WordPress Login Page Keeps Redirecting in a Loop

What this error means & how to recognize it

• Opening wp-login.php repeatedly returns to the login page.
• The browser reports too many redirects or never finishes loading the login form.
• Login appears to succeed, but the session immediately returns to the login screen.
• The loop occurs in one browser but not another, or disappears in a private browsing window.
• The issue began after a domain change, HTTP-to-HTTPS migration, hosting move, proxy change, or cookie-related configuration change.

Root causes, ordered by likelihood

1. Mismatched siteurl and home values: The WordPress database values may use different domains, protocols, or outdated migration addresses. Login redirects can then move between conflicting URLs.
2. Stale or incorrectly scoped cookies: Cookies from an earlier domain, protocol, or path can contain unusable authentication state and repeatedly send the browser back to login.
3. SSL termination or reverse-proxy disagreement: A proxy may receive HTTPS while the origin interprets the request as HTTP. WordPress can then issue redirects based on the wrong protocol.
4. Incomplete migration or domain change: Configuration or database values may still reference the previous site address.
5. Conflicting redirect, caching, security, or cookie settings: These are less likely than URL, cookie, and HTTPS issues but can override or conflict with normal WordPress login behavior.

How to fix it

1. Confirm whether the problem is browser-specific

Open wp-login.php in a private browsing window or a different browser. If the loop disappears, clear cookies and site data for the affected domain in the original browser, then start a new session.

This test separates stored browser state from a server-side problem; it does not prove that the server configuration is correct.

2. Check siteurl and home

Using the database administration tool or another trusted maintenance method, inspect the siteurl and home entries in the WordPress options table. The table may use a custom prefix rather than the default wp_ prefix.

Before editing them, back up the database and confirm that you are working on the correct site. Both values should:

• Use the current domain.
• Use the same intended protocol, normally HTTPS when the site is configured for HTTPS.
• Avoid an old domain, migration address, or unintended alternate hostname.
• Match the address users actually use to reach the site.

If the values are wrong, correct them consistently through an approved maintenance process and retest the login page. Do not change unrelated settings at the same time.

3. Remove stale login cookies

Delete cookies and site data for the affected domain, close the existing login tab, and open a fresh session. Test again in a private window if possible.

This is particularly useful after changing the domain, enabling HTTPS, or moving the site. If clearing cookies fixes the loop only temporarily, continue with the URL and HTTPS checks rather than treating cookie deletion as the permanent fix.

4. Check HTTPS and reverse-proxy behavior

If a reverse proxy, load balancer, or hosting layer handles SSL before requests reach WordPress, verify that it forwards the correct HTTPS state and that the origin is configured for that arrangement.

The browser, proxy, web server, and WordPress should agree about whether the request is HTTPS. A common failure pattern is an HTTPS request reaching the origin as HTTP, followed by a redirect to HTTPS; the next request is interpreted the same way and the cycle repeats.

Apply changes according to the hosting environment and approved maintenance procedures, then retest wp-login.php. Do not change proxy or server settings without authorization, because they can affect the whole site.

5. Review recent changes

If the loop began after a migration, domain change, SSL change, proxy change, or hosting move, compare the current setup with the previous one. Look for old domain references, inconsistent protocols, and cookie settings that still describe the old environment.

6. Isolate redirect and security conflicts

If the URL values, cookies, and HTTPS arrangement are correct, review redirect, caching, security, and cookie-related configuration. Use an approved maintenance process, preserve a backup, and test one change at a time.

The goal is to identify the setting that changes the login behavior, not to disable protections permanently.

7. Retest and record the first unexpected redirect

After each change, begin with a clean browser session and test the login page directly. Note whether the form loads, whether submitting credentials returns to login, and whether the address changes between domains or protocols.

The first unexpected redirect often points to the setting that needs correction.

Prevention & how to verify the fix

• Record the intended domain and protocol before changing WordPress URL settings.
• Back up the database and configuration before migrations, URL changes, or proxy changes.
• After enabling SSL or a proxy, test both the front end and wp-login.php in a clean browser session.
• Remove or update old domain references after a migration.
• Document how the proxy communicates HTTPS to the origin.
• Change one redirect, security, caching, or cookie-related setting at a time and retest the login flow.