WordPress Login Redirect Loop? Recover wp-admin Fast

You enter the correct password, WordPress appears to accept it, and then sends you straight back to the login page—or the browser shows “too many redirects.” This is usually a session, URL, rewrite, plugin or HTTPS configuration problem. The safest fix is to identify which layer is creating the loop rather than changing everything at once.

What a WordPress Login Redirect Loop Looks Like

The issue can appear in several ways:

• wp-login.php refreshes after you submit valid credentials.
• /wp-admin/ sends you back to the login form.
• The URL repeatedly adds reauth=1.
• The browser reports ERR_TOO_MANY_REDIRECTS.
• The problem started after changing the domain, enabling HTTPS, moving hosts or activating a security plugin.

If an incorrect password produces a normal error but the correct password loops, authentication may be succeeding while the login cookie or post-login redirect is failing.

Step 1: Clear Only This Site’s Cookies

Delete cookies and cached site data for the affected domain, then retry in a private/incognito window. Also test the exact canonical URL—such as https://example.com/wp-admin/ rather than an old HTTP or www variation.

If the loop happens on every browser and device, move to the server-side checks below.

Step 2: Verify Home and Site URL

A mismatch between the WordPress Address and Site Address is one of the most common causes after a migration, SSL change or accidental settings edit. Both should normally use the real public hostname and the same protocol.

When wp-admin is inaccessible, temporary recovery constants can be added above the “stop editing” line in wp-config.php:

Replace the example domain with the correct canonical address. If this restores access, correct the saved values properly before removing the temporary constants.

Step 3: Test the .htaccess Rules

Security, redirect and caching plugins sometimes write conflicting rewrite rules. Through File Manager or SFTP:

1. Back up the existing .htaccess.
2. Rename it to .htaccess-old.
3. Try the login again.
4. After access is restored, visit Settings → Permalinks and save once to generate clean WordPress rules.

If renaming the file fixes the loop, inspect the old file for forced-domain, HTTPS or plugin-generated redirects before restoring anything.

Step 4: Disable Plugins Without wp-admin

Login, security, membership, redirect, caching and two-factor plugins can all intercept authentication or post-login routing.

To test all plugins at once, rename:

If login works, restore the original folder name and disable plugins individually. Start with anything that controls login URLs, SSL, redirects, user roles, security or cache.

For a large plugin stack, test groups rather than one plugin at a time. This binary-search approach finds the conflict much faster.

See the detailed WordPress plugin conflict recovery guide for safe isolation and rollback steps.

Step 5: Rule Out Theme Redirect Code

A custom theme can use login hooks, membership logic or hard-coded redirects. If plugin isolation does not help, temporarily switch to a default WordPress theme. Without wp-admin, rename the active theme folder so WordPress falls back to another installed default theme.

If the loop disappears, inspect custom functions using hooks such as login_redirect, login_url, template_redirect or forced dashboard redirects.

Step 6: Check HTTPS, Cloudflare and Reverse Proxy Settings

This is where many basic guides stop too early. WordPress may see the connection as HTTP while Cloudflare, a load balancer or the host presents HTTPS to the visitor. WordPress then redirects to HTTPS repeatedly because the server never reports the expected scheme.

Check:

• Cloudflare SSL mode is appropriate for the origin certificate.
• The host is not forcing HTTPS in a second conflicting layer.
• The application correctly receives forwarded HTTPS headers.
• There is no simultaneous www-to-non-www loop at the CDN and server.
• A migration did not leave an old proxy or cache rule active.

Step 7: Clear Every Relevant Cache Layer

After correcting the cause, clear caches in this order:

1. Browser/site data
2. WordPress caching plugin
3. Persistent object cache such as Redis
4. Host/server cache
5. CDN or Cloudflare cache

A stale redirect can remain cached even after the underlying configuration is fixed.

When the Loop Started After Changing the URL

Check all of the following:

• home and siteurl in the WordPress options table
• WP_HOME and WP_SITEURL constants
• www versus non-www consistency
• HTTP versus HTTPS consistency
• old-domain redirect rules
• Cloudflare Page Rules or Redirect Rules
• host-level domain forwarding

Do not keep redirecting between multiple versions of the domain. Choose one canonical URL and make every layer agree with it.

What Not to Do

• Do not edit WordPress core files.
• Do not delete plugins before preserving the files and identifying the cause.
• Do not paste random HTTPS snippets into wp-config.php without checking the proxy setup.
• Do not clear all browser data when site-specific cookie removal is enough.
• Do not assume .htaccess is the only cause.
• Do not perform an unsafe database search-and-replace.

Frequently Asked Questions