Skip to content
Website Rescue Rescue

WordPress Admin Problems

Cannot Log In to WordPress Admin

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

Most WordPress admin login failures come from wrong credentials, a redirect loop (URL or HTTPS mismatch), a security plugin lockout, or a PHP error that breaks wp-login.php or the dashboard after auth. Recover by resetting the password via hosting or database tools, clearing cookies, fixing siteurl/home, and temporarily disabling security plugins via FTP—not by repeatedly guessing passwords.

Losing wp-admin access locks you out of updates, content, and commerce settings even when the front end still loads. Password resets alone will not fix redirect loops, IP lockouts, or admin-only fatals. This guide walks through safe recovery in the right order so you identify which failure mode you have before editing the database or renaming plugins.

Intermediate

What the error means

“Cannot log in” covers several distinct failures: the login form rejects the password, the page refreshes and dumps you back at wp-login.php, the browser reports too many redirects, a security plugin blocks your IP, or wp-admin white-screens after a successful authentication. Identifying which pattern you see matters more than resetting the password blindly. WordPress login depends on correct credentials, matching site URLs over HTTPS, cookies that can stick, and PHP that loads cleanly for admin bootstrap—any one of those layers can fail independently.

Common symptoms

  • “Invalid username or incorrect password” after a known-good password
  • Login page reloads with no error message (often cookies or URL mismatch)
  • ERR_TOO_MANY_REDIRECTS on /wp-login.php or /wp-admin/
  • Message about too many failed attempts, blocked IP, or country restriction
  • Login succeeds briefly then immediately logs you out
  • Front end works; only wp-admin or wp-login fails or white-screens after auth
  • Email password-reset link never arrives or loops back to the login form

Most likely causes

  1. 01 Forgotten, rotated, or mistyped password; wrong username; caps lock
  2. 02 Site URL mismatch (http vs https, www vs non-www) causing redirect loops
  3. 03 Security, firewall, or limit-login plugin lockout of your IP or user
  4. 04 Corrupted or conflicting auth cookies / object cache for login sessions
  5. 05 Plugin or theme fatal error that loads only in the admin area
  6. 06 Administrator role missing or capabilities corrupted after migration, import, or malware
  7. 07 Cloudflare or host SSL mode fighting WordPress force-HTTPS redirects on login

What changed before the problem started

  • Password reset emailed or hosting-panel WordPress password rotated
  • SSL enabled or Cloudflare Flexible/Full SSL mode changed
  • Security plugin installed, updated, or rules tightened after bot attacks
  • Site migrated, domain changed, or www vs apex switched
  • Plugin or theme update that breaks wp-admin while leaving the public site up
  • Failed login storm from bots triggering automated lockouts

Troubleshooting steps

  1. 01

    Confirm the exact failure before resetting anything

    Try an incognito window and a second browser or device. Note whether you see an invalid-password message, a silent refresh, a redirect loop, a 403, a lockout notice, or a blank page after login. That single observation decides whether this is credentials, cookies/URLs, security lockout, or a PHP crash.

  2. 02

    Reset the password through a trusted hosting path

    Use the hosting panel’s WordPress tools, WP-CLI (`wp user update`), or phpMyAdmin to set a new password for the correct admin user—not endless form guesses. Confirm you are editing the right row in `wp_users`. After reset, attempt one login from a private window only.

  3. 03

    Clear cookies and use the canonical https login URL

    Clear cookies for your domain and visit `https://yourdomain.com/wp-login.php` using the exact preferred host (www or bare) that matches the live site. Bookmarks to http leftovers or the wrong subdomain commonly look like “login does nothing.”

  4. 04

    Lift security plugin lockouts via FTP or file manager

    If you use Wordfence, Solid Security, All-In-One WP Security, or similar—or you failed login many times—your IP may be blocked. Rename that plugin’s folder under `wp-content/plugins` (for example `wordfence.off`), log in, whitelist your current IP, then re-enable with saner limits.

  5. 05

    Fix http/https and www mismatches that cause redirect loops

    In the database `wp_options`, verify `siteurl` and `home` are both https and match the live domain visitors use. If Cloudflare is on Flexible SSL while WordPress forces https (or the reverse), login often loops forever. Align SSL mode and WordPress URLs before changing more plugins.

  6. 06

    Disable all plugins via FTP if admin white-screens after login

    Rename `wp-content/plugins` to `plugins.off`. If you can reach the dashboard, rename back and reactivate in batches. A plugin that only loads in admin often breaks wp-admin while leaving the public site intact. Take a backup before renaming if you have not already.

When to stop troubleshooting

Stop if you cannot access hosting files or the database, redirect loops persist after siteurl/home and SSL alignment, login still fails after security plugins are disabled, or you suspect compromise (unknown admins, odd redirects, modified core files). Forced lockout recovery on a possibly hacked site needs a careful security pass, not more password guesses.

Information to collect before requesting help

  • 01 Exact login URL you use and the browser error or on-screen message
  • 02 Whether the front end still loads for visitors
  • 03 Hosting provider and whether you have FTP/cPanel/phpMyAdmin or WP-CLI
  • 04 Security plugins in use and any lockout or 403 notices
  • 05 Recent SSL, domain, Cloudflare, or migration changes
  • 06 Screenshots of the login failure and any redirect-loop interstitial
  • 07 Whether password reset email arrives and what happens when you use the link

How a professional repairs the problem

A pro restores admin access through hosting-level password reset or database role repair, clears redirect and SSL mismatches, lifts lockouts safely, isolates admin-only fatals, flushes bad session caches, and—when indicators of intrusion exist—rebuilds clean login paths and hardens the site before returning credentials.

Frequently asked questions

Why does login refresh with no error message? +
Often cookies cannot stick, or WordPress redirects between http/https or www/non-www. Clear cookies, use the canonical https URL, and verify siteurl and home match that host.
Can a security plugin lock out the real administrator? +
Yes. Brute-force protection and country or IP blocks regularly lock out owners after travel, VPN use, or bot attacks. Disable the plugin via FTP, log in, whitelist yourself, then re-enable with saner limits.
Is the lost-password email required to recover? +
No. Hosting tools, WP-CLI, or a careful database password update recover access when mail delivery is broken. Fix SMTP later; do not wait on email during an outage.
Front end works—does that mean the site is fine? +
Not necessarily. Admin-only plugins can crash wp-admin while the public site loads. You still need access to update, secure, and manage the site.
Should I keep trying different passwords? +
No. Repeated failures trigger lockouts and look like attacks. Use a hosting or database reset once, then diagnose redirects or security blocks.
What if I get too many redirects only on /wp-admin/? +
That pattern usually points to siteurl/home mismatch or SSL mode conflict (especially Cloudflare Flexible vs Full). Fix URLs and SSL alignment before renaming every plugin.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form.

Written by Website Rescue

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.