Fix WordPress Login Redirect Loops Safely

If WordPress keeps sending you back to the login page, the cause is usually one of a few fixable problems: a bad site URL, cookies or cache issues, a plugin or theme conflict, or an HTTPS/domain mismatch. Start with the safest checks first, and back up your site before changing anything on the server or database.

The important thing is to narrow down whether the loop happens only in wp-admin, only on one device, or for everyone. That tells you whether you’re dealing with a browser-side issue, a WordPress configuration problem, or something deeper in the site.

What a login redirect loop looks like

You enter your username and password, WordPress appears to accept them, and then you land right back on the login screen. Sometimes you’ll see a “too many redirects” browser message. Other times the page just refreshes as if the login never happened.

This is different from a wrong password. In a redirect loop, your credentials may be correct, but WordPress cannot keep the authenticated session long enough to send you into the dashboard.

The most common causes

• Browser cookies are blocked, stale, or corrupted. WordPress relies on cookies to keep you logged in.
• Site URL and home URL do not match. This often happens after a domain change, HTTPS migration, or staging-to-live move.
• HTTP/HTTPS mismatch. If WordPress thinks the site is on one scheme and the browser uses another, login cookies may not stick.
• Plugin conflict. Security, caching, login, or redirect plugins are common triggers.
• Theme or custom code issue. A theme function or snippet can interfere with authentication or redirects.
• Server cache or proxy cache. Host-level caching, CDN rules, or reverse proxies can serve the wrong response at the wrong time.
• .htaccess or nginx redirect rules. A loop in server rules can bounce the login request forever.
• Session or cookie path problems. Less common, but worth checking after a migration or subdirectory install.

Start with the safest fixes

1) Try a clean browser session

Open a private/incognito window and try logging in there first. If that works, the issue is likely your normal browser session, not WordPress itself.

1. Clear cookies for your site only, not your entire browser if you can avoid it.
2. Disable browser extensions temporarily, especially privacy blockers and security tools.
3. Try a different browser or another device.

If the loop disappears in a private window, the fix may be as simple as clearing cookies and cache for the domain.

2) Check whether the site URL is wrong

Misconfigured URLs are one of the most common reasons WordPress sends users back to the login page. If your site recently moved to HTTPS, changed domains, or changed from www to non-www, compare the values WordPress is using.

If you can still access the database, check the wp_options table for siteurl and home. They should match the real public address of the site exactly, including https:// if that’s what the site uses.

If you prefer to change them without the admin panel, you can temporarily define them in wp-config.php:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

Use the real domain for your site. If the loop stops after this change, the underlying issue is usually a URL mismatch in the database or an environment-specific override.

3) Verify HTTPS and cookie settings

WordPress login cookies are sensitive to scheme and domain. If your site is loading over HTTPS but WordPress still thinks it should use HTTP, authentication can fail repeatedly.

Check for these common problems:

• The site loads at https:// but siteurl or home still use http://.
• A CDN or reverse proxy is forcing one version while WordPress is configured for another.
• You recently installed SSL, but mixed redirects are still active in hosting, .htaccess, or a plugin.

If you changed SSL settings recently, inspect your host dashboard and any redirect plugin before editing files manually. A bad redirect rule can create a loop that looks like a login problem even though the real issue is at the server edge.

4) Disable plugins without the dashboard

If the redirect loop is caused by a plugin, you may not be able to reach wp-admin to disable it normally. The safest way is to rename the plugins folder so WordPress loads with plugins off.

1. Back up the site first.
2. Use SFTP, file manager, or host tools to rename /wp-content/plugins/ to something like plugins-disabled.
3. Try logging in again.
4. If the login works, rename the folder back and reactivate plugins one by one to find the culprit.

Pay special attention to security, caching, and redirect plugins. These are the most likely to affect login behavior.

5) Switch to a default theme temporarily

If disabling plugins does not help, the active theme may be adding a redirect, altering sessions, or interfering with authentication hooks. You can test this by temporarily switching to a default theme such as Twenty Twenty-Four, if it is installed.

If you cannot access the dashboard, rename the active theme folder through SFTP. WordPress will usually fall back to a default theme if one is available.

6) Check .htaccess or server redirect rules

On Apache servers, a broken .htaccess file can send login traffic in circles. On nginx or managed hosts, the issue may live in the hosting control panel instead.

To test safely, back up .htaccess and then temporarily replace it with the default WordPress rules. If that resolves the loop, the problem was in custom rewrite or redirect code.

# Default WordPress rules
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

If your host uses nginx, do not copy Apache rules into nginx config. Ask your host for help or use their supported method to inspect redirects.

7) Clear server-side cache and CDN cache

Even when WordPress is fixed, cached redirects can keep the problem going. Purge all layers you control: host cache, plugin cache, and CDN cache if you use one.

Then test again in a private browser window. If the loop only appears for certain visitors, a cache layer may be serving stale login or redirect headers.

Special case: when you can log in on one URL but not another

This is a strong clue that the issue is not your password. It usually means WordPress, your web server, and your browser disagree about the canonical site address.

For example, one version may be set to https://www.example.com while another part of the stack is forcing https://example.com. That mismatch can break cookies and return you to the login screen.

Pick one canonical version of the site and make sure everything matches it: WordPress settings, redirects, SSL certificate, CDN configuration, and links in the database if the site was migrated.

What not to do

• Don’t keep guessing and randomly changing multiple settings at once.
• Don’t edit the database without a backup.
• Don’t delete plugin or theme files until you know which one is causing the loop.
• Don’t add multiple redirect rules from different plugins or host settings.

Login loops are often fixed by one small mismatch, but they become harder to trace after several rushed changes. Make one change at a time and test after each one.

How to prevent login redirect loops

The best prevention is consistency. Keep your site URL, SSL, CDN, and redirect settings aligned, and avoid stacking multiple tools that all try to manage redirects.

• Use one clear canonical domain and stick to it.
• After migrations, verify home and siteurl immediately.
• Be cautious with security and redirect plugins that touch authentication.
• Test updates on a staging site when possible.
• Keep a restore-tested backup before major changes.

If you want a practical backup approach that you can actually restore under pressure, see A Sensible WordPress Backup Strategy You Can Actually Restore.

When to call a professional

If you have already checked cookies, URLs, HTTPS, plugins, themes, and redirects and you are still locked in a loop, the issue is probably in the server configuration or a deeper conflict that needs careful tracing. That is especially true if the site is live, revenue-generating, or tied to a recent migration or security change.

At that point, a focused fix is usually faster than more trial and error. Mend can triage the issue with a free diagnosis, then fix it on a backup-first workflow with a plain-English report of what caused the loop and what changed. If you need help now, start with free diagnosis or go straight to Emergency Rescue if the site is blocked and urgent.

If you want to give an engineer secure access without sharing passwords, use Mend Connect. Most fixes are completed the same day, and every paid fix includes a fixed-or-your-money-back guarantee.

Related fixes

If your redirect loop started after a change, these guides may help too:

• WordPress Site Broke After an Update? Here's What Happened and How to Fix It
• Locked Out of WordPress Admin: Why It Happens and How to Fix It
• There Has Been a Critical Error on This Website: What It Means and How to Fix It