Why does WordPress log me in and then send me right back to the login page?

Usually because WordPress cannot validate the login cookie or the redirect target does not match the site’s real URL. The most common causes are bad URL settings, cache, cookies, plugin conflicts, or SSL/proxy mismatches.

Can a cache plugin cause a login redirect loop?

Yes. If login pages or admin pages are cached when they should not be, WordPress can keep serving stale redirects or session-related content. Clear every cache layer and exclude wp-login.php and wp-admin from caching.

What if I can log in on one browser but not another?

That usually points to a browser cookie or cache issue rather than a site-wide failure. Clear cookies for the domain, try incognito mode, and test a second browser.

Is it safe to rename the plugins folder to fix the loop?

Yes, as a troubleshooting step it is a standard way to disable all plugins at once when you cannot reach the dashboard. Back up first, and rename the folder back after testing so you can narrow down the conflicting plugin.

WordPress Login Redirect Loop: Why It Happens and How to Fix It

If WordPress keeps sending you back to the login page after you sign in, the problem is usually one of four things: a bad site URL, broken cookies, a cache or security layer rewriting the login flow, or a plugin/theme conflict. Start with the safest checks first, because you can often fix a login redirect loop without touching the database or core files.

This issue can look different depending on the site and host. You might enter the correct username and password, see the dashboard flash for a second, then get bounced back to wp-login.php. Or you may land on a redirecting URL like /wp-admin that keeps looping between login and admin pages. The good news is that the cause is usually specific and fixable.

What a WordPress login redirect loop looks like

The loop can present in a few ways:

You log in successfully, but WordPress returns you to the login screen.
/wp-admin redirects to /wp-login.php repeatedly.
You can log in on one browser but not another.
The problem started after a move to HTTPS, a domain change, a plugin install, or a site update.
Only some users are affected, such as admins but not editors.

That pattern matters. If the issue is browser-specific, cookies are likely involved. If it affects everyone, the problem is more often site URL settings, server cache, security rules, or a plugin/theme conflict.

Likely causes, from most common to least

Cause	Why it creates the loop	Best first check
Wrong WordPress address or site address	WordPress can authenticate you, then redirect you to a different URL or scheme	Check `WP_HOME`, `WP_SITEURL`, and Settings > General
Broken cookies or browser cache	The login cookie is not being stored or sent back correctly	Try another browser, incognito, and clear cookies for the site
Cache layer or CDN	Cached redirects or stale pages can trap the login flow	Clear host, plugin, and CDN cache
SSL or reverse proxy mismatch	WordPress thinks the request is HTTP while the browser is on HTTPS, or vice versa	Check the canonical site URL and proxy/SSL settings
Plugin or theme conflict	A security, membership, redirect, or cache plugin can alter authentication or admin redirects	Disable plugins and switch to a default theme
Corrupted `.htaccess` or server rules	Redirect rules can loop before WordPress loads	Temporarily reset rewrite rules

Before you change anything

Back up your site first. If you have to edit wp-config.php, rename plugins, or adjust rewrite rules, a backup gives you a safe rollback point. If your host offers one-click backups, use it before any troubleshooting step that touches files or settings.

If you can still access the admin area in another browser or an incognito window, great. If you are fully locked out, you can still fix this through hosting file access or by using your host’s file manager, FTP, or SSH.

Step 1: Eliminate browser cookie problems

Start here because it is fast and harmless.

Open the login page in a private/incognito window.
Try a different browser or device.
Clear cookies for your domain only, then try again.
If you use a password manager or browser autofill, type the password manually once.

If a different browser works, the site itself may be fine. In that case, the browser was likely holding stale cookies or cached redirects.

Step 2: Check the WordPress URL settings

A mismatched site URL is one of the most common reasons for redirect loops, especially after a migration or HTTPS change. WordPress needs the same canonical URL everywhere it expects to authenticate users.

In the dashboard, go to Settings > General and compare:

WordPress Address (URL)
Site Address (URL)

They should match the real site URL exactly in scheme and domain. For example, if the site uses HTTPS, both should usually be https://example.com rather than a mix of HTTP and HTTPS or www and non-www.

If you cannot reach the dashboard, you can define these values in wp-config.php:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Use your real domain, and only make this change if you are sure which URL should be canonical. If your host or CDN handles redirects, keep those rules consistent with WordPress.

Step 3: Clear every layer of cache

Clear any WordPress cache plugin.
Clear your host-level cache.
Clear CDN cache, if you use one.
Clear browser cache and cookies for the site.

If your site is behind a CDN or proxy, make sure wp-login.php and /wp-admin are excluded from caching. For deeper context, see WordPress Caching Explained: What to Clear and When.

Step 4: Test for a plugin conflict

Security, membership, login, redirect, and cache plugins are the most likely to interfere with authentication. If the issue started right after a plugin change, this is a strong lead.

If you can access wp-admin:

Deactivate all plugins.
Try logging in again.
If the loop stops, reactivate plugins one by one until the problem returns.

If you cannot access wp-admin, rename the /wp-content/plugins/ folder via FTP, SFTP, or file manager. That disables all plugins at once. If the loop clears, rename the folder back and troubleshoot plugins individually.

If you suspect a bad update rather than a general conflict, this guide may help too: What to Do When a WordPress Update Breaks the Site.

Step 5: Switch to a default theme

Less common than plugin conflicts, but still worth checking. A theme can alter login or redirect behavior through custom functions, membership code, or compatibility issues.

Temporarily activate a default WordPress theme such as Twenty Twenty-Four.
Try logging in again.
If the issue disappears, the theme is part of the problem.

If you cannot enter the dashboard, you can rename the active theme folder in /wp-content/themes/ so WordPress falls back to a default theme, assuming one is installed.

Step 6: Reset rewrite rules and `.htaccess`

A bad redirect rule can cause a loop before WordPress has a chance to finish authentication. This is especially common after permalink changes, migration work, or custom redirect rules in .htaccess.

If you can access the dashboard, go to Settings > Permalinks and click Save Changes without changing anything. That refreshes rewrite rules.

If you cannot log in, back up .htaccess first, then temporarily rename it to something like .htaccess.old. WordPress will not use it while renamed, which helps you determine whether the file is causing the loop. If that fixes the problem, rebuild a clean ruleset.

Step 7: Verify SSL and reverse proxy settings

This is a very common cause on sites moved to HTTPS, hosted behind a proxy, or served through a CDN. WordPress may think the request is insecure even when the browser is using HTTPS, so the login cookie never matches the redirect target.

Check for these issues:

The site URL still uses http:// while the browser uses https://.
Your host terminates SSL at a proxy or load balancer.
A CDN is forcing HTTPS but origin settings are inconsistent.
wp-config.php has custom SSL or proxy constants that no longer match the server setup.

If this started after a migration, compare the live site URL with the value in WordPress and with the redirect rules at the host or CDN level. These need to agree.

Step 8: Look for a security rule blocking the login cookie

Sometimes a firewall or security plugin blocks the login request, strips cookies, or redirects the request in a way that creates a loop. This can happen after a false positive, a country-block rule, or aggressive login protection.

Check:

WordPress security plugins
Host firewall rules
CDN firewall or bot protection
Rate limiting or brute-force protection

If the site is also behaving oddly in other ways, or you see unexpected admin changes, review whether the site may have been compromised. In that case, read WordPress Site Hacked? Here's How to Clean It Up — Safely.

What not to do

Do not keep making random changes in multiple places at once. Redirect loops are easy to make worse when you edit WordPress settings, server rules, CDN settings, and plugin settings all together. Change one thing, test, and record what happened.

Avoid deleting core files, reinstalling WordPress blindly, or changing the database unless you have a clear reason. Those steps are rarely the first fix for a login loop.

How to prevent login redirect loops later

Keep one clear canonical URL for the site, including HTTPS and www/non-www choice.
Exclude login and admin pages from cache layers.
Test major plugin, theme, and host changes on a staging site first.
Back up before updates and before changing redirect or SSL settings.
Document any custom proxy, SSL, or CDN configuration so it can be restored accurately.

When to call a professional

If you have already checked cookies, URLs, cache, plugins, themes, and rewrite rules and the loop is still there, it is time to stop guessing. At that point the problem may involve server config, a proxy/SSL mismatch, a custom redirect rule, or a hidden plugin conflict that needs direct inspection.

If you are locked out of admin, running a business site, or worried about making downtime worse, Mend can usually triage the issue fast and fix it on a backup-first workflow. Start with a free diagnosis at /start/diagnosis, or if you need urgent help getting back into the site, use /start/emergency. You can also connect securely without sharing passwords through /connect.

If you want to keep this from happening again, a Care Plan can cover updates, backups, security, and uptime monitoring so login problems are less likely to catch you by surprise.