A WordPress login redirect loop is usually fixed by correcting the site URLs, replacing stale login cookies, and removing conflicting HTTPS or proxy rules. Start with a private-window test, then clear cookies for the affected site. If that does not work, make WordPress Address (URL) and Site Address (URL) identical, including https:// and any www prefix. Locked-out administrators can force those values in wp-config.php. Continue by checking proxy SSL handling, plugins, .htaccess, and CDN caches in that order.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the loop looks like
The symptom can take several forms:
wp-login.phpaccepts your credentials and immediately sends you back to the login form./wp-admin/redirects to the public homepage.- The browser reports
ERR_TOO_MANY_REDIRECTSor “too many redirects.” - The page keeps refreshing while the rest of the site appears normal.
These variants point to a redirect or authentication state that never becomes valid. An administrator-only loop is often caused by a cookie, URL, login-security, cache, or proxy setting; a loop affecting every page is more likely to involve HTTPS rules, a CDN, the web server, or compromised code.
As an Amazon Associate I earn from qualifying purchases.
Before changing files or database values
Back up the site
Make a full file and database backup before editing wp-config.php, .htaccess, or the wp_options table. Keep a separate copy of the original file whenever you rename or edit it. A backup gives you a way to undo a malformed PHP line or an incorrect URL.
Use a controlled test
- Open the site in a private or incognito window.
- Try a second browser or a different device.
- Test the public homepage and a known static page, then test
/wp-login.phpand/wp-admin/.
If the private window works, the server configuration is probably fine and the original browser’s site data is the first thing to remove. If every browser and device fails, continue with the server-side checks below.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Fixes in the safest order
| Observed behavior | Most useful first check | Why it matters |
|---|---|---|
| Only one browser loops | Delete cookies for this site | A stale or corrupt authentication cookie can repeatedly send an otherwise valid session back to login. |
| Login fails but public pages work | Compare home and siteurl; inspect cookie settings |
WordPress may be issuing a cookie for a different host, scheme, or path. |
| Every page redirects between HTTP and HTTPS | Inspect proxy/CDN SSL mode and duplicate HTTPS rules | WordPress and the front-end proxy may disagree about whether the request is secure. |
| Loop began after a plugin or security change | Disable all plugins as an isolation test | Caching, redirect, SEO, and security plugins can each alter login requests. |
| Loop began after permalink or server edits | Temporarily rename .htaccess |
A malformed rewrite can redirect requests before WordPress handles them. |
| Problem disappears when the CDN is bypassed | Review CDN rules and purge caches | The edge may be caching a redirect or applying a second HTTPS policy. |
1. Clear only the site’s cookies
Do not begin by deleting all browser history and saved data. Remove cookies and cached site data for the affected domain only, then close and reopen the browser.
- Open the browser’s privacy or site-settings panel.
- Search for your exact domain, including whether it uses a
wwwhost. - Delete cookies and storage for that domain.
- Reload
/wp-login.phpin a normal window and sign in again.
Use the exact host that appears in the address bar. A cookie issued for example.com is not automatically interchangeable with one issued for www.example.com. If the loop is limited to one browser, this step often resolves it without any server change.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Make WordPress Address and Site Address match
WordPress stores two URL values. siteurl is where the WordPress core files reside; home is the public address visitors use. For a conventional single-site installation they should normally be identical, character for character.
Check through the dashboard
If you can reach the dashboard, open Settings > General. Compare:
- WordPress Address (URL)
- Site Address (URL)
Correct differences in the protocol (http versus https), hostname (www versus the bare domain), spelling, and trailing path. If WordPress is installed in a subdirectory, the core-file URL may legitimately contain that directory while the public site URL does not; do not remove a real installation path merely to make the strings shorter. Save the settings and test in a private window.
Check the database when the dashboard is unavailable
In your database administration tool, open the table whose name ends in _options (the prefix is not always wp_). Find the rows whose option_name values are siteurl and home. Compare their option_value entries exactly. Take a database backup before editing either row.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Do not change unrelated options, and do not add a slash or remove a subdirectory unless that reflects the real URL. A database edit is a last resort when the dashboard cannot be used; a wrong value can make both the front end and administration area unreachable.
3. Force the URLs in wp-config.php if you are locked out
WordPress’s documented recovery method is to define the two URL constants in wp-config.php. Use the final canonical URL, not a temporary host or an alternate spelling:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );- Download or open
wp-config.phpwith your hosting file manager or FTP/SFTP client. - Insert the definitions above the line that says
/* That's all, stop editing! Happy publishing. */(or the equivalent stop-editing comment). - Save the file, clear the site’s cookies, and test
/wp-login.php.
These constants override the database values, but they do not update those rows. While the definitions remain, the URL fields cannot be edited on the General settings screen. Removing the lines causes WordPress to use the database values again, so correct the database later if you want the settings to be editable.
This method is intended for a single-site installation. In a Multisite network, use the network’s database values and domain/path configuration rather than assuming these two constants will solve the problem.
4. Check COOKIE_DOMAIN and host consistency
Search wp-config.php for a line defining COOKIE_DOMAIN. A value that does not exactly match your intended domain can prevent WordPress from accepting the login cookie. If the line was added for an old migration, staging domain, or abandoned subdomain, remove it temporarily, test, and restore it only if your architecture genuinely requires it.
Also check that you are not mixing these pairs across redirects, cookies, and links:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
http://example.comandhttps://example.comexample.comandwww.example.com- A root installation and a subdirectory installation
- A production domain and a staging or temporary domain
Choose one canonical combination and use it in WordPress, the web server, the proxy, and the CDN.
5. Resolve HTTPS and reverse-proxy conflicts
A common loop occurs when a proxy terminates HTTPS for visitors but connects to the origin over HTTP. WordPress sees an unsecured origin request and redirects to HTTPS; the proxy receives that request over HTTPS and sends another HTTP request to the origin. The cycle repeats.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsInspect the proxy or CDN SSL mode
If you use a service such as Cloudflare, review its SSL/TLS mode and the origin certificate. “Flexible” arrangements that use HTTP between the edge and origin are a frequent cause of this pattern. A full end-to-end HTTPS mode, with a valid certificate at the origin, prevents the edge and WordPress from disagreeing about the scheme. Confirm the current provider documentation and certificate requirements before changing production settings.
Pass the original protocol to WordPress
The web server or proxy must pass the original HTTPS state in its forwarded-protocol header, and the WordPress stack must trust that header. The exact configuration depends on the server and hosting platform; do not paste a PHP snippet intended for a different proxy. If WordPress never recognizes the request as secure, login cookies may be marked incorrectly and HTTPS redirects can loop.
Keep one HTTPS redirect authority
Forcing HTTPS simultaneously in a hosting control panel, the web server’s .htaccess, a redirect plugin, WordPress settings, and the CDN creates competing rules. Disable duplicate rules and retain one deliberate redirect at the edge or origin. After each change, test both the homepage and /wp-login.php from a private window.
6. Isolate plugins without guessing
Security, caching, redirect, and SEO plugins are frequent participants in login loops, but a symptom alone does not prove which plugin is responsible. Disable them all as an isolation test.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Back up the site.
- Use FTP/SFTP or the hosting file manager to rename
wp-content/pluginsto a temporary name such asplugins.disabled. - Try the login URL again.
- If the loop stops, rename the directory back to
plugins. - Reactivate plugins one at a time, testing in between, until the behavior returns.
Once the conflicting plugin is identified, update it, remove its forced-HTTPS or redirect setting, clear its cache, or replace it. If renaming the directory changes nothing, restore its original name before continuing so later troubleshooting tools can see the normal path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Test and regenerate .htaccess
On Apache-based hosting, a bad rewrite rule can redirect login requests before WordPress runs. Rename .htaccess to something such as .htaccess.backup; do not delete it. Test the site.
If the loop disappears, log in and open Settings > Permalinks. Click Save Changes without changing the permalink structure. WordPress will write a fresh default ruleset. Reapply only custom rules that you understand, and keep the backup until the site has been tested.
If the server uses Nginx or another web server without .htaccess, inspect its virtual-host configuration and redirect rules instead. A file that the server does not read cannot be the source of that server’s loop.
8. Bypass the CDN and clear every cache layer
Temporarily bypass or pause the CDN, then request the origin directly if your hosting setup provides a safe way to do so. If the redirect disappears, inspect edge rules, page-cache behavior, HTTPS settings, and any cached redirect responses.
After correcting the configuration, purge caches in this order:
- WordPress caching plugin
- Server or hosting cache
- CDN or reverse-proxy cache
- Browser cookies and cached site data
Do not assume a successful configuration change is visible while an old 301 or 302 response remains cached. Test with a private window and, where possible, a second network.
9. Database recovery when no dashboard access remains
If the constants in wp-config.php are unsuitable for your setup and the dashboard is still unreachable, edit siteurl and home directly in the correct _options table. This is the last-resort URL repair, not a general fix for plugin or proxy loops.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Confirm the database belongs to the affected installation.
- Back up the database first.
- Change only the two URL rows.
- Use the same protocol, hostname, and installation path that the site should actually use.
- Remove temporary URL constants from
wp-config.phponly after the database values are correct.
Multisite networks store additional site and network domain settings, so changing only the single-site rows may not repair a network login.
10. Avoid the dangerous RELOCATE shortcut
Some recovery instructions suggest adding define( 'RELOCATE', true ); to wp-config.php. WordPress documentation warns that leaving this constant enabled can allow the site URL to be changed by an attacker in some configurations. If you use it briefly during a controlled recovery, remove it immediately afterward and verify the final URL values.
11. When redirects continue after configuration fixes
Inspect server and application logs
Look for repeated redirects between two URLs, alternating schemes, or a redirect that occurs only after a login POST. The first and second Location headers usually reveal whether the loop is between HTTP and HTTPS, between www and the bare domain, or between the login page and homepage.
Check for injected redirects
If URL values, cookies, plugins, rewrite rules, and proxy settings are correct but unexpected destinations remain, scan the files and database for malware. Malicious code can issue redirects independently of WordPress’s normal login flow. Treat an unfamiliar redirect target or newly modified PHP file as a security incident, not as a reason to keep adding redirect rules.
Recommended Free Tools
Practical decision path
- One browser only: remove cookies for the domain and retry.
- All browsers, public site works: compare
home,siteurl, hostnames, andCOOKIE_DOMAIN. - Locked out: back up, define
WP_HOMEandWP_SITEURL, then test. - HTTP/HTTPS alternation: correct proxy SSL handling and remove duplicate HTTPS rules.
- Started after a plugin change: rename the plugins directory and reactivate one by one.
- Started after rewrite changes: rename
.htaccessand regenerate permalinks. - Only fails through the CDN: bypass it, correct edge rules, and purge caches.
- Still redirecting unexpectedly: inspect logs and perform a malware check.
What a successful repair should look like
- The canonical homepage loads without changing its scheme or hostname repeatedly.
/wp-login.phpdisplays once, accepts valid credentials, and sets a cookie for the canonical host./wp-admin/opens the dashboard rather than the public homepage.- Refreshing the dashboard does not return to login.
- HTTP and alternate-host requests perform one intentional redirect, not a chain.
- The fix survives a private-window test and a second browser.
Once those checks pass, remove temporary constants, restore normally named directories, keep the backup until you are satisfied, and document which layer owns the site’s canonical HTTPS redirect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
