How to fix a WordPress login redirect loop (login page keeps refreshing)

Short answer

If your WordPress login page keeps refreshing and sends you straight back to the same login screen even though your username and password are correct, the cause isn’t a site-wide error. It’s a session cookie that never gets accepted, or a site-address setting that doesn’t match your real domain.

The three most common causes are a stale cookie stored in the browser, a mismatch between the WordPress Address (URL) and Site Address (URL) settings, and a plugin or theme conflict. Worked through in order, a WordPress login redirect loop is usually fixed within 10 to 15 minutes.

Why does a WordPress login redirect loop happen?

There’s no single error message attached to this behavior. You fill in the form, click “Log In,” the page loads for a moment, and you land back on the exact same login screen. It looks like nothing happened, but behind the scenes WordPress actually validated your credentials. The real problem is what happens right after: the session cookie sent to your browser either gets rejected or points to the wrong address. In practice, the list of causes is short:

• An old, corrupted, or expired login cookie still stored in the browser
• The WordPress Address (URL) and Site Address (URL) settings not matching your domain’s exact spelling, protocol, or www version
• A recently updated security, caching, or membership plugin changing the cookie path
• A theme or plugin interfering with session handling inside functions.php
• A corrupted .htaccess file with conflicting rules
• A hosting-level or firewall rule quietly blocking requests to /wp-login.php

What these causes have in common is timing: the loop almost always starts right after an update, a migration, or a new plugin install. If a site worked fine for months and suddenly breaks, the first question should always be “what changed most recently,” since that gets you to the fix far faster than changing settings at random.

How is this different from the too many redirects error?

These two problems get mixed up constantly, but they live at different layers. The WordPress too many redirects error shows up in the browser as ERR_TOO_MANY_REDIRECTS, and it usually breaks every single page on the site, not just login. A login redirect loop is narrower: the site itself loads fine, visitors see every page normally, and the only symptom is that entering correct credentials sends you back to the login form instead of the dashboard. Knowing which one you’re dealing with saves time, because one points you toward SSL and domain settings, and the other points you toward cookies and session handling.

1. Clear your browser cookies and cache

Always start here. WordPress confirms that you’re logged in by writing a cookie to your browser, and if that cookie is stale or corrupted, the login simply never “sticks.” Clear the last hour of browsing data from your browser, then try logging in from an incognito window or a completely different browser. If the incognito window logs in successfully, the cause is confirmed to be an old cookie on your regular browser, and clearing cookies there resolves it for good.

2. Check your WordPress Address and Site Address settings

This is the single most common cause of a WordPress login redirect loop. If you can reach the dashboard in an incognito window, open Settings → General and confirm that both “WordPress Address (URL)” and “Site Address (URL)” exactly match your real domain, with the same protocol (https://) and no trailing slash. If you can’t reach the dashboard at all, you can pin the same values directly in wp-config.php:

define( 'WP_HOME', 'https://yoursite.com' );
define( 'WP_SITEURL', 'https://yoursite.com' );

When these two values don’t match your real address, WordPress writes the session cookie to the wrong path or domain. Your browser never sends that cookie back on the next request, so WordPress treats you as logged out and bounces you to the login screen again. If you want to see exactly how WordPress handles this internally, its official wp_cookie_constants() function reference documents how COOKIE_DOMAIN and COOKIEPATH get derived from your Site Address setting.

3. Rule out a plugin or theme conflict

If your address settings check out, move on to plugins and themes. Use FTP or your hosting file manager to temporarily rename the wp-content/plugins folder, for example to plugins-old; WordPress then treats every plugin as deactivated and falls back to a default theme. If login works normally at that point, rename the folder back and reactivate plugins one at a time, testing login after each one. Whichever plugin brings the loop back is the culprit, and security, caching, membership, or “single session” plugins are the usual suspects because they tend to rewrite the cookie path.

4. Regenerate your .htaccess file

If the two steps above didn’t resolve it, drop down to the file level. Back up .htaccess through FTP, delete it from the root directory, then open Settings → Permalinks and save without changing anything; WordPress regenerates a standard file for you. This follows the same logic covered in our white screen of death guide: a corrupted rule doesn’t always block the whole page, but it can quietly rewrite the /wp-login.php request and trigger exactly this loop.

5. Could a security plugin or server firewall be blocking login?

Once failed login attempts cross a certain threshold, some security plugins and server-level firewalls quietly throttle requests to /wp-login.php. The form doesn’t throw an error; it just “refreshes” and drops you back on the same screen. Check your security plugin’s login lockout settings and deactivate it temporarily to test. If you’re on shared hosting, ask your provider whether an IP block or ModSecurity rule is active, since that layer usually runs independently of anything configured inside WordPress itself.

What’s different on a subdomain or multisite setup?

If your site is a WordPress multisite network, or it runs across subdomains such as shop.yoursite.com, a login loop is often caused by an incorrectly defined COOKIE_DOMAIN constant. If logging in on one subdomain works but switching to another subdomain asks you to log in again, the cookie is tied to a single subdomain instead of the root domain, such as .yoursite.com. Adding a COOKIE_DOMAIN definition that points to the root domain in wp-config.php lets every subdomain share the same session. Back up the site first, and test this change in a staging environment if one is available.

What if none of this fixes it?

If you’ve worked through every step above in order and the WordPress login redirect loop is still happening, the root cause is most likely server-side: the PHP session directory may lack write permissions, the server clock could be misconfigured, or a CDN may be caching an old version of the login page. Write down exactly what you’ve tried and what your browser console shows, then share it with your hosting provider’s support team; they can usually resolve it faster once they have that detail, since they can see the server logs you can’t.

Avoiding it next time

This problem is largely preventable. Check the WordPress Address and Site Address settings right after any domain or hosting change, install security and caching plugins one at a time rather than all at once, and test plugin updates in a staging environment before an important login session depends on them. Using a strong, unique password for your admin account also keeps security plugins from applying overly aggressive lockout rules in the first place.

Next step

A WordPress login redirect loop is something you can usually fix yourself once you work through the causes in order. But if the problem keeps coming back on a multisite network, behind a CDN, or at the server firewall level, bringing in professional help saves time and reduces risk. If you’re weighing ongoing technical maintenance, security configuration, or access issues for a WordPress site, our group company Web Tasarım Ofisi supports exactly this kind of work.

To talk through your site’s technical setup or a custom software need, take a look at our custom software service or get in touch with Argo Ajans.