A WordPress admin login redirect loop occurs when you enter valid credentials, click Log In, and land back on the login screen. Some browsers instead report “too many redirects.”
The password is often not the problem. WordPress needs to set and read an authentication cookie, while the site, browser, proxy, and web server must agree about the domain and protocol. A mismatch in any of those areas can make WordPress reject an otherwise valid login session.
Work through the checks below in order, testing after each change. Before editing files or the database, create a backup. If the site is already unstable, see this guide to restoring a WordPress backup from cPanel safely.
1. Test the login URL and clear browser cookies
Start by opening a private or incognito browser window and visiting:
https://example.com/wp-login.php
Replace the example domain with your site’s actual domain. If you can log in privately, an outdated or conflicting cookie is a likely cause. Clear cookies and cached site data for your domain, then try again in a regular browser.
Use the exact domain and protocol configured for the site. These addresses are different locations from a cookie’s perspective:
https://example.comhttps://www.example.comhttp://example.com
Do not switch between them while testing. A cookie created for one host or protocol may not be accepted by another.
2. Check the WordPress and site URLs
A mismatch between WordPress Address (URL) and Site Address (URL) is one of the most common causes of login redirects. If you can reach the dashboard, open Settings → General and review both fields.
For a standard installation, they will usually be identical:
- WordPress Address:
https://example.com - Site Address:
https://example.com
Use the correct domain and protocol, and do not add a trailing slash. If WordPress is intentionally installed in a subdirectory such as /wordpress, the two values may differ, but each must describe the actual installation.
Temporarily define the URLs in wp-config.php
If the redirect prevents dashboard access, define the URLs in wp-config.php, above the line that says “That’s all, stop editing!”:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Replace the example domain with the site’s canonical URL. These constants override the database values. After confirming that the site works, remove them if you want to manage the URLs from Settings → General.
Correct the URLs in the database
Alternatively, edit the home and siteurl values in the wp_options table with phpMyAdmin or another database tool. The table may have a custom prefix, so look for the table ending in _options.
Only use this method if you are comfortable working with the database and have a backup. A typo or incorrect domain can create further problems. For related database symptoms, see this guide to fixing WordPress database connection errors.
3. Check HTTPS and reverse-proxy configuration
HTTPS can cause a redirect loop when WordPress, the web server, and a proxy disagree about whether a request is secure. This commonly occurs when a CDN, load balancer, or hosting platform terminates HTTPS before forwarding the request to PHP.
Confirm that the SSL certificate is valid and that WordPress consistently uses https://. If SSL was installed recently, also review how to fix WordPress mixed content warnings.
On some reverse-proxy setups, WordPress must be told to trust the forwarded HTTPS status. A commonly used configuration is:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
$_SERVER['HTTPS'] = 'on';
}Use this only when your hosting provider or proxy documentation confirms that the header is trustworthy. Do not copy server configuration from another host without checking how your own infrastructure handles forwarded requests.
Ask your host to inspect the redirect chain if you are unsure whether the server is applying both a forced HTTPS redirect and a conflicting HTTP rule.
4. Temporarily disable login and security plugins
Security, login, membership, caching, and redirection plugins can all affect authentication. They may change the login URL, enforce additional checks, alter cookie behavior, or redirect users according to their role.
To test plugins without dashboard access, connect through cPanel File Manager or SFTP and rename:
wp-content/plugins
For example, rename it to:
plugins.disabled
Try logging in again. If the login works, restore the original folder name and activate the plugins one at a time until the redirect returns. Pay particular attention to security, login-protection, caching, redirect, and membership plugins.
This procedure disables standard plugins, but it may not disable must-use plugins, theme code, or a firewall running at the hosting or CDN level. For a more controlled investigation, see how to use AI to triage WordPress plugin conflicts safely.
5. Inspect .htaccess and other redirect rules
A damaged or overly broad .htaccess rule can redirect every request, including wp-login.php. On a standard Apache installation, temporarily rename the file to .htaccess.backup and test the login.
If the loop stops, log in and visit Settings → Permalinks. Click Save Changes to let WordPress regenerate its basic rewrite rules. Keep the backup until you have tested the front end, dashboard, and important URLs.
Also review:
- Rules that repeatedly redirect HTTP to HTTPS.
- Rules that redirect
wp-login.phpor/wp-admin/. - Security rules that block cookies or POST requests.
- Redirects configured in the hosting panel or CDN.
Avoid adding several “force HTTPS” snippets from different tutorials. One correctly placed redirect is preferable to multiple overlapping rules.
6. Check cookie constants and custom code
Custom code in wp-config.php, a plugin, or the active theme can define cookie domains, paths, or secure settings incorrectly. Search recent changes for constants such as COOKIE_DOMAIN, COOKIEPATH, and ADMIN_COOKIE_PATH.
Remove custom cookie constants unless the hosting arrangement specifically requires them. A cookie assigned to the wrong domain or subdomain may prevent WordPress from recognizing the login session.
After making a change, clear the site’s cookies and test in a private window. If the problem began after a theme change, temporarily switch to a default WordPress theme by renaming the active theme folder through SFTP.
7. Review WordPress, PHP, and server logs
If the loop continues, inspect the available logs. Depending on your setup, useful information may appear in WordPress debugging logs, PHP logs, web-server logs, CDN logs, or security-plugin logs.
Look for repeated redirects, cookie warnings, fatal errors, authentication failures, and firewall blocks. Enable WordPress debugging only in a safe staging environment when possible, or ask your hosting provider to collect the relevant entries.
Do not leave public error display enabled on a live site. If the redirect is accompanied by a blank page or server error, the underlying problem may be broader; see this guide to fixing WordPress 500 internal server errors.
Frequently asked questions
Why does WordPress keep returning me to the login page?
WordPress usually returns to the login page when it cannot accept or read the authentication cookie. Common causes include mismatched site URLs, incorrect HTTPS detection, stale cookies, security plugins, and server redirects.
Can clearing cookies fix a WordPress login loop?
Yes, if the browser has an old cookie from a previous domain or protocol. Clearing cookies will not correct an incorrect site URL, proxy configuration, plugin conflict, or server rule.
Should the WordPress Address and Site Address always match?
They match for most standard installations. They can differ when WordPress core is installed in a subdirectory, but both values must accurately reflect the installation and use the intended protocol.
What if I cannot edit files or access phpMyAdmin?
Ask your hosting provider or a WordPress developer to inspect the redirect chain, URL settings, cookies, plugins, and server rules. Make sure they create a backup before changing production files or database values.
Conclusion
Fixing a WordPress admin login redirect loop means finding the layer that disagrees with the others. Start with browser cookies and site URLs, then check HTTPS detection, plugins, .htaccess, custom cookie code, and logs.
Make one change at a time and test after each step. If the site handles customers, orders, or subscriptions, avoid making untested changes directly on production without a recent backup.