WordPress Keeps Logging Me Out: Session Cookie Fixes (2026)

You log in fine. You edit for five minutes. Then "Your session has expired" and you're back at the login screen. This is a session problem, not a password problem - and it's distinct from the login redirect loop where you never get in at all.

Cause 1: URL Mismatch (Most Common)

The auth cookie is written for the domain in Settings → General. If you log in at https://yoursite.com but Site Address says http://yoursite.com - or www vs non-www differs - the browser won't send the cookie back correctly, and every request looks anonymous. Make WordPress Address, Site Address, and your login URL identical, scheme included. If the values are greyed out, they're set in wp-config.php via WP_HOME and WP_SITEURL - edit them there.

Cause 2: A Plugin Killing Sessions

Security plugins with idle timeouts, membership plugins that log out "inactive" users, and session-management plugins all intentionally end sessions. If logout happens at a consistent interval, that's designed behavior - find the setting and extend it. If it started after a new plugin, deactivate it and test.

Cause 3: Salt Rotation

WordPress auth cookies are signed with the security keys in wp-config.php. Regenerate them (via the wordpress.org secret-key service, a security plugin's "rotate salts" feature, or after a security incident) and every existing session dies at once. That's correct after a compromise - but if a plugin is auto-rotating salts on a schedule, that's your logout loop. Check wp-config.php for AUTH_KEY changes you didn't make.

Cause 4: Cache/CDN Interference

A page cache or CDN that serves the wp-admin or login flow breaks sessions silently. Exclusions needed: /wp-admin/*, /wp-login.php, and any request carrying a wordpress_logged_in_ cookie. In Cloudflare, "Cache Everything" page rules on the whole domain are the classic offender - scope them to exclude admin.

Cause 5: Browser and Multisite Edge Cases

Test in incognito - a corrupted cookie store logs you out on schedule. Multisite adds a layer: switching between mapped domains crosses cookie domains and ends the session by design. And if multiple people share the admin account, WordPress's concurrent-session handling can kick the "other" session - use separate accounts.

Keep Reading

• Login redirect loop - when you never get in at all
• wp-admin not loading - blank admin while the site works
• Mixed content error - SSL mismatches that break cookies too
• Hacked recovery - unexpected salt changes can mean compromise
• Bluehost review 2026
• ERR_CONNECTION_TIMED_OUT on WordPress: Site Can't Be Reached (2026)