WordPress Login Redirect Loop: How to Get Back Into wp-admin

You enter your username and password on the WordPress login page, press Log In, and land straight back on the login page. No error, no message, just the same form again. Or the browser says “This page isn’t working: redirected you too many times” (ERR_TOO_MANY_REDIRECTS).

This login redirect loop is almost always caused by cookies, wrong site URLs, an HTTPS misconfiguration, or a plugin. Here is how to break out of it.

Step 1: Clear cookies and try a private window

WordPress keeps you logged in with cookies. If an old or broken cookie is stored, WordPress keeps rejecting it.

• Open a private or incognito window and try to log in there.
• If that works, clear the cookies and cache for your site in your normal browser.
• Make sure the browser is not blocking cookies for your domain.

Step 2: Check the WordPress Address and Site Address

If the two URLs WordPress uses for your site do not match how you visit it, cookies are set for one address and checked on another. Common mismatches are www versus non-www, and http versus https.

You cannot change these in wp-admin if you cannot log in, so set them in wp-config.php, above “That’s all, stop editing”:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

Use the exact address your site should load on, with or without www, and with https if you have an SSL certificate. Then try to log in again.

Step 3: Fix HTTPS redirect conflicts

“Too many redirects” often means two systems are redirecting in opposite directions. For example, WordPress sends visitors to HTTPS while a proxy or CDN sends them back to HTTP.

• Cloudflare: if the SSL/TLS mode is set to Flexible, Cloudflare connects to your server over HTTP while WordPress insists on HTTPS. Set it to Full or Full (strict) when your server has a certificate.
• Behind a proxy or load balancer: WordPress may not detect HTTPS. Add this to wp-config.php above the WordPress settings:

  if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
      $_SERVER['HTTPS'] = 'on';
  }

• Duplicate redirect rules: check .htaccess and your hosting panel for HTTPS or www redirects that conflict with an SSL plugin. Keep only one set of rules.

Step 4: Disable plugins that affect login

Security plugins, login customizers, two-factor plugins, membership plugins, and caching plugins can all interfere with the login process. Without wp-admin access:

1. In File Manager or SFTP, go to wp-content/plugins/.
2. Rename the plugins folder to plugins-off.
3. Try to log in. If it works, rename the folder back and reactivate plugins one at a time to find the culprit.

Also check that your caching plugin or server cache does not cache /wp-login.php or /wp-admin/. Those must never be cached.

Step 5: Rule out the theme

Rarely, a theme’s functions.php contains redirect code that breaks login. Rename the active theme folder in wp-content/themes/ so WordPress falls back to a default theme, then try again.

Step 6: Reset the .htaccess file

A damaged or overcomplicated .htaccess file can cause redirect loops. Rename it to .htaccess-old and create a new one containing the standard WordPress rules:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If the site was in a subfolder, adjust RewriteBase and the last rule. Add back any security or redirect rules from the old file one by one.

Step 7: Check session and cookie settings

• Make sure the server’s clock is correct. Expired-looking cookies can be rejected if the time is far off.
• If you defined COOKIE_DOMAIN in wp-config.php, make sure it matches the site’s domain, or remove it.
• Check that the server has free disk space. Full disks can stop sessions from being saved.

Frequently asked questions

Why did the loop start after I installed an SSL certificate?

The site URLs still use http, or a CDN or proxy is redirecting the other way. Set both URLs to https and fix the CDN’s SSL mode. Our guide to fixing mixed content after moving to HTTPS covers the rest.

Can I reset my password if the login page keeps reloading?

A password reset does not fix a redirect loop, because the loop is about cookies and URLs, not your password. Fix the cause first.

Is a login redirect loop a sign of a hack?

Usually not. But if you find unknown redirect code in .htaccess or theme files, read our guide on what to do if your WordPress site is hacked.