WordPress login loop
Right password, no error, and… the login page again. And again.
The login loop is uniquely maddening because nothing is visibly wrong — WordPress accepts your password and then simply fails to keep you logged in, bouncing you back like you never tried. The causes are unglamorous and the fixes are quick, in the right order.
Same-day diagnosis. Flat quote before any fix.
What’s actually happening
Logging in has two halves: proving who you are, and WordPress remembering it — via a cookie your browser stores and sends back. The loop means half two is failing: the cookie isn't being set, isn't being accepted, or a redirect rule is intercepting you before the session sticks.
That framing explains the strange randomness of it — why it can hit one browser and not another, follow an SSL change, or appear right after a security plugin update. Anything that touches cookies, URLs, or redirects can quietly break the remembering half.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
Stale cookies and cache
The boring, leading cause: your browser is replaying old session cookies that no longer match. Wrong site URL values and recent SSL changes make it worse.
A URL mismatch — www vs non-www, http vs https
If WordPress's stored site URL differs from how you're accessing it, the cookie gets set for one address and read from another. Classic after SSL installs and migrations.
A security or redirect plugin misfiring
Login-protection plugins, redirect managers, and 'force HTTPS' tools all sit exactly on this path. An update or misconfiguration turns protection into a bouncer who won't admit the owner.
Corrupted .htaccess or a broken update
Rewrite rules gone wrong can trap wp-admin in a redirect cycle — sometimes visible as the loop, sometimes as 'too many redirects.'
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Try a private window, then another browser
If incognito works, it's cookies and cache — clear them for your site and you're out. This solves a genuinely large share of loops in ninety seconds.
- 2
Try the alternate address
Add or drop the www, or try https explicitly. If one variant logs in fine, you've found the URL mismatch — note which worked; that's the config fix in one clue.
- 3
Check from a second device
Phone on cellular looping too? Then it's server-side — plugin, config, or rewrite — and browser fixes are done helping. That's the handoff point.
Stop and call when…
- Incognito, other browsers, and other devices all loop — it's in the site, not your browser
- The loop appeared right after a security plugin, SSL, or migration change
- You're tempted to edit wp-config or .htaccess by hand for the first time
From there it’s our job: same-day look, flat quote, and the $229 flat repair covers most cases of exactly this.
Single Error Fix — buy it now, skip the hunt.
One error, hunted down and fixed — 500s, white screens, redirect loops, broken pages.
Covers one specific error or broken behavior on one site. Diagnosis, the fix, and a plain-English note on what happened. If we can't fix it, you get a full refund.
Questions we hear a lot.
Why does incognito mode fix it?
Private windows start with zero cookies, so WordPress issues fresh ones instead of choking on stale mismatches. It proves your password and the site's login machinery both work — and points the finger squarely at cached state in your everyday browser.
Could this be a hack?
Usually not — loops are overwhelmingly config and cookies. But if your correct password is now REJECTED (different symptom), or admin emails changed without you, treat it as a possible compromise and see our hacked-site checklist instead. The two get confused because both lock you out.
It loops only on my phone. Same problem?
Same family — one device holding stale cookies or an aggressive mobile cache. If clearing that browser fixes it, done. If it follows the account across devices, it's server-side and worth a look.
What if I'm locked out entirely?
There are clean recovery routes — resetting sessions at the database level, disabling the interfering plugin without the dashboard — that don't involve guessing at config files. That's the flat-price fix: back into your own site the same day, cause named, loop retired.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
Back into your own site, today.
Send the symptom, get a same-day look and a flat quote from the developer who's fixed this exact thing more times than either of us can count.