Recommended Free Tools
If WordPress keeps sending you back to the login page, start by opening https://your-domain.example/wp-login.php on the site’s intended hostname. Clear cookies for that site, then compare the public URL with the WordPress URL settings. If they match, temporarily test for a plugin conflict. Loops that persist after those checks—especially after an SSL, hosting, or CDN change—may need the host to inspect HTTPS and proxy settings.
First, confirm what the redirect is doing
Use the site’s canonical hostname and expected scheme to open its root wp-login.php page. Replace the example hostname with your own. When you visit /wp-admin/ while logged out, WordPress normally sends you to the login screen; that first redirect is expected. The problem is when submitting credentials repeatedly returns you to login or produces a “too many redirects” error.
As an Amazon Associate I earn from qualifying purchases.
If the address includes a redirect_to= parameter, note its destination. WordPress can use that parameter to send you to a requested page after login, and its login URL function can also add reauth=1. The parameter alone does not show that it is causing the loop. If it points to an old hostname, the wrong scheme, or an unavailable admin path, record that detail for the site administrator. WordPress documents these login URL parameters.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Clear the site’s cookies and test a clean session
- Clear cookies and cached data for the affected hostname, then reload the login page.
- Try a private or incognito window, or a second browser, to see whether the behavior changes.
- Submit credentials once and note whether the page reloads, the address changes, or an error appears.
WordPress uses authentication cookies, including wordpress_[hash], wordpress_logged_in_[hash], and, for HTTPS logins, wordpress_sec_[hash]. If the browser does not retain or send the expected cookie, WordPress may not accept the session. WordPress recommends clearing cookies and cache, and its developer guide also calls out cookie settings, plugin conflicts, and caching of wp-login.php as possible troubleshooting areas. See WordPress’s login troubleshooting guidance and WordPress.org’s login troubleshooting page.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not disable HTTPS or add a COOKIE_DOMAIN definition as a guess. Cookie settings can depend on the site’s domain and whether it uses multisite.
Compare the public address with WordPress’s saved URLs
Check the exact canonical URL, including http versus https, the hostname, and whether it uses www. Compare it with the WordPress URL values in both configuration and the database:
WP_HOMEandWP_SITEURLdefinitions inwp-config.php, if present.- The
homeandsiteurlentries in the database options table.
These values should agree with the intended address. WordPress identifies conflicting URL values and mixed HTTP/HTTPS settings—sometimes left after an SSL change—as possible causes of login trouble. The official login guide describes the URL checks.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Changing these values can affect the whole site. Back up the database and configuration first, confirm the intended canonical address, and make a targeted correction. Avoid broad search-and-replace edits without a migration plan. For a domain or protocol move, WordPress documents using WP-CLI’s search-replace command; the --dry-run option previews proposed changes before they are applied. Consult the WordPress guide before updating stored URLs.
Test whether a plugin is interfering
If the URLs are correct and the loop persists, temporarily disable plugins as a diagnostic test. You will need hosting file-manager or SFTP access if the dashboard is unavailable.
- In the site files, locate
wp-content/plugins. - Temporarily rename the
pluginsfolder, for example toplugins-test. - Try logging in again at the canonical
wp-login.phpaddress. - Restore the folder’s original name after the test.
WordPress recommends temporarily renaming the plugins folder to rule out a conflict. If login works while the folder is renamed, that points toward plugin interference; it does not identify which plugin is responsible. Work with the site administrator to isolate the cause, and do not leave the site in an altered state without understanding the effects. WordPress’s login guide covers this test.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When the issue points to HTTPS, a CDN, or a proxy
Give this branch priority if the loop began after enabling SSL, migrating hosts, changing domains, adding a CDN, or changing proxy settings. A redirect can be introduced at WordPress, the CDN, the hosting proxy, or the web server, and conflicting rules or mixed schemes can make the browser bounce between addresses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWordPress warns that forcing HTTPS for admin access can create an infinite loop when a reverse proxy terminates SSL but the WordPress origin itself uses HTTP, unless WordPress recognizes the correctly configured HTTP_X_FORWARDED_PROTO header. Whether that header is present and trustworthy depends on the host’s actual proxy setup. Do not add proxy code or change redirect rules blindly; ask the host to verify where HTTPS is terminated and what scheme WordPress receives. Read WordPress’s HTTPS guidance for reverse-proxy setups.
Ask the host to check for conflicting HTTPS or redirect rules in the CDN, hosting proxy, Nginx, or Apache, and whether login pages or authenticated sessions are being cached. WordPress says FORCE_SSL_ADMIN should only be enabled when SSL is configured on the server. The login guide lists server and redirect configuration among the possible causes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Escalate with details that help isolate the cause
If the browser, URL, and plugin checks do not resolve the loop, send the host or administrator a concise record of the failure:
- The exact login URL and the redirect sequence, if you can capture it.
- When the problem began and any recent SSL, domain, hosting, CDN, or plugin changes.
- The server setup and, if available, database and PHP versions, operating system, browser, and WordPress version.
- Whether the site uses multisite, custom cookie constants, a CDN, or a reverse proxy.
Ask specifically whether the server or proxy is forwarding the expected HTTPS information to WordPress and whether redirects or caching affect login requests. WordPress recommends providing environment and version details when requesting support. See the HTTPS support guidance and the WordPress.org login troubleshooting page.
Use the test results to choose the next step
| What you observe | Most useful next check |
|---|---|
| The loop changes or disappears in a clean browser session | Investigate site cookies, browser cache, or session handling. |
| The public address differs from WordPress’s URL settings | Confirm the canonical scheme and hostname, then correct the relevant configuration or database value carefully. |
| Login works while the plugins folder is temporarily renamed | Restore the folder name and isolate the plugin conflict with the administrator. |
| The loop began after SSL, CDN, hosting, or proxy changes | Have the host inspect redirect rules, HTTPS termination, forwarded scheme information, and login caching. |
Change one variable at a time and retry login after each test. That makes it easier to tell which change affected the result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
