There is a particular kind of frustration that comes with the WordPress login redirect loop. You type your username and password, hit Log In, and instead of landing in the dashboard, you end up right back at the login page — again. No error message, no access denied notice, just the login page staring back at you. The WordPress login redirect loop is deceptive precisely because it looks like it might be a password problem, which sends many site owners down the wrong path of resetting credentials that were correct all along. I have dealt with this on my own sites and on client installations, and the actual causes are always something else entirely — cookies, URL mismatches, broken sessions, or plugin interference. This guide covers every real cause and fix for the WordPress login redirect loop so you can get back into your dashboard without changing anything that does not need changing. For a broader walkthrough, our WordPress Errors Complete Guide is a good next read.
Why the WordPress Login Redirect Loop Happens
The WordPress login process works by issuing an authentication cookie when you submit correct credentials, then redirecting you to the dashboard. The dashboard page reads that cookie to confirm you are authorised, and lets you in. The WordPress login redirect loop occurs when something in that sequence breaks — most often when the authentication cookie cannot be set, cannot be read, or when the URL WordPress expects to redirect to does not match the URL the browser is actually on.
The most common single cause of the WordPress login redirect loop is a mismatch between the WordPress Address (URL) and Site Address (URL) settings in the database and the actual domain the site runs on. If WordPress thinks it lives at http://example.com but the server serves it at https://example.com, the login cookie is set for one URL and the redirect goes to the other — and because the URLs do not match, the cookie is not sent with the redirected request, and authentication fails every time. This produces a perfect WordPress login redirect loop that clears the moment the URL settings match reality.
Browser-side cookie problems are the second most common cause. The WordPress login redirect loop can occur when the browser has a stale, corrupted, or conflicting cookie from a previous WordPress session. The old cookie interferes with the new authentication response, and the result is that WordPress cannot establish a clean authenticated session — sending you back to the login page on every attempt. Caching problems, both browser-side and server-side, work the same way: a cached version of the login page or a cached redirect rule can trap the login process in a loop regardless of whether your credentials are correct.
Plugin interference is the fourth cause worth understanding before you start fixing things. Security plugins, caching plugins, and redirect plugins all touch the WordPress authentication flow. A security plugin with an aggressive login lockout rule, a caching plugin that caches the login redirect, or a redirect plugin with a rule that catches /wp-admin/ URLs can each create a WordPress login redirect loop that has nothing to do with your credentials, your site’s URL settings, or your cookies in isolation. Knowing that a plugin could be responsible saves you from exhausting other fixes before getting to the right one.
First Fix — Clear Cookies and Try a Different Browser
The fastest thing to try when you encounter a WordPress login redirect loop is clearing your browser’s cookies for the site and attempting login again, or switching to a completely different browser. This takes two minutes and immediately rules out browser-side cookie issues as the cause.
In Chrome: Settings → Privacy and security → Delete browsing data → tick Cookies and other site data, set the time range to All time, and delete. In Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → search for your domain → Remove Selected. In Safari: Settings → Privacy → Manage Website Data → search for your domain → Remove. After clearing cookies, return to your WordPress login page and attempt login fresh.
If clearing cookies does not break the WordPress login redirect loop, try a completely different browser or an incognito/private window (which starts with no cookies). If login works in a fresh browser session but not in your regular browser, the problem is definitely browser-side — a corrupted cookie or a cookie from an old WordPress install that is interfering. Continue clearing all cookies and site data in your regular browser until the conflict is gone.
If the WordPress login redirect loop persists in every browser and every incognito window, the problem is server-side rather than browser-side, and the fixes below address the actual underlying cause.
Fix the WordPress Login Redirect Loop Caused by URL Mismatches
A WordPress Address and Site Address mismatch is the most structurally common cause of the WordPress login redirect loop, particularly on sites that have recently added an SSL certificate, migrated to a new domain, or been moved from a subdirectory to the root. The fix involves correcting these URL values in the database to match the actual URL the site uses.
The cleanest way to check and fix these values without being able to log in is through wp-config.php. Connect via FTP, open wp-config.php, and add these two lines before “That’s all, stop editing!”:
define( 'WP_HOME', 'https://yoursite.com' ); define( 'WP_SITEURL', 'https://yoursite.com' );
Replace https://yoursite.com with the exact URL your site uses — including or excluding www, and with the correct protocol (http or https). Save the file and attempt login. If the WordPress login redirect loop clears, these constants are overriding incorrect database values and your login is working. You should then update the actual database values to match: log in to phpMyAdmin, select your WordPress database, open the wp_options table, find the rows where option_name is siteurl and home, and update their values to match what you put in wp-config.php. After the database is corrected, you can remove the constants from wp-config.php — the WordPress login redirect loop will not return because the root cause is now fixed at the database level.
Deactivating Plugins When the Loop Persists
If the cookie and URL fixes have not resolved the WordPress login redirect loop, a plugin is the likely culprit. Security plugins are the most frequent offenders — particularly those with login protection features that can accidentally block successful logins or interfere with the authentication redirect. Caching plugins are the second most common cause, as they can cache the redirect response that produces the loop and serve it to every subsequent login attempt regardless of the actual authentication outcome.
Because the WordPress login redirect loop prevents dashboard access, plugin deactivation has to go through FTP. Connect to your server and navigate to wp-content/plugins/. Rename the entire plugins folder to plugins_off — this deactivates every plugin simultaneously without deleting anything. Attempt login. If the WordPress login redirect loop is gone, rename the folder back to plugins and then rename individual plugin folders one at a time, attempting login after each, until the loop returns. The last plugin folder you renamed before the loop came back is the problem plugin.
Security plugins that caused the WordPress login redirect loop often have their own login URL or authentication settings that need to be reconfigured after the plugin is reactivated. Look for settings related to login protection, IP blocking, two-factor authentication, or custom login URLs in the plugin’s configuration — any of these can interfere with the standard WordPress authentication flow that the WordPress login redirect loop diagnosis leads back to.
Reset WordPress Security Keys and Authentication Cookies
If the WordPress login redirect loop is still present after clearing cookies, fixing URL settings, and deactivating plugins, resetting the WordPress secret keys and salts is the next step. These cryptographic values are used to secure authentication cookies — if they have been changed by a plugin, a security scan, or a manual edit to wp-config.php, existing authentication cookies become invalid and the login process fails, producing the WordPress login redirect loop.
Visit the WordPress secret key generator at wordpress.org/about/security/ — it produces a fresh set of eight unique keys on every page load. Copy the entire output block, open wp-config.php via FTP, and replace the existing key definitions with the new ones. The section looks like this in wp-config.php:
define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); ...
Replace all eight lines with the freshly generated values and save. This immediately invalidates all existing login sessions and authentication cookies site-wide — which is exactly what is needed when stale or invalid cookies are contributing to the WordPress login redirect loop. All logged-in users will be logged out and need to log in again. Attempt login after saving the file to confirm the WordPress login redirect loop has cleared.
Check .htaccess for Redirect Rules Causing the Loop
A .htaccess file with a redirect rule that catches /wp-login.php or /wp-admin/ requests is a structural cause of the WordPress login redirect loop that is easy to miss because it operates at the server level, below WordPress itself. A security plugin that adds a custom login URL rule, a maintenance mode redirect that did not get cleaned up, or a manual redirect rule added to improve site security can all produce the WordPress login redirect loop independently of anything in the WordPress application.
Connect via FTP and download the .htaccess file from your WordPress root for inspection. Look for redirect rules that reference wp-login, wp-admin, or authentication-related paths. A rule redirecting /wp-login.php to a custom login URL when no corresponding custom login page exists, or a rule redirecting all HTTPS requests through an HTTP path (or vice versa) that conflicts with the WordPress URL settings, can both sustain the WordPress login redirect loop. Rename the existing .htaccess to test whether it is the cause — if login works with the file renamed away, the problem rule is inside it. Regenerate a clean file via Settings → Permalinks → Save Changes, then manually add back only the custom rules you actually need.
Our guide on fixing the WordPress database connection error covers database-level URL corrections via phpMyAdmin in more detail than this guide does — useful if the wp-config.php constant approach did not resolve your WordPress login redirect loop and you want to address it directly in the database. Our guide on how to secure the WordPress admin covers the security plugin configurations that most often interfere with login flow, including the specific settings to check when a security plugin is suspected of causing the WordPress login redirect loop. The WordPress support forums have extensively documented hosting-specific variations of the WordPress login redirect loop, particularly on servers where the SSL termination happens upstream of the WordPress installation. Our guide on How to Fix WordPress Redirect Loop Safely With Proven Recovery Steps covers an adjacent issue.
