WordPress login redirect loop: the causes, in order

You type the username and password, WordPress does not complain, and it shows the sign-in screen again. Or the browser gives up with “too many redirects”. This is the login loop. The password is almost never the problem: WordPress cannot keep the session, or is being bounced from one address to another without end. These are the causes, from the commonest to the rarest.

In this order

1 Try a private window. If you get in, the culprit is your browser’s cookies or cache. Clear the cookies for this site and go back to the normal window.
2 Compare WordPress’s two addresses. In Settings, General, the “WordPress Address” and the “Site Address” have to match what you type in the bar, including https and whether www is there. If one says http and the other https, or one has www and the other does not, a session created on one is worthless on the other. If you cannot even reach that page, use the WP_HOME and WP_SITEURL lines in wp-config.php, as in changing the site address.
3 Look for two HTTPS rules fighting each other. The .htaccess redirect, an SSL plugin and Cloudflare’s “Flexible” setting can each send the visitor the other way, forever. Keep only one. See switching on SSL at Cloudflare without breaking the site and redirecting HTTP to HTTPS with .htaccess.
4 Deactivate the plugins. Security plugins, login-address changers and cache plugins are the usual suspects. To test, rename the wp-content/plugins folder: WordPress leaves them all deactivated. If the loop ends, put the name back and switch the plugins on again one by one.
5 Switch to a default theme. A theme with a bug in its code can wreck the session.
6 Reset .htaccess. Rename it and save the permalinks: WordPress writes a clean one.
7 Empty the site cache. If a cache stored the login screen, it serves it to everyone, session-less. Login and dashboard pages should never be cached: see cache rules that do not hide the dashboard.

What each sign points to

Sign Where to look
You get in from a private window but not the normal one Browser cookies and cache.
It works with www and fails without (or the other way round) The two addresses in Settings, General.
The browser says it redirected too many times Duplicate HTTPS rules: .htaccess, a plugin and Cloudflare.
It came back when you renamed the plugins folder A plugin, usually a security or cache one.
Do not lose your administrator session experimenting without a copy. Before touching wp-config.php or .htaccess, keep a copy of the file you are about to change. A one-line mistake can turn a login loop into a whole site that is down.
If it started right after changing domain or moving to HTTPS, it is almost certainly the addresses. Make the two identical, clear the caches and sign in again. If the cause is something else, the six usual reasons you cannot get into the dashboard covers the rest.

Still bouncing back to the sign-in screen? Tell us the site address and the step you stopped at, and we will check what the server returns from our side.

Open a support ticket

SEE ALSO

WordPress hosting

SSL certificates

Support Policy

RECOMMENDED PRODUCT

WordPress hosting

One-click install, updates handled, and speed that holds up. from $6.59/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to install WordPress in a few clicks You don't have to download WordPress, create a database and upload files by hand. The installer in cPanel does all of it...
Common WordPress errors: white screen, critical error and how to find the cause The site stopped opening and shows a blank white screen, or the line «There has been a critical error on this website»....
Cannot get into the WordPress dashboard: the six usual causes The site opens, but the admin dashboard does not. Either it asks for the password in an endless loop, or it says the det...
How to remove WordPress from a domain, without leaving anything behind You want WordPress off a domain, because the installation broke, because you are starting over, or because the site is b...
Protecting the WordPress login: three steps in order of effect WordPress’s login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated...
Mixed content after moving to HTTPS: the padlock that will not turn on The certificate is installed, the site opens on https, and the browser still says “not secure” or shows a padlock with a...