The WordPress login redirect loop happens when you enter correct credentials and the page just refreshes back to the login form — never granting access. Your username and password are usually correct. The issue is a session or cookie problem preventing WordPress from maintaining authentication.
Most common causes we diagnose:
Systematic, fast, and safe process:
First, clear all cookies for your domain in your browser. Then open a new private/incognito window and try logging in again. This rules out browser-side cookie corruption.
Via WP-CLI: wp option get siteurl and wp option get home. Both must match your exact domain including correct http:// or https:// prefix. Fix with: wp option update siteurl https://yourdomain.com
Rename /wp-content/plugins/ to plugins_backup/. This bypasses all plugin code and usually breaks the login loop immediately. Then re-enable plugins one by one.
Our WordPress expert responds in minutes.
User-specific login loops are usually caused by corrupted session data or browser cookies for that specific user. Clearing all cookies for the domain, or creating a new admin user, resolves this.
After adding SSL, the database still has http:// in siteurl and home. WordPress tries to redirect to https://, but the cookie was set for http://, creating an infinite loop. Update siteurl and home to https:// and the loop stops.
After entering correct credentials, WordPress redirects you back to the login page instead of the dashboard. Your credentials are accepted but the session/redirect logic fails. Common causes: cookie/session config, multiple plugins fighting over redirects.
Browser cookie blocking, third-party cookie restrictions (Safari ITP), or browser extensions interfering with cookies. Test in incognito mode first — if it works there, an extension or stale cookie is the cause.
Yes — most common cause. WP_HOME and WP_SITEURL must match the URL you're actually using. If site is at https://yoursite.com but settings say http://yoursite.com, cookies for HTTPS get rejected by HTTP backend.
Edit wp-config.php and add `define('WP_HOME', 'https://yoursite.com');` and `define('WP_SITEURL', 'https://yoursite.com');` These override database settings and force correct cookies.
Yes. Wordfence, iThemes Security can have settings that interfere with login flow (custom login URLs, IP-based redirects, geographic blocks). Disabling temporarily isolates the issue.
Different cookie paths. WordPress sets some cookies for / and others for /wp-admin. If cookie path is wrong, /wp-admin can't read the session cookie that /wp-login.php just set.
Yes. If domain mapping is misconfigured, sub-sites may set cookies for the wrong domain, causing loops. We verify SUBDOMAIN_INSTALL and DOMAIN_CURRENT_SITE settings in wp-config.php.
Often yes — for stale/conflicting cookies. We always recommend testing in incognito after fixing server config to avoid being misled by cached cookies.
Yes. Updates that change cookie names/paths or break session handling cause loops. Rolling back the update often fixes it; we then patch the underlying issue properly.
Admin users redirect to /wp-admin (different path/domain rules). Regular users redirect to /home or front-end. Cookie or path issue specific to /wp-admin causes admin-only loops.
Yes — Cloudflare or other CDN may strip or modify cookies. We configure CDN to bypass cache for /wp-admin and /wp-login.php and forward all cookies properly.
No — it requires a config or code fix. The longer it persists, the more likely there's an underlying issue (corrupt user data, wrong URL settings, plugin bug).
Three layers: 1) consistent URL configuration (always HTTPS or always HTTP), 2) test in incognito after major changes, 3) staging environment for plugin/theme/core updates before production.
WordPress emergency? Our expert responds in minutes — any problem, same-day fix.
Response in minutes. No data loss. No diagnosis charge.
wpfix.blimx.com