The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If WordPress keeps sending you back to the login page, start by opening wp-login.php on the site’s intended HTTPS hostname, then clear that hostname’s cookies and cache. Next compare the site’s canonical URL with WP_HOME, WP_SITEURL, and the database’s home and siteurl values. If those match, temporarily isolate plugins. A loop that persists—especially after an SSL, CDN, proxy, or host change—may need attention to server-side HTTPS and redirect settings.
Confirm what is looping
WordPress serves the login screen from wp-login.php in the site root. When you visit /wp-admin/ while logged out, WordPress normally redirects you to the login screen. That first redirect is expected; the problem is being returned to login after submitting credentials or encountering a “too many redirects” error.
Try the login page directly using the hostname and scheme the site is meant to use, for example https://your-domain.example/wp-login.php. If the address includes redirect_to=, note its destination. It may simply be the intended page to open after login; the wp_login_url() function can also add reauth=1. If the destination uses an old hostname, the wrong scheme, or an inaccessible admin path, record that for the site administrator rather than assuming the parameter itself caused the loop. WordPress Developer Resources’ login guide and the wp_login_url() reference describe these behaviors.
Clear cookies and test a clean browser session
- Clear cookies and cached data for the affected hostname, then reload the direct
wp-login.phpaddress. - Try a private or incognito window, or another browser, if available. If login works there, the issue may be specific to the original browser’s stored data or session.
- If the problem continues, keep that result in mind as you check site settings and plugins; a clean session does not rule out a server-side cause.
WordPress login relies on authentication cookies, including wordpress_[hash], wordpress_logged_in_[hash], and, for HTTPS logins, wordpress_sec_[hash]. Cookie settings, plugin conflicts, or caching of wp-login.php and cookie-based sessions can interfere with authentication. WordPress recommends clearing cookies and cache and identifies these configuration areas in its login troubleshooting guide and login-issues documentation.
#1 Best Overall
Compare the canonical URL with WordPress settings
Check that the intended scheme (https or http), hostname, and www choice agree throughout the site configuration. WordPress specifically identifies mixed HTTP/HTTPS values after an SSL move and mismatched URLs as possible causes of login trouble.
- In
wp-config.php, look forWP_HOMEandWP_SITEURLdefinitions, if present. - In the database options table, check the
homeandsiteurlvalues. - Compare those settings with the exact public URL you used to reach the login page.
Changing these values can affect the whole site. Back up the database and configuration first, establish which URL is authoritative, and make a targeted correction. Avoid broad search-and-replace changes unless you understand their effects. For a domain or protocol move, WordPress documents using WP-CLI search-replace to update stored URLs and the --dry-run option to preview changes before applying them. See the login guide for URL checks and the WordPress login-issues documentation for troubleshooting context.
Temporarily rule out plugin conflicts
If the URLs are correct and the browser test did not resolve the issue, test whether a plugin is involved. You need access to the site’s files through a hosting file manager or SFTP.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Locate
wp-content/plugins. - Temporarily rename the
pluginsfolder, then try logging in again. - If access returns, restore the folder’s original name and work with the site administrator to identify the conflicting plugin.
Renaming the folder is a diagnostic toggle, not a permanent fix: disabling all plugins may affect site features. Restore the folder after the test and investigate the cause before leaving the site in an altered state. This is the plugin-conflict test described in WordPress’s login troubleshooting guide.
Check HTTPS, CDN, and reverse-proxy handling
If the loop began after enabling SSL, moving hosts, changing the domain, adding a CDN, or changing proxy settings, the site may be handling the public and origin connection as different schemes. WordPress warns that forcing HTTPS admin access behind a reverse proxy that terminates SSL can create an infinite redirect loop if WordPress does not recognize the correctly configured HTTP_X_FORWARDED_PROTO header. Its HTTPS guide makes clear that this depends on the proxy setup.
Do not add proxy-detection code or change FORCE_SSL_ADMIN blindly. WordPress says FORCE_SSL_ADMIN should only be enabled when SSL is configured on the server. Ask the host or infrastructure administrator to verify where SSL terminates, which scheme WordPress receives, whether the proxy sends the expected forwarding header, and whether redirect rules agree across the CDN, host proxy, Nginx, or Apache. Also ask whether login requests or authenticated sessions are being cached. WordPress lists conflicting SSL and redirect settings among possible causes in its login guide and explains reverse-proxy considerations in its HTTPS guide.
Escalate with details that help diagnose the cause
If the loop remains, send the host or site administrator the exact login URL, the redirect sequence if you can capture it, when the issue began, and recent changes such as a migration, SSL change, CDN addition, or plugin update. Include the server setup, database and PHP versions, operating system, browser, and WordPress version when available; WordPress recommends these details when requesting support in its HTTPS guidance and login troubleshooting documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also mention whether the site is multisite, uses custom cookie constants, or sits behind a reverse proxy. Those details can change which configuration is appropriate, and the host may control settings you cannot safely change from WordPress.
Best Value
Use each test to narrow the next step
- Works in a clean browser session: focus on the affected browser’s cookies and cached data.
- URL settings disagree with the public address: back up the configuration and database, then correct the intended canonical URL consistently.
- Login works with plugins isolated: restore the plugins folder and identify the conflict before re-enabling the site unchanged.
- The issue followed SSL, CDN, proxy, or host changes: ask the host to inspect scheme forwarding, redirect rules, and caching.
Change one variable at a time so each result remains useful. The loop alone does not identify whether the cause is the browser, WordPress configuration, a plugin, or the hosting infrastructure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
