How to fix the WordPress login redirect loop

How to fix the WordPress login redirect loop (step by step)

Work through these fixes in order. The earlier steps are the easiest and most likely to solve the problem, so don’t skip ahead to wp-config.php edits unless you’ve already tried the basics.

Step 1: Clear browser cookies and cache for your site

Start here. About a third of login redirect loops are fixed by this step.

1. Open your browser’s settings.
2. Find the option to clear cookies and cached data.
3. Filter to only your site’s domain (otherwise you’ll log out of everything else).
4. Clear the cookies and cached files.
5. Restart your browser and try logging in again.

If that doesn’t work, try logging in from a different browser (Chrome if you usually use Firefox, or vice versa) or from an incognito window. If the login works elsewhere, the issue is browser-specific, and a full cache clear will fix it.

Step 2: Disable browser extensions

Some browser extensions, especially privacy-focused ones, block cookies in ways that break the WordPress login flow. Disable extensions one by one (or just use an incognito window with no extensions) to test.

Step 3: Check your WordPress URL settings

If you have access to your dashboard (sometimes the login loop only affects certain users or paths), check Settings > General and make sure the WordPress Address (URL) and Site Address (URL) both:

• Use the same protocol consistently (both HTTPS, ideally).
• Use the same www or non-www format.
• Match the URL you’re actually visiting in your browser.

If you can’t access your dashboard, jump to Step 7 to fix these values via wp-config.php instead.

Step 4: Disable plugins via FTP

If you can’t log in to disable plugins through the WordPress admin dashboard, you can disable all plugins at once via FTP or your hosting control panel’s file manager:

1. Connect to your site via FTP, SFTP, or your hosting provider’s file manager.
2. Navigate to /wp-content/.
3. Rename the plugins folder to something like plugins-disabled.
4. Try logging in again.

If the login works, one of your plugins was the cause. Rename the folder back to plugins. WordPress will recognize that all the plugins are now deactivated. Log in to your dashboard and reactivate plugins one at a time, testing the login between each one, until you find the plugin causing the issue.

The most common culprits in our experience are security plugins, caching plugins, and any plugin that modifies the login URL or adds two-factor authentication.

Step 5: Switch to a default WordPress theme

If disabling plugins didn’t fix it, the issue might be your theme.

1. Connect to your site via FTP or file manager.
2. Navigate to /wp-content/themes/.
3. Rename your active theme’s folder to something like your-theme-disabled.
4. WordPress will automatically fall back to the latest default theme (Twenty Twenty-Five at the time of writing).
5. Try logging in again.

If the login works with the default theme, your custom theme is the cause and needs troubleshooting. You can usually rename the folder back, and the theme will reactivate, but check it for recent changes (especially to functions.php) before doing anything else.

Step 6: Reset the .htaccess file

A corrupted .htaccess file can cause redirect loops at the server level. The fix is to let WordPress regenerate a clean one:

1. Connect to your site via FTP or file manager.
2. Navigate to the WordPress root directory (the folder containing wp-config.php).
3. Rename .htaccess to .htaccess.old.
4. Log in to your WordPress dashboard.
5. Go to Settings > Permalinks.
6. Click Save Changes without changing anything. This regenerates a fresh .htaccess file with the default WordPress rules.

If you can’t log in to do step 4-6, you can create a clean .htaccess manually. Create a file called .htaccess in your WordPress root with this content:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

This is the standard WordPress .htaccess content and will work for most sites using pretty permalinks.

Step 7: Update WordPress URL settings via wp-config.php

If you can’t access your dashboard and Steps 1-6 haven’t worked, you can force the WordPress URL settings through wp-config.php. This overrides whatever is in the database.

1. Connect to your site via FTP or file manager.
2. Open wp-config.php in the WordPress root directory.
3. Find the line that says /* That’s all, stop editing! Happy publishing. */ (or similar).
4. Just above that line, add these two lines, replacing the domain with your actual site URL:

define( 'WP_HOME', 'https://yourdomain.com' );
define( 'WP_SITEURL', 'https://yourdomain.com' );

5. Save the file and try logging in.

If this fixes the issue, once you can access your dashboard, go to Settings > General and update the URLs there to match. You can then remove the lines from wp-config.php so the database values are used again.

Step 8: Force cookie domain consistency

If you’ve tried everything above and the loop persists, add one more line to wp-config.php that forces WordPress to use a specific cookie domain:

define( 'COOKIE_DOMAIN', 'yourdomain.com' );

Place this above the same /* That's all, stop editing! */ line. This is particularly useful when the loop is caused by a www/non-www mismatch that other fixes haven’t resolved.

Step 9: Check file permissions

Permissions that are too restrictive can prevent WordPress from reading the files it needs to authenticate properly. The standard:

• Directories: 755
• Files: 644
• wp-config.php: 440 or 600 (for tighter security)

If you’re not sure what your current permissions are, your FTP client or file manager will show them. Most hosting control panels include a file permissions tool. Check the WordPress root directory and wp-content folder permissions in particular.

Step 10: Disable caching and CDN

If you use a caching plugin or a CDN like Cloudflare, temporarily disable them to test:

1. Caching plugins: Disable the plugin via FTP using the rename method from Step 4.
2. Cloudflare: Set it to development mode (under your domain’s settings > Caching > Configuration). This bypasses caching for three hours, long enough to test the login.
3. Server-side caching: Contact your hosting provider’s support team to disable any server-level caching temporarily.

Try logging in. If the login works without caching, the cache is what was causing the loop. You’ll need to clear the cache and adjust the cache rules so login pages aren’t cached.

Step 11: Contact your hosting support

If you’ve worked through all the steps above and you still can’t log in, contact your hosting provider’s support team. Server-level issues (mod_security rules, firewall configurations, DNS routing) can cause login loops that aren’t fixable from the WordPress side. Liquid Web’s managed WordPress hosting includes 24/7 support that can diagnose these issues directly on the server.