedly. On a site with a limit-login plugin, every wrong guess extends the lockout.

How we get you back in

Reach us on WhatsApp, or use the contact form, and include the login address you are using, a screenshot of what you see, and any changes made recently. Once we have checked the site from outside, we share a frank first opinion on the likely cause and say when we are free to begin. If the person locked out needs the dashboard to keep the business running, we handle it as urgent.

For most of this work we need hosting access rather than your WordPress password, because the fix happens underneath the login page. We copy the files and database first. Then we read the site’s address settings, the active plugins, the server’s redirect rules and the error logs to find what is blocking the login. Where it fits, we test the fix on a staging copy. The fix itself is usually small: an address corrected, a cache rule excluding the login page, a plugin updated or replaced, a lockout cleared, a broken file repaired.

While we are in there we also check the user list and the admin email address. If they show anything suspicious, we stop and tell you, because the right next step is then a security review, not a quick login fix. If you work from the USA or UK, the team is in India on IST, and you can pay for the work by PayPal or Wise.

When you are back in, we explain what caused it and what to change so it does not repeat: a written note of the custom login address, saved backup codes, a whitelisted office IP, or working site email for password resets. Login faults sit within our general WordPress bug fixing service.

Small habits that prevent lockouts

• Keep at least two administrator accounts belonging to real, trusted people, each with its own login.
• Store any custom login address and two-factor backup codes in a password manager.
• Make sure the site can send email before you need a reset link.
• Exclude the login page and the dashboard from any page or CDN cache.
• When a developer or agency stops working on the site, change the details they held and remove their account if you no longer need it.

For WordPress’s own guidance on logins and passwords, the official WordPress documentation is the reliable reference.