Skip to content
Website Rescue Rescue

WordPress Admin Problems

WordPress Login Redirect Loop

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

A WordPress login redirect loop usually means cookies cannot stick or siteurl/home and HTTPS settings disagree — often www vs non-www mismatch, force-SSL conflicts, security plugins, or Cloudflare Flexible SSL fighting WordPress redirects. Align URLs and SSL end-to-end, clear cookies, and temporarily disable conflicting security or SSL plugins rather than resetting the password repeatedly.

Redirect loops on wp-login or wp-admin lock you out even when the password is correct. The browser shows too many redirects while WordPress keeps bouncing between HTTP/HTTPS or hostnames. This guide fixes cookie and URL mismatches in a safe order so you regain admin without stacking more redirect plugins.

Intermediate

What the error means

After credentials validate, WordPress sets authentication cookies and redirects into wp-admin. If the cookie domain or secure flag does not match the URL you land on — or if every request is redirected again by `.htaccess`, a security plugin, or Cloudflare Flexible SSL — the browser never settles and reports a redirect loop. This is distinct from a wrong-password message and from a PHP fatal after login. siteurl and home must agree with the canonical https host; stacked force-HTTPS rules plus Flexible SSL (HTTPS at the edge, HTTP to origin) are a classic loop factory.

Common symptoms

  • Browser error ERR_TOO_MANY_REDIRECTS on /wp-login.php or /wp-admin/
  • Login form accepts credentials then returns to the login screen
  • Loop only on admin; front end may still load (or also loops on HTTPS)
  • Incognito fails the same way; clearing cookies helps briefly or not at all
  • Problem started after enabling SSL, Cloudflare, or a security plugin
  • www and non-www behave differently — one works, the other loops
  • DevTools Network shows a long chain of 301/302 between http/https or hosts

Most likely causes

  1. 01 siteurl and home mismatch (http vs https, www vs apex, wrong domain)
  2. 02 Cloudflare Flexible SSL while WordPress or plugins force HTTPS to origin
  3. 03 Multiple force-SSL or redirect plugins stacking rules
  4. 04 Security plugin cookie, session, or force-SSL features conflicting
  5. 05 Cookie domain / path issues after domain change or subdirectory install
  6. 06 Bad or duplicate redirect rules in `.htaccess` or nginx config
  7. 07 Object cache holding stale URL or session data after a URL change

What changed before the problem started

  • SSL enabled or certificate renewed; HTTP→HTTPS forced
  • Cloudflare proxy enabled or SSL mode set to Flexible / Full / Strict
  • Domain, www, or staging URL changed; migration completed
  • Security or SSL plugin installed or updated
  • `.htaccess` hardening or redirect snippets added
  • CDN or host “force HTTPS” toggled in addition to WordPress rules

Troubleshooting steps

  1. 01

    Confirm it is a redirect loop, not a lockout or fatal

    Note the exact browser message. Too many redirects is a loop. A lockout notice or 403 is security blocking. A white screen after login is often a PHP fatal. Check DevTools → Network for the bounce chain between URLs — that list is your diagnosis map.

  2. 02

    Clear cookies and use one canonical https login URL

    Clear cookies for the domain and visit only `https://your-preferred-host/wp-login.php` (pick www or apex — the one DNS and the certificate use). Bookmarks to http:// or the other hostname commonly sustain loops.

  3. 03

    Fix siteurl and home in the database

    In `wp_options`, set both `siteurl` and `home` to the same https:// canonical URL. If you cannot reach admin, use phpMyAdmin, WP-CLI, or host WordPress tools. Mismatched values are the most common WordPress-side loop cause.

  4. 04

    Align Cloudflare SSL mode with a real origin certificate

    If Cloudflare is orange-cloud proxied, Flexible SSL often loops when WordPress redirects all traffic to HTTPS. Switch to Full or Full (Strict) once the origin has a valid certificate, purge cache, and retry login from a private window.

  5. 05

    Temporarily disable SSL and security plugins via FTP

    Rename force-SSL and security plugin folders under `wp-content/plugins`. Retry wp-login. If the loop stops, re-enable one at a time and configure a single HTTPS strategy. Leave only one force-HTTPS mechanism active long term.

  6. 06

    Rename `.htaccess` to rule out redirect stacks

    On Apache hosts, back up then rename root `.htaccess` to `.htaccess.bak` and retry. If login works, restore default WordPress rewrite rules via Settings → Permalinks → Save once inside admin, then re-add custom redirects carefully.

When to stop troubleshooting

Stop if loops persist after siteurl/home and Cloudflare SSL alignment, you cannot access the database or files, security plugins reintroduce the loop immediately, or you suspect malware rewriting redirects. Forced recovery on a possibly compromised site needs a careful security pass, not more redirect plugins.

Information to collect before requesting help

  • 01 Exact login URL and browser redirect-loop screenshot
  • 02 DevTools redirect chain (http/https and www/apex hops)
  • 03 siteurl and home values from the database
  • 04 Whether Cloudflare (or another CDN) is proxied and which SSL mode
  • 05 Security and SSL plugins installed
  • 06 Recent SSL, domain, or migration changes
  • 07 Whether the front end also loops or only wp-admin

How a professional repairs the problem

A pro maps the redirect chain, sets matching https siteurl/home, aligns CDN SSL mode with a valid origin certificate, removes stacked force-SSL rules, clears cookie and object-cache leftovers, restores clean rewrite rules, and verifies private-window login to wp-admin before re-enabling a single hardening path.

Frequently asked questions

Will resetting my password fix a redirect loop? +
Usually no. Loops happen after auth when cookies or redirects fail. Resetting the password without fixing URLs and SSL alignment leaves you stuck.
Why does Flexible SSL cause login loops? +
Visitors reach Cloudflare over HTTPS while the origin may still see HTTP. WordPress then redirects to HTTPS again and again. Full or Full (Strict) with a real origin certificate stops that fight.
Front end works — can admin still loop? +
Yes. Admin and login often enforce HTTPS or cookie rules more strictly. Fix siteurl/home and SSL for the admin host even if the marketing site loads.
Is this the same as “login refreshes with no error”? +
Related. Silent refresh is often cookies or URL mismatch without hitting the browser’s redirect limit. A full ERR_TOO_MANY_REDIRECTS is the same family of problems taken further.
Should I add another redirect plugin to force HTTPS? +
No. Extra redirectors usually worsen loops. Fix siteurl/home and use one server or CDN redirect only.
Can a security plugin alone cause the loop? +
Yes. Force-SSL, session, and cookie features conflict with CDN modes and host redirects. Disable via FTP, log in, then reconfigure with saner settings.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form.

Written by Website Rescue

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.