WordPress Login Redirect Loop: Why the Login Page Reloads

You type your username and password, press Log In, and the login page simply comes back. Empty fields, no “incorrect password” warning, no dashboard. You try again, slowly this time, and the same thing happens. Sometimes the address bar shows a long link ending in reauth=1, and sometimes you get as far as the dashboard for a split second before being thrown out.

That missing error message is the key detail. When the password is wrong, WordPress tells you. When it quietly sends you back, it usually accepted the password but then could not keep you logged in. That points to cookies, site addresses or something interfering with the redirect, not to your credentials.

How a WordPress login actually works

When you log in, WordPress checks the password and then sets login cookies in your browser. It then redirects you to /wp-admin/. On that next page load, WordPress reads the cookies to confirm who you are. If the cookies are missing, set for the wrong address, or not trusted, WordPress decides you are not logged in and sends you to wp-login.php again, often with reauth=1 added to ask for a fresh login.

So a loop means the cookies are being set in one place and looked for in another, or not being set at all. Every cause below is a variation on that.

Is it a loop or a “too many redirects” error?

These get mixed up. In a login loop, the login page loads normally and you can type into it; you just never get past it. With ERR_TOO_MANY_REDIRECTS, the browser gives up and shows its own error page before WordPress appears at all. That second problem usually comes from SSL or CDN settings, and our post on fixing the too many redirects error deals with it separately.

The likely causes

Stale or blocked cookies in your browser

Old login cookies from before a change to the site, a browser set to block cookies, or a privacy extension can all stop the new ones working. If cookies are fully blocked, WordPress often says so on the login screen with a message that cookies are blocked or not supported by your browser.

The site address does not match the address you are using

Under Settings, then General, WordPress stores a “WordPress Address (URL)” and a “Site Address (URL).” If those say http://example.com but you visit https://www.example.com, the cookies are issued for one version and you are browsing another. This often happens after adding SSL, moving hosts, or switching between www and non-www.

A caching layer serving the login page

The login page and the dashboard must never be cached. If a caching plugin, the host’s server cache or a CDN rule is caching wp-login.php or wp-admin, you can be handed a stale page that ignores your fresh cookies.

A security or login plugin

Plugins that hide or rename the login page, add a CAPTCHA, limit login attempts or enforce two-factor checks all sit in the middle of the login. After an update, or if their settings get out of step with the site address, they can bounce every login.

HTTPS behind a proxy or CDN

When a site sits behind a load balancer or a CDN, the server may receive traffic as plain HTTP even though visitors use HTTPS. WordPress then believes the connection is not secure and issues the wrong kind of cookie for the admin area. Hosts that use this setup normally handle it, but custom servers sometimes do not.

PHP output breaking the cookies

Cookies are sent in the headers of the response. If a file prints anything before those headers, even a blank line, the cookies cannot be sent. You may see “Cookies are blocked due to unexpected output” on the login screen, or a warning about headers. That has its own explanation in our post on the “headers already sent” warning.

What to try, gentlest first

1. Clear cookies for this site only, then try again. In most browsers you can do this from the padlock or site information icon next to the address. Then close the tab and open a fresh one.
2. Try a private window and a second browser. If login works there, the problem is local to your normal browser: an extension, a saved cookie, or a privacy setting.
3. Type the address exactly as WordPress stores it. If you are not sure, try both with and without www and with https. If one works, you have found an address mismatch.
4. Purge every cache you have: the caching plugin (if you can reach its settings), the hosting panel’s cache tool, and the CDN.

The next steps change files on the server, so take a backup first, or at least download a copy of wp-config.php and note what you rename.

5. Disable plugins by renaming the folder. Using FTP or your host’s file manager, give the wp-content/plugins folder a temporary name such as plugins-disabled, and every plugin stops loading. If the login now works, restore the original folder name and switch plugins off individually in the dashboard until the loop returns. Start with security, login and caching plugins. You can also rename only a single plugin’s folder if you already suspect it.
6. Fix the site address in wp-config.php. If you cannot reach Settings, add these two lines above the “stop editing” comment, using your real address: define( 'WP_HOME', 'https://example.com' ); and define( 'WP_SITEURL', 'https://example.com' );. These override what is stored in the database, so once you are back in, you can correct the settings properly and remove the lines.
7. Check for a stray cookie setting. Look in wp-config.php for COOKIE_DOMAIN, COOKIEPATH or ADMIN_COOKIE_PATH. These are rarely needed on a single site. If one was added during a migration and points at an old domain, it alone can cause the loop.
8. Switch to a default theme. Rename your active theme’s folder in wp-content/themes. WordPress falls back to an installed default theme. Theme code that runs on login is less common, but it happens.
9. Ask the host about HTTPS detection. If the site is behind a proxy or CDN, the host can confirm whether the server passes the original protocol through, and how they recommend WordPress detects it.

When only one person is affected

If you share the site with colleagues and only one of you is stuck, the site settings are probably fine. The cause sits with that person’s browser or account.

• Have them try a different device on a different network, such as a phone on mobile data. If that works, their usual browser, extension or office network is involved.
• Some office firewalls and VPNs rewrite or strip cookies. Turning the VPN off for a moment is a quick test.
• An administrator can open that user’s profile under Users and press the “Log Out Everywhere” button, which appears when the user has active sessions. It ends all of their stored sessions so they can start clean.
• If they get past the login but immediately see a message saying they are not allowed to access the page, the loop has become a permissions problem. Their role may have been changed, or a plugin may have removed a capability.

A loop that affects everyone, on every device, almost always comes back to the site address, caching, a plugin, or server configuration, which is where the earlier steps focus.

When it might not be a simple loop

If you are bounced from the login page and you also find admin users you do not recognise, a changed admin email address, or password reset emails you did not request, treat it as a possible break-in rather than a cookie problem. That calls for a different response, and our help recovering admin access after a break-in starts from that assumption.

And if what you face is a lost password with no reset email arriving, the issue is email delivery, not the login itself. Our article on why WordPress emails go missing explains that side.

Stopping it from happening again

• Pick one version of your address, with or without www and always with https, and make sure the settings, the SSL certificate and any redirects all agree on it.
• Exclude wp-login.php and /wp-admin/ from every cache layer. Most caching plugins do this by default; custom CDN rules often do not.
• After updating a security or login plugin, log out and back in once to check it still works, while you still have a session open in another tab.
• Keep FTP or file manager access details somewhere safe. When a loop locks you out, file access is how you get back in.

A login loop is one of many errors covered in our WordPress errors and fixes guide. If you have worked through the steps above and still cannot get past the login page, or you do not have file access to try them, our WordPress login problem fix service can pick it up. Tell us the site address and what you see after logging in; we back up first and tell you plainly what was causing it once you are back in.

Next in this series: WordPress Admin Slow but the Site Is Fast? Here Is Why