AmaarDev.
Hire Me

How to Fix WordPress Login Page Refreshing and Redirecting (2026 Guide)

Fix WordPress login page refreshing — laptop showing a WordPress login form on a desk

You type the correct username and password, hit Log In, and the page just reloads. No error message, no “incorrect password” warning — the same login form, staring back at you. If that sounds familiar, you need to fix WordPress login page refreshing, and the good news is that the cause is almost always one of a handful of things: a cookie problem, a URL mismatch, a plugin conflict, or a bad redirect rule. This guide walks through each fix in the order you should try them, starting with the ones that take thirty seconds.

Why the WordPress Login Page Keeps Refreshing

WordPress proves you are logged in with cookies. When you submit the login form, WordPress checks your credentials against the database and, if they are correct, sends back an authentication cookie — wordpress_logged_in_[hash] (and wordpress_sec_[hash] on HTTPS sites). Your browser stores that cookie and sends it with every later request, including the redirect to /wp-admin/.

The refresh loop happens when that round trip breaks: the cookie is never stored, is stored for the wrong domain, or is overwritten by a conflicting value. WordPress then sees an unauthenticated request on the next page load and sends you straight back to wp-login.php. Your password was never the problem — the cookie handshake was. That is also why this loop is silent: WordPress has nothing to complain about, because as far as it can tell, you simply never logged in.

Before You Start: Confirm What Kind of Loop You Have

Not every login problem is the same loop, and the fix depends on which one you have:

  • The form reloads with no error after correct credentials — almost always a cookie or URL problem. Start with Fix 1.
  • The browser shows “too many redirects” or ERR_TOO_MANY_REDIRECTS — a redirect rule is bouncing the request between two URLs, usually HTTP and HTTPS. Jump to Fixes 2 and 6, and see my guide on how to fix a WordPress redirect loop for the deeper version.
  • You are sent to the homepage or another page after logging in — a plugin (security, membership, or custom-login plugin) is redirecting you. Jump to Fix 3.
  • Only one user is affected — it is almost certainly that user’s browser. If every user is locked out, the problem is server-side.

Open a private or incognito window and try logging in at your site’s exact canonical address, for example https://yourdomain.com/wp-login.php. If it works there, your normal browser profile has stale cookies — Fix 1 will sort it. If it fails in incognito too, work through the rest of the fixes.

Fix 1: Clear Your Browser Cookies and Cache

This fixes the problem more often than anything else, so always try it first.

  1. Open your browser settings and find the cookie and site-data section.
  2. Clear cookies and cached data specifically for your site’s domain — clear both the www and non-www versions if both exist.
  3. Close the browser completely, not just the tab. Some cookie state survives across tabs in the same session.
  4. Reopen the browser and try logging in again.

Also try a different browser entirely. If Chrome loops but Firefox logs you in, the problem is isolated to Chrome’s stored data for your domain, and clearing it (or removing any extensions that block third-party cookies) will fix it.

Fix 2: Check the WordPress Address and Site Address

WordPress stores two URLs in Settings > General: the WordPress Address (URL) and the Site Address (URL). If these disagree with the address you actually use — one says http:// while the site loads over https://, or one includes www and the other does not — WordPress sets its login cookie for one domain and then redirects you to the other, where the cookie is meaningless. Loop.

If you can reach the dashboard, check both fields match your real address exactly, including the https:// and the www choice. If you are locked out, you can hard-code both values in wp-config.php (via FTP or your host’s file manager), above the line that says “That’s all, stop editing!”:

define( 'WP_HOME', 'https://yourdomain.com' );
define( 'WP_SITEURL', 'https://yourdomain.com' );

Replace yourdomain.com with your actual domain, keeping the scheme and www exactly as visitors reach the site. Save the file and try logging in again. If this fixes it, remove the two lines afterwards and set the correct values in Settings > General instead — hard-coded constants override the database and will bite you the next time the domain changes.

Fix 3: Disable Plugins Without Dashboard Access

Security plugins, custom-login plugins, membership plugins, two-factor plugins, and redirect plugins can all intercept the login before it completes. A single misbehaving plugin is one of the most common causes of a login loop that starts right after an update.

Since you cannot reach the dashboard, use FTP or your host’s file manager:

  1. Open wp-content/plugins/.
  2. Rename the plugins folder to plugins-disabled. This deactivates every plugin at once.
  3. Try logging in. If it works, the culprit is a plugin.
  4. Rename the folder back to plugins, then reactivate plugins one at a time from the dashboard, testing the login after each one, until the loop returns. That plugin is your culprit — leave it deactivated and look for an update or a replacement.

If you have WP-CLI access, the same test is faster: wp plugin deactivate --all, test the login, then reactivate plugins one by one with wp plugin activate plugin-name. Suspect security and login-related plugins first — they are the usual offenders, which is why a good WordPress security hardening checklist matters, but only when the plugin is configured correctly.

Fix 4: Switch to a Default Theme

A theme can also break login, usually through a custom functions.php that redirects users or a broken login template. The test is the same idea as Fix 3: rename your active theme’s folder inside wp-content/themes/ (for example, my-theme to my-theme-disabled). WordPress will fall back to a default theme such as Twenty Twenty-Five if one is installed. If the login works, the theme is the problem — check its functions.php for redirect or login hooks, or contact the theme author.

Fix 5: Reset Your .htaccess File

A corrupted or badly edited .htaccess file can redirect wp-login.php or wp-admin in a circle, especially after a security plugin or a migration writes rules into it. To test:

  1. Download a backup copy of .htaccess from your site root, then delete the file from the server (or rename it to .htaccess-backup).
  2. Try logging in. If it works, the file was the problem.
  3. Once you are in, go to Settings > Permalinks and click Save Changes. WordPress regenerates a clean default .htaccess for you:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Compare this with your backup before restoring anything from it — any extra redirect rules between the # BEGIN WordPress and # END WordPress markers were added by a plugin or by hand, and one of them is the likely culprit.

Fix 6: Fix SSL, Proxy, and Cloudflare Settings

If the loop started after you enabled SSL, moved hosts, changed domains, or added a CDN, the redirect is almost certainly a scheme mismatch: the proxy or CDN talks to your origin over HTTP while WordPress believes the site is HTTPS (or the reverse), so each side redirects to the other forever.

Check these in order:

  • Cloudflare: in the Cloudflare dashboard, set SSL/TLS encryption mode to Full (or Full Strict) — not Flexible. Flexible mode makes Cloudflare serve HTTPS to visitors while connecting to your origin over plain HTTP, which is the classic recipe for a login loop. This is the single most common Cloudflare-related cause.
  • Force HTTPS consistently: make sure your site URL uses https:// (Fix 2) and that any HTTP-to-HTTPS redirect in .htaccess or your host panel points at the same canonical address.
  • Reverse proxy: if your host terminates SSL at a load balancer or proxy, WordPress needs to know the original request was HTTPS. Most managed hosts handle this automatically; if yours does not, ask the host to check the X-Forwarded-Proto handling rather than adding proxy code to wp-config.php by guesswork.

For the full picture on scheme-related loops, see the official WordPress HTTPS administration guide.

Fix 7: Stop Caching the Login Page

Login pages must never be served from cache. If a caching plugin, your host’s page cache, or a CDN caches wp-login.php or an authenticated session, you can be handed a stale logged-out page no matter how many times you submit the form.

Exclude /wp-login.php, /wp-admin/, and all logged-in sessions from every layer of caching: your caching plugin’s exclusion list, your host’s cache settings, and any CDN page rules. Then purge all caches and try again. If your host offers a “bypass cache for logged-in users” toggle, make sure it is on.

Fix 8: Check wp-config.php and the Error Log

If none of the above works, look for something quietly wrong in the configuration:

  • Stray constants in wp-config.php: search for COOKIE_DOMAIN, ADMIN_COOKIE_PATH, or FORCE_SSL_ADMIN. A COOKIE_DOMAIN set to the wrong domain makes every login cookie invalid. Unless you deliberately set these, remove them.
  • Disk space: if the server disk is full, WordPress cannot write session data. Your host can confirm this in seconds.
  • PHP errors: enable WP_DEBUG temporarily, or check the server error log for warnings on wp-login.php. A fatal error in an mu-plugin or a drop-in can kill the login before the redirect completes.

When the loop is accompanied by a white screen instead of a reload, the cause is usually different — see my guide on fixing the white screen of death in WordPress.

When to Contact Your Host

If you have worked through all eight fixes and the login still loops, it is time to open a ticket. Give the host three things: when the loop started, what changed just before it (SSL, migration, plugin update, domain change), and whether it affects every user or just you. Ask them to check server redirect rules, the mod_security or firewall rules blocking wp-login.php, and whether the site recently moved between servers. Most hosts can spot a server-level redirect in minutes.

Frequently Asked Questions

Why does WordPress keep redirecting me to the login page after I log in?

Because the authentication cookie is not surviving the round trip. Either it was never stored (browser cookies or cache), it was stored for the wrong domain (URL mismatch), or something overwrote it (a plugin, a CDN rule, or a bad COOKIE_DOMAIN constant). Work through Fixes 1–3 first — they cover the large majority of cases.

Is a login loop the same as a wrong password?

No. A wrong password shows an error message (“The password you entered for the username is incorrect”). A loop shows no error at all. If you see no error, do not reset your password — it will not help.

Can a security plugin cause a login loop?

Yes — security, two-factor, and custom-login plugins are the most common plugin culprits, because they hook directly into the login flow. If you recently enabled one, disable it via FTP (Fix 3) and re-check its settings before reactivating. If you use two-factor authentication, see my guide on adding two-factor authentication to WordPress to make sure it is set up correctly.

Why did the loop start right after I added Cloudflare?

Almost always the SSL mode. Cloudflare’s Flexible mode serves HTTPS to visitors but talks HTTP to your origin, so WordPress and Cloudflare redirect each other in a circle. Switch the SSL/TLS mode to Full or Full Strict and the loop usually stops immediately.

Being locked out of your own site is stressful, but a WordPress login loop is a configuration problem, not a broken site — and it is fixable in minutes once you find the layer that is breaking the cookie handshake. Start with cookies, then URLs, then plugins, and you will find it. If you would rather have a developer sort it out for you, get in touch through my contact page — I fix WordPress login and access issues for clients regularly, and most are resolved the same day.