Last updated on October 29th, 2026 at 12:46 pm
A WordPress login redirect loop happens when the login form accepts your credentials but sends you back to the login screen. You may also see repeated redirects between wp-login.php, wp-admin, HTTP and HTTPS versions, or different versions of the domain.
The problem is usually caused by cookies, mismatched WordPress URLs, caching, a plugin conflict or conflicting redirect rules.
Clear cookies for the website
WordPress authentication depends on browser cookies. Delete cookies for the affected domain, close the browser and try again in a private window. Confirm that cookies are allowed and that the computer’s date and time are correct.
Confirm the WordPress and site URLs
The WordPress Address and Site Address must use the correct protocol and hostname. A mismatch such as HTTP versus HTTPS or www versus non-www can prevent authentication cookies from working.
If you cannot access wp-admin, temporarily define the URLs in wp-config.php:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Replace the example domain with the exact canonical website address. Remove duplicate or conflicting definitions after access is restored.
Clear every caching layer
Purge the WordPress cache plugin, hosting cache, object cache and CDN cache. Login pages should not be cached. Check that wp-login.php, wp-admin and authenticated cookies are excluded from page caching.
Disable login, security and redirect plugins
If the loop began after an update or settings change, deactivate the most likely plugin first. When wp-admin is inaccessible, rename its folder through cPanel File Manager or SFTP. Security, membership, SSL, redirect and custom-login plugins are common suspects.
If necessary, rename the entire plugins directory briefly to test whether a plugin is responsible. Restore the folder name immediately and reactivate plugins carefully.
Check .htaccess and server redirects
Review redirects in .htaccess, cPanel, your CDN and the hosting platform. Multiple rules can fight over HTTPS, www or trailing slashes. Back up .htaccess, then refresh WordPress rewrite rules after removing the conflict.
If the browser reports too many redirects outside the login screen, use my WordPress redirect loop guide.
Check HTTPS proxy settings
A reverse proxy or CDN may terminate SSL before sending traffic to WordPress. If WordPress thinks the request is HTTP, it can repeatedly redirect to HTTPS. Confirm the host and CDN use a compatible SSL mode and pass the HTTPS request status correctly.
Reset authentication salts
As a later troubleshooting step, generate fresh WordPress authentication keys and salts in wp-config.php. This logs out every active user, so coordinate the change on membership, ecommerce and multi-user websites.
Check user permissions and the database
If only one account is affected, confirm the user exists and has the correct role. Damaged user metadata can prevent dashboard access even when the password is correct. Create a verified backup before editing database values.
Prevent future login loops
- Use one canonical HTTPS domain.
- Exclude login and admin pages from caching.
- Avoid duplicate redirect systems.
- Test security and SSL changes on staging.
- Keep recent off-site backups.
For related access and server problems, visit my WordPress troubleshooting hub.
