How to Fix the WordPress Login Page Redirect Loop

A WordPress login redirect loop happens when your browser successfully sends your credentials, but a server or site misconfiguration forces WordPress to send you right back to wp-login.php without logging you in. This issue is usually caused by mismatched Site and Home URLs, broken cookie domain settings, a corrupted .htaccess file, or an SSL reverse-proxy loop. You can almost always resolve it by hardcoding your URLs in wp-config.php, clearing site cookies, or temporarily resetting your rewrite rules.

What You Are Seeing (Symptoms)

When you encounter a login redirect loop, WordPress rarely displays an explicit error message like "incorrect password." Instead, you will notice one of the following behavior patterns:

• The Refresh Loop: You enter your correct username and password, press Log In, and the page simply reloads the login screen with blank input fields.
• The URL Parameter Loop: The login page reloads, but the browser address bar keeps appending query parameters such as wp-login.php?redirect_to=https%3A%2F%2Fexample.com%2Fwp-admin%2F&reauth=1.
• The Browser Error: Your browser halts the process entirely and displays a TOO_MANY_REDIRECTS or ERR_TOO_MANY_REDIRECTS error page.

Because you cannot enter the /wp-admin dashboard to adjust settings, resolving this requires using FTP, SSH, or your web hosting panel's File Manager.

The Common Causes Behind the Loop

WordPress relies on a strict set of rules to confirm who you are. When you log in, WordPress validates your credentials, sets authentication cookies in your browser, and issues a 302 Redirect header sending you to the administration panel (/wp-admin/). The loop happens when the browser visits /wp-admin/, but something on the server tells WordPress: "This user does not have a valid authentication cookie for this domain." WordPress then redirects you right back to wp-login.php.

This breakdown usually stems from one of five root causes:

Step-by-Step Fixes for the WordPress Login Loop

Before editing any core configuration files or server settings, take a full backup of your website and database through your web host hosting panel. If you are entirely locked out of the dashboard, you can review our guide on getting locked out of WordPress admin for secondary access methods.

Step 1: Clear Browser Cookies and Cache

WordPress relies on cookies to store authentication details. If your browser holds an outdated or corrupted cookie for your domain, it may refuse to send the new cookie established during login.

1. Open your browser settings and navigate to Privacy and Security.
2. Find the option to manage Cookies and site data.
3. Search specifically for your domain name and delete all associated cookies.
4. Clear your browser cache or attempt to log in using a private or incognito window.

If you can log in via an incognito window, the issue lies entirely within your browser's local stored cookies or a local browser extension.

Step 2: Hardcode Site URLs in wp-config.php

If your WordPress siteurl or home settings in the database do not match the exact protocol (http vs https) or domain structure (www vs non-www) you use to access the site, WordPress will reject the login cookie.

You can override database settings instantly by editing your wp-config.php file:

1. Connect to your site via FTP or your host's File Manager.
2. Locate the wp-config.php file in the root directory (public_html or similar).
3. Open the file in a text editor and add the following lines near the top, right after the opening <?php tag:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

Note: Replace https://example.com with your actual domain name. Ensure the protocol matches whether you use https or http, and include www if your domain uses it.

Save the file and test the login page again. If this resolves the loop, your database contains mismatched site URLs that should be corrected cleanly once you regain access.

Step 3: Reset the .htaccess File

A corrupted or misconfigured .htaccess file can cause web servers running Apache or LiteSpeed to misdirect requests heading to the admin directory.

1. Connect to your server via FTP or File Manager.
2. Ensure hidden files are set to visible in your FTP client.
3. Locate the .htaccess file in your site's root directory.
4. Rename the file to .htaccess_old to temporarily disable it.
5. Create a fresh file named .htaccess in the same folder and insert the default WordPress rewrite rules:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Save the new file and attempt to log in. If this resolves the redirect loop, one of your plugins or server settings was writing bad rewrite rules to your original file.

Step 4: Fix Cloudflare or Reverse Proxy SSL Loops

If your site uses a reverse proxy, load balancer, or CDN like Cloudflare, the server behind the proxy might receive traffic over unencrypted HTTP (port 80) while the user connects to Cloudflare over HTTPS (port 443).

When this happens, WordPress assumes the connection is insecure and attempts to redirect the user to https://, creating an infinite loop. To fix this, open your wp-config.php file and place this snippet near the top:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

This tells WordPress to recognize the SSL header passed along by Cloudflare or your host's load balancer. Additionally, ensure your Cloudflare SSL setting is set to Full (Strict) rather than Flexible.

Step 5: Define Cookie Path and Domain Constants

If you recently migrated your site or use a custom multisite/subdomain network, WordPress may be assigning authentication cookies to the wrong domain or path. You can force explicit cookie settings in wp-config.php:

define('COOKIE_DOMAIN', false);
define('ADMIN_COOKIE_PATH', '/');
define('COOKIEPATH', '/');
define('SITECOOKIEPATH', '/');

Setting COOKIE_DOMAIN to false forces WordPress to fall back to the standard domain requested by the user's browser, preventing cross-domain cookie rejections.

Step 6: Temporarily Disable Plugins via FTP

Security plugins, custom login routing plugins, and caching suites can conflict with WordPress's native authentication hooks. To rule out a plugin conflict without dashboard access:

1. In your FTP client, navigate to wp-content/.
2. Rename the plugins folder to plugins_old. This immediately deactivates all plugins on your site safely.
3. Try logging in. If you can log in, rename plugins_old back to plugins.
4. Navigate into the plugins directory and rename individual plugin folders one by one to isolate the exact culprit.

For detailed steps on identifying problematic plugins safely, follow our guide on how to isolate a plugin conflict in WordPress.

How to Prevent Login Loops in the Future

• Keep Canonical URLs Consistent: Always maintain identical URLs across your database, host panel settings, and CDN configurations.
• Avoid Flexible SSL Modes: Configure edge networks like Cloudflare to use end-to-end encryption (Full/Strict) rather than Flexible SSL.
• Flush Cache After Server Migrations: Always clear server-level caches (such as Redis, Varnish, or Nginx FastCGI) and object caches after changing domains or server architectures.
• Test Security Plugins on Staging: Security plugins that alter login paths (e.g., hiding /wp-admin/) should be thoroughly tested on a staging environment before pushing to production.

When to Call a Professional

Fixing a login loop is straightforward when it involves basic URL mismatches or corrupted `.htaccess` rules. However, complex cases involving Nginx server configuration blocks, broken object caches, multisite domain maps, or persistent database corruptions can require expert server-level analysis.

If you have tried these steps and are still locked out, or if you simply don't want to risk breaking server configuration files, let an expert handle it. You can connect your site securely using our free Mend Connect plugin without sharing passwords. Our team will diagnose the issue and get your dashboard working smoothly again.

If you need your site fixed immediately, request an Emergency Rescue for same-day resolution, or submit a request for a Quick Fix. If you are dealing with a broader or unpredictable issue, request a Free Diagnosis — we will triage the problem and provide a flat rate quote before performing any work.