Technical

WordPress Login Redirect Loop: Can't Access wp-admin (2026)

By Daniel Reyes•October 11, 2026•3 min read

Disclosure: some links on this page are affiliate links. We may earn a commission at no extra cost to you. How we test and rate hosts.

Our top pick for most WordPress sites

Bluehost: free domain, free SSL, 24/7 support, 30-day money-back guarantee.

Check Bluehost Deal →

The symptom: you enter the right password at wp-login.php, click Log In, and land back on the same login form. No error, no lockout - just a loop. Authentication works; the session doesn't survive. It's almost always a URL mismatch, a cookie problem, or a plugin. Work the fixes in order.

Fix 1: Clear Cookies / Test Incognito (30 Seconds)

Open an incognito window and try logging in. Works? Clear your normal browser's cookies for the domain - done. Still looping? The problem is server-side; continue.

Fix 2: Match WordPress Address and Site Address

The auth cookie is written for the domain in siteurl. If you visit https://yoursite.com but siteurl says http://yoursite.com or www.yoursite.com, the cookie is written for a different domain and the browser ignores it - loop.

Via FTP, add to wp-config.php (above the "stop editing" line):

define('WP_HOME','https://yoursite.com');
define('WP_SITEURL','https://yoursite.com');

Match exactly what you type in the address bar - same scheme, same www/non-www. Login restored? Later, fix the same values in Settings > General and remove the constants. Still looping? Check the database values directly in wp_options (siteurl, home) via phpMyAdmin.

Fix 3: Disable Plugins Via FTP

1.FTP in, rename wp-content/plugins to plugins_off
2.Try logging in - works? A plugin broke sessions (security, custom-login, or SSL plugins are the usual ones)
3.Rename back to plugins, reactivate one by one to find the culprit

Fix 4: Regenerate .htaccess

A corrupted .htaccess can break the login POST. Rename it to .htaccess_old via FTP, try logging in, then regenerate via Settings > Permalinks > Save. (Related: posts returning 404 shares this root cause.)

Fix 5: SSL / CDN Conflicts

If this started right after activating SSL or putting the site behind Cloudflare, the scheme is mismatched - login happens on https but WordPress thinks it's http. Set the constants above to https, and if you're on Cloudflare use Full (strict) SSL mode, not Flexible. Flexible + forced https causes the cookie-scheme mismatch that creates both login loops and redirect loops.

Locked Out With a Different Message?

"Sorry, you are not allowed to access this page" after logging in is a capabilities problem, not a session problem - see that fix. White screen instead of a loop: white screen of death guide.

Host That Handles SSL Correctly

Bluehost provisions SSL properly at install - no Flexible-mode mismatches, no cookie loops. $3.99/mo with 24/7 phone support when you need a human.

Get Bluehost from $3.99/mo

Find Your Perfect Hosting Plan

What are you building?

Tell us about your project so we can match the perfect hosting plan.

Question 1 of 425% complete

Interactive Tool

Hosting Cost Calculator

See exactly how much you'll spend on hosting over time. Compare Bluehost vs popular alternatives and discover your potential savings.

Time Period: 3 years

Monthly Revenue: $0

Used to calculate transaction fees (Shopify charges 2% on sales)

Compare Against:

Bluehost Plan:

Shopify Basic (3yr)

$1,044

Bluehost (3yr)

$444

You Save

$600

58% less than Shopify Basic

Save $600 with Bluehost →

Frequently Asked Questions

Why does wp-login keep sending me back to the login page?

Your credentials are accepted but the session can't stick - usually because WordPress's Site URL/Home URL settings don't match the URL you're visiting (http vs https, www vs non-www, or a changed domain), so the auth cookie is written for the wrong domain.

Is it a wrong password problem?

No - a wrong password shows an error message. A silent redirect back to the login form means authentication succeeded and the session broke afterward. If you do get an error message, that's a different fix (password reset via email or phpMyAdmin).

What's the fastest thing to try?

Clear your browser's cookies for the site or test in an incognito window. Corrupted cookies cause this often. If incognito works, it's purely a client-side cookie issue.

It started after I activated SSL or moved domains - why?

The siteurl option in the database still points to the old scheme/domain. Fix it by adding define('WP_HOME','https://newdomain.com') and define('WP_SITEURL','https://newdomain.com') to wp-config.php - both must match exactly what you type in the address bar.

Can a plugin cause the login loop?

Yes - security plugins, custom-login plugins, and SSL-forcing plugins are the usual suspects. Rename wp-content/plugins to plugins_off via FTP, try logging in, then restore the name and reactivate one by one.

What if the loop happens only on the live site but localhost works?

Classic sign of a URL mismatch introduced by migration or a CDN. Check Settings > General values, wp-config constants, and whether your CDN is rewriting or redirecting the login URL. Also see the ERR_TOO_MANY_REDIRECTS guide if the browser itself reports a loop.

Ready to launch?

Get Bluehost from $3.99/month with a free domain, free SSL, and 30-day money-back guarantee.

Start for $3.99 →