What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If your browser downloads wp-login.php instead of displaying the WordPress login form, PHP is not being executed for that site. The file is being sent as source code, which makes this a web-server or hosting configuration failure—not a bad WordPress password. Restore PHP execution first; only then investigate cookies, caching, firewalls, or login credentials.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the download means
wp-login.php is the WordPress login script in the site root. A working PHP stack passes that script to a PHP interpreter, which generates an HTML login page. A download means the server returned the file itself instead of handing it to PHP. The browser then treats the response as a file rather than rendering a form.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A WordPress.org support moderator describes the condition plainly: the site is “not configured to interpret PHP files” and is transmitting them instead. The recommended remedy is to have the hosting provider correct the configuration and install or enable PHP. Another WordPress support response notes that the same symptom with index.php or other PHP files occurs when the web server stops executing PHP.
This distinction determines what to do next. Changing a WordPress password, replacing the login URL, or reinstalling a plugin cannot make a server execute PHP. Server-side PHP support and its handler must be repaired first.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Check whether the failure affects one file or the whole site
Use a private browsing window if you normally have an administrator session, then perform these checks without uploading diagnostic files.
- Open the site’s public home page.
- Open another ordinary PHP URL, such as
https://example.com/index.php, if your site uses that standard front controller. - Try
https://example.com/wp-login.phpagain and note whether a download starts, an error appears, or an HTML page renders.
| What you observe | Most likely scope | First action |
|---|---|---|
| The home page and several PHP URLs download source | Domain-wide PHP execution or handler outage | Contact the host or server administrator immediately; ask for PHP-handler and error-log checks. |
Only wp-login.php downloads while other PHP pages execute |
A file-specific rule, security product, rewrite, or damaged WordPress file | Check web-server rules and security logs, then verify the core file from a clean WordPress package. |
| The home page is a normal HTML/PHP page, but login redirects or loops | Usually cookies, cache, URL, proxy, or firewall behavior | Skip server reconfiguration and follow the login-specific checks below. |
| The browser downloads a file after a recent migration, PHP upgrade, or panel change | Handler mapping or disabled PHP support introduced during the change | Review the changed domain and PHP settings and the deployment’s server logs. |
If even one unrelated PHP endpoint downloads, stop treating this as a WordPress authentication problem. Leaving source responses publicly available can expose application details and, if configuration files are ever served, credentials. Restrict public access while the host repairs execution, and rotate database or API credentials after any evidence that sensitive source was exposed.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFix the domain’s PHP setting in a hosting panel
Plesk: enable PHP Support
Plesk documents this exact symptom as disabled PHP support for the domain. In the Plesk interface:
- Sign in to Plesk with permission to manage the affected subscription.
- Open Domains and select the affected domain, such as
example.com. - Choose PHP Settings.
- Enable or select PHP Support. If a PHP version selector is shown, choose a version supported by your WordPress release and site code.
- Save or apply the change.
- Retest the home page,
index.php, andwp-login.phpin a private window.
The Plesk procedure was documented in an article updated January 13, 2026. If you administer Plesk from the command line, the documented subscription command is:
plesk bin subscription -u example.com -php true
Replace example.com with the subscription’s actual domain, run the command with the privileges required by your Plesk installation, and then test a PHP endpoint. A panel may show PHP as enabled while the underlying handler is still unhealthy; a successful setting change does not replace log inspection when downloads continue.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Other hosting control panels
Panels use different labels, but look for the domain-level controls named PHP version, PHP support, PHP handler, FPM, or scripting. Confirm that PHP is enabled for the affected domain rather than merely installed on the account. Save the setting, allow the panel to reload the web service, and test a normal PHP page.
Recommended Free Tools
Do not change unrelated WordPress settings while making this repair. Switching themes, disabling plugins, or editing login URLs can obscure the server symptom and will not enable a missing interpreter.
What the host or server administrator must inspect
When multiple PHP files download, the correct escalation targets are the PHP handler configuration and the web-server error log. Send support the exact domain, the time and timezone of a test request, the downloaded URL, and whether index.php also downloads. Ask them to verify each layer below.
PHP is installed and available
The server needs a supported PHP runtime, not just static-file hosting. The administrator should confirm that the selected PHP version starts successfully and that its service is running.
The web server maps PHP requests to the handler
On Apache, this may be a module or proxy/FastCGI configuration. On Nginx, requests are commonly passed to PHP-FPM through a configured socket or port. On IIS, a FastCGI application mapping performs the equivalent role. A broken socket, stale pool, wrong user, or removed mapping can make PHP requests fail even when PHP is installed.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The domain is using the intended virtual host
After DNS, migration, or certificate changes, a request can land on a different virtual host whose PHP support is disabled. The administrator should check the domain’s active server block or site binding, document root, and any account-wide PHP policy.
Logs identify the failing layer
The web-server error log and PHP-FPM or equivalent runtime log can reveal a missing handler, permission problem, unavailable socket, syntax error in configuration, or service crash. A support team should inspect those logs around the timestamp of your test rather than guessing from the browser’s download dialog.
Do not leave a public phpinfo() page online as a diagnostic shortcut. It exposes server paths, modules, versions, and environment values. If an administrator creates one in a protected location for testing, it should be removed immediately after verification.
Apache, Nginx/PHP-FPM, and IIS: why the remedy differs
| Stack | Typical execution path | Failure to check | Who should change it |
|---|---|---|---|
| Apache with a PHP module or proxy | Apache recognizes a PHP extension and invokes the configured PHP runtime. | Module or proxy disabled, handler directive removed, or a virtual-host override serving PHP as a static file. | Server administrator or hosting support. |
| Nginx with PHP-FPM | Nginx forwards PHP requests to a PHP-FPM socket or TCP listener. | Wrong socket path, stopped FPM pool, mismatched PHP version, or a location block that omits the FastCGI pass. | Server administrator or managed host. |
| IIS with FastCGI | IIS maps .php requests to a PHP FastCGI application. |
Missing handler mapping, stopped FastCGI process, or an incorrect site binding. | Windows/IIS administrator or host. |
These are implementation differences, not alternative WordPress fixes. A site owner on shared hosting generally cannot and should not edit them directly; request that the provider repair the domain’s mapping.
After PHP renders normally: troubleshoot login-only failures
Once the front page and another PHP endpoint produce HTML instead of downloads, test login again. If the form now opens but login fails, work through these checks in order.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Clear cookies and cached responses
- Sign out of any open WordPress tabs.
- Clear cookies for the site or open a private window.
- Clear the browser cache for the affected domain.
- Open
/wp-login.phpand submit credentials once.
WordPress login relies on cookies. A stale domain, path, secure flag, or cached redirect can create loops that look like a failed login even though PHP is functioning.
Exclude login and session URLs from page caching
Full-page caches and reverse proxies must not serve a cached login form or cache a response that depends on authentication cookies. Exclude wp-login.php, the administrator area, and requests carrying WordPress authentication cookies from page caching. Purge existing cache entries after changing the rule. Keep browser, plugin, host, and proxy caches in scope; fixing only one layer may leave an old response in another.
Check firewall and security controls
A web-application firewall, intrusion-prevention rule, or hosting security product can block or redirect login requests. Review its event log for the timestamp of a failed attempt. Temporarily allow the request or disable only the specific rule under controlled conditions, then restore protection after confirming the cause. Do not broadly remove security controls on a production site.
Verify the WordPress URL and proxy scheme
Ensure the WordPress Address and Site Address use the intended hostname and HTTP/HTTPS scheme. If TLS terminates at a proxy, the origin must receive the correct forwarded-protocol information; otherwise WordPress can repeatedly redirect between HTTP and HTTPS. Make one URL change at a time and test in a private window.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If warnings mention headers or wp-config.php
Sometimes the login file is named in a warning even though it is not the source of the fault. WordPress documentation explains that “headers already sent” messages commonly point to an earlier file, often wp-config.php. Read the warning from the beginning and inspect the first file and line it identifies.
- Remove whitespace or blank lines before the opening
<?phptag or after a closing tag. - Remove a UTF-8 byte-order mark (BOM) from the file.
- Check recently edited configuration or included files for accidental output, debugging text, or a closing PHP tag followed by spaces.
- Use a code editor that displays encoding and invisible characters.
Make a backup before editing configuration. If you are unsure which bytes are being emitted, have the host or a WordPress professional inspect the file rather than repeatedly changing login code.
When only wp-login.php downloads
A single-file failure is less consistent with a domain-wide PHP outage. First confirm that index.php and a harmless, existing plugin or theme PHP request execute normally. Then investigate:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Web-server location or rewrite rules targeting
wp-login.php. - Security or malware-scanning rules that alter the response headers for the login path.
- Permissions or ownership that differ from the other WordPress core files.
- A damaged or modified
wp-login.php.
Compare the file with the same WordPress version’s clean package and replace it only after preserving a backup and confirming the version. Do not download a replacement from an unknown website. If the file contains unexpected code, treat the event as a possible compromise: preserve logs, scan the installation, change administrative credentials, and ask the host for assistance.
Account-wide versus one-domain failures
Shared accounts can host several domains under different PHP settings. Test another domain only if you own it and can do so without exposing private content.
| Pattern | Interpretation | Escalation |
|---|---|---|
| Every domain on the account downloads PHP | Account-wide handler, runtime, or server outage. | Open an urgent hosting ticket and include tests from more than one domain. |
| Only one domain downloads PHP | Domain-level PHP support, virtual-host, subscription, or document-root setting. | Ask support to compare that domain’s handler with a working domain. |
| Only one URL on one domain downloads | Path-specific rule, file integrity, or security product issue. | Inspect that path’s rules and logs after confirming other PHP requests work. |
What to include in a hosting support request
A precise ticket shortens the time to the right team. Include:
- The full URL that downloads, including whether it is HTTP or HTTPS.
- The first time you noticed the problem and your timezone.
- Whether the home page,
index.php, and another PHP endpoint also download. - Your hosting panel’s domain, PHP version, and PHP-support status as displayed.
- The browser and network used for testing, if behavior differs between them.
- A screenshot or exact filename of the downloaded response, without uploading credentials or private source code.
Ask specifically: “Is PHP support enabled for this domain, and is the PHP handler/FPM or FastCGI mapping working? Please check the web-server and PHP runtime error logs for this request.” That wording directs the ticket toward the documented cause instead of password resets.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Recovery checklist
- Stop repeated login attempts while PHP source is being served.
- Confirm whether more than
wp-login.phpdownloads. - Enable the domain’s PHP support in the hosting panel, or use the documented Plesk command if you administer that server.
- Have the host verify the runtime, handler mapping, virtual host, and logs.
- Retest the home page and at least one additional PHP endpoint.
- Remove any temporary diagnostic page such as
phpinfo(). - Only after PHP works, clear cookies, purge login-related caches, and inspect firewall and URL/proxy behavior.
- If sensitive source may have been exposed, rotate credentials and review access logs.
Why common quick fixes do not work
- Resetting the WordPress password: authentication cannot occur until PHP executes the login script.
- Disabling plugins: this may help a login redirect or firewall conflict, but it cannot repair a missing server handler.
- Editing
.htaccessblindly: an incorrect rule can create new outages and does not fix Nginx or IIS mappings. - Installing a browser extension or downloading the file manually: this only saves the source; it does not render or secure the application.
- Publishing
phpinfo(): it may confirm the runtime but exposes information and should never remain public.
The decisive test is simple: when PHP is correctly configured, requesting wp-login.php returns a rendered login page, not the script as a download. If that does not happen after enabling support, the host must continue at the handler and log level.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
