It is Monday morning. You have blog posts to publish and orders to process. You go to yoursite.com/wp-admin, enter your username and password, and hit Log In.
The page loads. The screen flashes. And then… you are staring at the exact same login screen. Fields empty. No error message. No “Incorrect Password” warning. Just silence.
You try again. You reset your password. You try a different browser. Nothing works. You are trapped in the WordPress Login Redirect Loop. This is one of the most frustrating errors because the site appears to be working fine for visitors, but the door is bolted shut for you.
The Mechanics of the Error: Authentication relies on a “handshake” between your browser and the server. The browser sends the password, the server accepts it and sends back a session cookie to save, the browser saves it, and the server then shows the dashboard.
The “loop” happens when the browser fails to hold onto that cookie. The server sends the cookie, but the browser (or the site configuration) drops it. When the server asks “show me the cookie,” the browser has empty hands, so the server kicks you back to the login screen. In this guide, we will walk through 5 proven methods to fix this handshake.
Method 1: Clear Browser Cookies & Cache (The First Step)
Before we tear apart your website code, we must rule out your computer. If your browser is holding onto an expired or corrupted cookie file, it will refuse to save the new one.
- Google Chrome: Click the Three Dots > Settings, go to Privacy and Security > Third-party cookies, click “See all site data and permissions,” search for your website domain, and click the trash can icon to delete all data.
- Force Refresh: Return to your login page and press Ctrl + F5 (Windows) or Cmd + Shift + R (Mac) to force a non-cached reload.
- Test: Try logging in.
Pro Tip: Try logging in using an “Incognito/Private” window. If that works, the issue is definitely your browser cache.
Method 2: Regenerate the .htaccess File (Server Reset)
The .htaccess file is the traffic controller of your server. It handles redirects and permalinks. If this file gets corrupted (often by a plugin update), it can send your login request into an infinite loop.
- Connect to your site via FTP or cPanel File Manager.
- Navigate to the public_html root folder.
- Locate the .htaccess file (ensure “Show Hidden Files” is checked).
- Rename it: change the name to .htaccess_backup. This effectively deletes it but keeps a copy just in case.
- Try to log in. If successful, go to Settings > Permalinks and click Save Changes — this forces WordPress to generate a fresh, error-free .htaccess file. If it fails, restore the file name and move to Method 3.
Method 3: Deactivate Plugins (The Conflict Fix)
If you recently installed a security plugin (Wordfence, iThemes) or a user role editor, it might be misconfigured.
- Connect via FTP.
- Go to wp-content/plugins.
- Rename the folder: change the folder name from plugins to plugins_deactivated.
- Try to log in. If you can log in now, it means one of your plugins was the culprit.
- Isolate the bad plugin: rename the folder back to plugins, enter the folder, and rename plugin folders one by one (e.g., wordfence to wordfence_off), testing the login each time until you find the one causing the loop.
Method 4: Hard-Code Site URL in wp-config.php (The SSL Fix)
This is the most common cause for sites that recently switched to HTTPS. If your database settings say your site is http://example.com but you are accessing it via https://example.com (secured), the cookie will be rejected because of the protocol mismatch. We need to force the server to recognize the correct address.
- Access your site via File Manager.
- Right-click the wp-config.php file in the root directory and select Edit.
- Scroll down to the line that says /* That’s all, stop editing! */
- Paste this code immediately above that line:
define('WP_HOME', 'https://yoursite.com');
define('WP_SITEURL', 'https://yoursite.com');Critical: replace yoursite.com with your actual domain name, and make sure to use https if you have an SSL certificate. Save and upload — this overrides any incorrect settings in the database.
- ✅ Definitive: Overrides database errors instantly.
- ❌ Rigid: You cannot change the URL from the Dashboard settings while this code is active.
Method 5: Clear Cloudflare/CDN Cache
If you use Cloudflare, Sucuri, or a hosting CDN, they might have “cached” the login page itself. This means you are technically submitting your password to a photograph of the login page, not the real one.
The Fix:
- Log in to your Cloudflare dashboard.
- Go to Caching > Configuration.
- Click Purge Everything.
- Try logging in again.
Frequently Asked Questions
Did I get hacked?
A login loop is usually a configuration error, not a hack. However, if you see strange new admin accounts in your database (via phpMyAdmin), you should scan your site immediately.
Why does the “Remember Me” box matter?
Sometimes, checking “Remember Me” creates a longer-lasting cookie that bypasses the glitch causing the loop. It is worth trying as a quick temporary fix.
Conclusion
The Login Loop is a breakdown in trust between your browser and the server. By clearing your cache, disabling conflicting plugins, and verifying your URL settings, you can rebuild that handshake and get back to business.
