WordPress Login Redirect Loop 101: How to Fix It Safely

You know that the strong password you created is right. WordPress accepts the form, pauses for a second, and sends you straight back to the login screen.

A WordPress login redirect loop feels like a broken account, but the password is usually not the problem.

TL;DR: A WordPress login redirect loop usually happens when cookies, cache, URL settings, HTTPS/CDN configuration, plugins, themes, or redirect rules stop WordPress from keeping a valid login session. Start with browser and cache checks, then move through URL settings, plugins/themes, .htaccess, SSL/proxy settings, server permissions, and scan your WordPress site for malware with MalCare when the symptoms point to suspicious redirects, unknown users, spam, or reinfection.

The safe way through this is to prove where the loop lives before you start editing files. Treat it like a chain of handoffs: browser to cache, cache to WordPress, WordPress to plugins, plugins to server rules. One bad handoff can send you back to the same login page again and again.

The useful rule is simple: start where the fix is reversible. Do not edit server files because one browser has a stale cookie. Do not blame malware because a cache plugin stored the wrong redirect. If your symptom does not match this loop, start with the broader WordPress login issues checklist before changing files.

Confirm the symptom

First, make sure you are fixing a login loop and not a different WordPress failure.

A login redirect loop means you submit valid credentials and WordPress sends you back to wp-login.php, /wp-admin/, a custom login page, or the same login form. That is different from a wrong-password message, a blank white screen, a 403 or 500 error, or a full-site browser warning that says there are too many redirects.

What you see	Likely area	Try first
One browser loops, another works	Cookies, cache, or extension	Private window and site cookies
Every browser loops after login	WordPress URL, cache, plugin, theme, or redirect rule	Cache, URLs, then plugins
Whole site has too many redirects	HTTPS, CDN, proxy, or server redirects	SSL/CDN settings
Only logged-in users loop	Membership, WooCommerce, SSO, 2FA, or custom code	Access and login plugins
Loop returns after normal fixes	Malware, backdoor, vulnerable plugin, or server rule	Security scan and host review

This split matters. If only one browser is affected, editing wp-config.php is unnecessary risk. If the whole site is bouncing between HTTP and HTTPS, clearing WordPress cookies will not fix the real cause. The visible problem is always the same login screen. The hidden problem can live in completely different places. The screenshot below shows the kind of repeat login state this guide is focused on.

Use the safe order

Start with changes that are easy to reverse. Move to file and server changes only when the simple checks fail.

That order keeps the blast radius small. Cookies and cache are quick. URL and HTTPS mismatches are common. Plugin and theme isolation changes behavior but is reversible. Server and malware work needs more context. A successful fix should leave you at the WordPress dashboard with the admin session still active.

If you are working on a store, membership site, or lead-gen site, make a backup before file changes and avoid testing risky fixes on production during busy hours.

Clear browser data

Start with the device in front of you. This takes minutes and cannot break the site. Open a private window and try to log in. If that works, your browser had a stale session, cached redirect, or extension conflict.

If private browsing does not help, try another browser or device. Then clear cookies for the affected domain only. WordPress uses cookies to remember that you are logged in; if those cookies belong to the wrong domain, protocol, or old session, WordPress may keep treating you as logged out.

Also, disable privacy, redirect, script-blocking, and security extensions for one test. Extensions rarely cause a site-wide login problem, but they can break one person’s admin session and make the site look guilty. If another browser works, stop changing WordPress. Fix the browser that failed.

Clear every cache

If the loop happens across browsers, move outward. A cached login page or cached redirect can keep replaying the problem after the original trigger is gone. Clear all WordPress cache across the layers your site actually uses:

Login and admin pages should not be cached like public blog posts. Exclude wp-login.php, /wp-admin/, custom login URLs, account pages, cart and checkout pages, and pages shown only to logged-in users. Clearing cache is a test, not a full diagnosis. If the loop returns, something is still generating the bad redirect. That distinction matters. A cache can replay the problem, but it may not be the thing that created it.

Match the site URLs

URL mismatches are one of the most common causes of a WordPress login redirect loop. WordPress may set a login cookie for one address and then send you to another. Check these details:

If you can reach the dashboard, go to Settings > General and check WordPress Address (URL) and Site Address (URL). These are the two URL fields to compare before changing lower-level files or server rules.

If you are locked out, use FTP, SFTP, SSH, or your host file manager. Back up and safely edit the wp-config.php file, then add temporary constants above the line that says That’s all, stop editing! Add WP_HOME and WP_SITEURL with your real canonical URL, for example https://example.com. Keep the URL exact: protocol, domain, and subdirectory if the site uses one.

If this restores access, update the database values in Settings > General and remove the temporary constants when they are no longer needed.

Do not start with COOKIE_DOMAIN unless you know why you need it. It can help with stubborn cookie-domain issues, but most sites only need the main URLs, HTTPS setting, and redirects to agree. The cookie needs to belong to the same version of the site the browser is actually visiting. If WordPress sets one identity card and the browser walks into a different door, the session fails.

Fix HTTPS conflicts

HTTPS loops often appear after an SSL migration, Cloudflare setup, reverse proxy change, load balancer change, or host-level redirect update. The visible problem is simple: you cannot stay logged in. The hidden problem is that the browser, CDN, origin server, and WordPress may disagree about whether the request is HTTP or HTTPS.

If you use Cloudflare, check SSL/TLS mode. Full (strict) is usually the right target when your origin server has a valid SSL certificate. Flexible SSL is a common loop trigger because visitors connect to Cloudflare over HTTPS while Cloudflare connects to your server over HTTP. Avoid risky shortcuts:

If bypassing the CDN fixes login, keep the diagnosis there. Fix CDN SSL mode, proxy headers, page rules, cache rules, and origin certificate issues instead of masking the symptom inside WordPress. Disabling secure admin behavior is not a fix. It is usually a sign that the HTTPS chain still has a broken link.

Disable plugins safely

Plugins can change login URLs, access rules, redirects, cookies, cache behavior, and two-factor flows. Start with anything recently updated or anything that touches login.

Plugin type	What can go wrong	Check this
Security or firewall	Lockouts, changed login URLs, blocked admin requests	Login URL, 2FA, firewall, lockout rules
Cache or performance	Cached login pages or admin responses	Login and admin exclusions
Redirect plugin	Sends users back to login or a protected page	Rules for /wp-admin/ and wp-login.php
Membership or access control	Treats valid users as blocked	Roles, protected pages, account rules
WooCommerce	Loops My Account, checkout, or customer sessions	Account and checkout redirects
SSO or 2FA	Login succeeds in one layer and fails in another	Callback URLs, token expiry, time sync

If you can access the dashboard, deactivate one likely plugin and test. Avoid disabling everything at once unless you are locked out and need a broad reset.

If you cannot access the dashboard, open your site files and rename wp-content/plugins to plugins.disabled. Test login. If access returns, rename the folder back to plugins, then reactivate plugins one by one until the loop returns.

Renaming the folder does not delete plugin data. It only stops WordPress from loading the plugins while you test. One clue is worth watching: if the login URL keeps adding repeated redirect_to values, a plugin or custom rule may be sending you to a protected page that immediately sends you back to login.

The Plugins screen is the safest dashboard starting point for isolating login, redirect, cache, and access-control plugins.

Test the theme

Themes are less common than plugins, but they can still break login. The usual culprit is custom code in functions.php or a hook that redirects users after authentication.

If you can reach the dashboard, switch briefly to a default WordPress theme and test login again. Use the Themes screen to confirm the active theme before testing a temporary switch to a default WordPress theme.

If you are locked out, go to wp-content/themes/ and rename the active theme folder. WordPress should fall back to a default theme if one is installed. If this fixes the loop, do not simply switch the old theme back on. Ask a developer to review recent edits and redirect-related code such as wp_redirect, wp_safe_redirect, template_redirect, and login_redirect.

Backup your site before editing the theme files. A tiny syntax error in the wrong file can break both the dashboard and the public site.

Reset .htaccess

Only do this on Apache servers. .htaccess can control permalinks, redirects, security rules, and plugin rules before WordPress fully loads.

If you have not handled this file before, review how to edit .htaccess in WordPress before renaming or replacing it. For Apache sites:

Nginx does not use .htaccess. If your site is on Nginx, ask your host to check routing rules instead. After replacing an Apache .htaccess file, Permalink Settings is where WordPress can regenerate its normal rewrite rules.

Do not copy redirect rules from another site. They may use the wrong domain, folder, SSL setup, or plugin assumptions.

Escalate server issues

If browser, cache, URL, HTTPS, plugin, theme, and .htaccess checks do not explain the loop, the problem may sit below WordPress. Ask hosting support to check:

Normal permission baselines are usually 755 for folders, 644 for files, and tighter permissions for wp-config.php where the host supports it. Do not change everything to 777. That makes files writable by far too many users and creates a security risk.

If /wp-admin/index.php works but /wp-admin/ loops, mention that to your host. That clue points toward server index or routing behavior, not your password. Site Health can give you a cleaner snapshot of server and configuration clues before you contact support.

At this stage, good support details save time. Tell the host exactly which URL loops, which URL works, what changed recently, and whether the behavior appears with the CDN paused.

Know when to get help

Some login loops are not worth debugging alone, especially on a store, membership site, lead-gen site, or client site where downtime costs money. Use this split:

Situation	Best next step
CDN, SSL, server cache, permissions, disk space, ModSecurity, or routing looks involved	Contact your host
Custom login code, theme redirects, SSO, membership rules, WooCommerce account redirects, or multisite constants are involved	Contact a developer
Unknown redirects, new admin users, suspicious files, SEO spam, blacklist warnings, or repeated reinfection appear	Scan and clean the site

The useful rule is this: stop experimenting once the problem moves below your comfort level. Random changes in production can turn a login problem into a wider outage.

Scan for malware

A login redirect loop is not automatically a hack. Most loops come from cookies, cache, URL settings, plugins, themes, SSL, or server rules. Scan for malware if you also see:

If wp-admin is unreliable, use an external scanner that does not depend on dashboard access. MalCare is useful here because it can scan from outside WordPress when the dashboard is locked, redirecting, or not trustworthy.

If malware is found, scanning is only the diagnosis. Clean the malware and backdoors, patch vulnerable plugins and themes, change passwords, review admin users, rotate security keys where needed, and monitor for reinfection. MalCare’s WordPress malware removal is relevant when the site needs cleanup, not just confirmation that something is wrong.

The practical rule is simple: do not panic over a loop by itself, and do not ignore a loop with suspicious redirects, unknown admins, spam, or repeated reinfection.

Verify the fix

One successful login is not proof that the problem is solved. Test while the cause is still fresh.

Write down what caused the loop and what fixed it. That note matters after the next migration, plugin update, SSL change, or CDN rule change.

Prevent repeat loops

Prevention is mostly about keeping the login path boring.

Conclusion

Start with the reversible checks first: browser data, cache, URL settings, and recent plugin changes. Escalate only when the symptom points to HTTPS/CDN, server routing, permissions, or suspicious security activity. Once login works again, document the cause and fix the weak spot so the same loop does not come back after the next update or migration.

FAQs

Why does WordPress keep sending me back to the login page?

Usually WordPress cannot keep a valid login session, or something is redirecting the request back to login. The common causes are cookies, cache, mismatched site URLs, HTTPS/CDN conflicts, plugins, themes, .htaccess, server routing, or malware.

How do I fix it without dashboard access?

Use your host file manager, FTP, SFTP, or SSH. You can clear host/CDN cache, set temporary WP_HOME and WP_SITEURL constants, rename wp-content/plugins, rename the active theme folder, or rename .htaccess depending on the symptom.

Can a plugin cause a login redirect loop?

Yes. Security, cache, redirect, custom login, 2FA, membership, WooCommerce, SSO, and access-control plugins can all affect login flow. Disable the most likely plugin first, then reactivate plugins one by one to find the culprit.

Is a WordPress login redirect loop a sign of malware?

Not by itself. Most loops are configuration, cache, plugin, theme, SSL, or server problems. Treat malware as a serious possibility when the loop appears with unknown redirects, new admin users, changed files, SEO spam, blacklist warnings, suspicious plugins, or repeated lockouts.

What should I do if the loop comes back?

Look for the trigger that changed between the fix and the return: a plugin update, cache rule, CDN change, SSL renewal, migration, redirect rule, theme edit, or new security alert. If the loop returns with suspicious activity, scan the site and check for backdoors instead of repeating the same surface fix.