Error guide / WordPress login redirect loop
WordPress login redirect loop
A WordPress login redirect loop is when you enter the right username and password, press Log In and land back on wp-login.php, often with reauth=1 or redirect_to in the address bar and no error message. Sometimes the browser gives up instead and shows ERR_TOO_MANY_REDIRECTS. Either way, by the time the request reaches /wp-admin/ WordPress does not believe you are logged in, so it sends you to log in again, and the cycle repeats. The password is almost never the problem: a wrong password shows an error, a loop does not.
Check your site
What causes it
WordPress keeps you logged in with cookies that belong to a specific host and path, and the loop starts whenever the cookie set at login does not come back with the next request to the admin. The usual reason is a mismatch between the WordPress Address and Site Address settings, for example one with www and the other without, or one on http and the other on https: you log in on one host and get sent to an admin on another, where the cookie does not apply. A close second is HTTPS behind a proxy or CDN: the visitor is on https, but the server only sees plain http coming from Cloudflare or a load balancer, so WordPress decides the request is not secure, looks for the wrong cookie or redirects to https again, round and round. Other causes are a page cache or CDN that caches wp-login.php or /wp-admin/, a wrong COOKIE_DOMAIN in wp-config.php, a security or redirect plugin, and duplicate https or www rules in .htaccess that undo each other.
How to fix it
- Run the check on this page for https://your-site.com/wp-admin/, using the address you actually log in at. A healthy site answers with one 302 redirect to wp-login.php with redirect_to and reauth=1, and that login page returns 200. Our check sends no cookies, so it sees what a logged-out visitor sees. If the chain is clean, the loop only happens after login and lives in cookies, the proxy setup or caching. If the check itself reports a redirect loop, or bounces between http and https or between www and the bare domain, you have found the conflict without logging in at all.
- Compare the two addresses in Settings, General: WordPress Address (URL) and Site Address (URL). They must use the same scheme and the same host as the address in your browser, normally both https and both with or both without www. If you cannot reach the admin to change them, add define('WP_HOME', 'https://your-site.com'); and define('WP_SITEURL', 'https://your-site.com'); to wp-config.php above the line that says to stop editing. These override the values in the database.
- If the site runs behind Cloudflare, a load balancer or a reverse proxy, make WordPress see HTTPS. In Cloudflare, set SSL/TLS to Full (strict) instead of Flexible. For other proxies that send the X-Forwarded-Proto header, add this to wp-config.php before wp-settings.php is loaded: if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') { $_SERVER['HTTPS'] = 'on'; }
- Exclude the login and the admin from every cache. wp-login.php, /wp-admin/ and any request carrying a wordpress_logged_in cookie must never be cached by a caching plugin, the server's page cache or a CDN rule such as Cache Everything. Purge the cache after changing the rule.
- Rule out plugins and .htaccess. Rename the wp-content/plugins folder through FTP or the file manager to switch off all plugins at once, then try to log in. If it works, rename the folder back and reactivate plugins one by one, starting with security, redirect and caching plugins. In .htaccess, look for duplicate rules that force https or www: there should be one canonical redirect, not two that fight each other.
- Finally, clear the site's cookies in your browser or try a private window, and look for a COOKIE_DOMAIN line in wp-config.php. If it names a different host than the one you log in at, remove it: WordPress picks the right cookie domain by itself.