Error WP · configuration
WordPress login redirect loop
You submit correct credentials, WordPress sends you back to the login page, and nothing tells you why.
Also seen as: wp-admin redirects to wp-login · can't log in to WordPress · login page reloads
What it actually means
You enter the right username and password, the page reloads, and you’re at the login screen again. No error about a wrong password — which is the clue.
A wrong password produces an error message. A silent bounce back means the login succeeded and something immediately invalidated the session.
There are three realistic reasons, in order of how often they’re the cause:
- WordPress’s configured site URL doesn’t match the address you’re using, so the cookie is set for a different domain than the one you’re on
- Cookies aren’t being stored or sent
- A plugin is interfering with authentication
Cause 1 is by far the most common, and it’s why this appears right after moving a site, adding HTTPS, or switching between www and non-www.
Why it happens
The site URL doesn't match the address you're visiting
WordPress sets its authentication cookie for the domain in its Site Address setting. If that says http://example.com and you’re on https://www.example.com, the cookie is set for a domain your browser isn’t on — so it never comes back, and the next request looks logged out.
Same scheme, same host, every time. www and non-www are different hosts as far as cookies are concerned.
Cookies aren't being set
A caching plugin caching the login page, a browser extension blocking cookies, or a stale cookie from a previous configuration that’s now invalid.
A plugin is hooking authentication
Security plugins, membership plugins and anything adding two-factor authentication all touch the login process. One misconfigured or half-updated plugin bounces you straight back.
The redirect happens before the cookie is read
A conflicting HTTPS or www redirect in .htaccess can redirect the POST before WordPress processes it, losing the login entirely. This overlaps with ERR_TOO_MANY_REDIRECTS — same root cause, different symptom.
How to fix it
1. Pin the site URLs in wp-config.php
This overrides whatever is in the database and fixes most cases outright:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');
No trailing slash. Both values must match exactly what you type in the address bar — including https:// and including whether there’s a www.
Then visit that exact address. Typing the other variant will bounce you again.
2. Clear cookies for the domain
A stale cookie from the old configuration will keep failing even after the settings are right.
In Chrome: Settings → Privacy → Third-party cookies → See all site data, find the domain, delete. Or just use a private window to test, which starts with no cookies at all.
This step is skipped constantly and it’s why “I fixed it and it still doesn’t work” happens.
3. Disable all plugins over FTP
You can’t do it from the admin panel if you can’t get in:
mv wp-content/plugins wp-content/plugins.off
If you can log in now, a plugin is responsible. Rename the folder back, then rename individual plugin directories one at a time until it breaks again.
Security and caching plugins are the usual culprits.
4. Stop the login page being cached
A cached login page serves someone else’s nonce and cannot work. Most caching plugins exclude /wp-admin and /wp-login.php by default, but check — a misconfigured page-cache rule is a common cause after switching caching plugins.
5. Define the cookie domain explicitly
If you’ve confirmed the URLs are right and it still loops, force the cookie domain:
define('COOKIE_DOMAIN', 'example.com');
define('ADMIN_COOKIE_PATH', '/');
define('COOKIEPATH', '/');
define('SITECOOKIEPATH', '/');
This is worth trying when the site is in a subdirectory or behind a proxy that rewrites the host header.
6. Rule out .htaccess redirects
mv .htaccess .htaccess.bak
If you can log in, a redirect rule is interfering. Restore it and remove any duplicate HTTPS or www redirects — you should have exactly one of each, in one place. The .htaccess generator produces a proxy-safe version.
Afterwards, regenerate WordPress’s rules from Settings → Permalinks → Save.
On CWP specifically
If you’re using a free CWP subdomain, set WP_HOME and WP_SITEURL to the full https:// subdomain address exactly as it appears in your control panel.
We issue SSL automatically, so your site is reachable over both HTTP and HTTPS from the start — which makes the scheme mismatch above easy to hit if the URLs were saved before the certificate was issued.
Related errors
-
REDIR
ERR_TOO_MANY_REDIRECTS
Two rules are sending the browser back and forth at each other, so it gives up after about twenty hops rather than looping forever. -
WSOD
White screen of death
PHP hit a fatal error and error display is turned off, so the server sent an empty page instead of a message. -
DB
Error establishing a database connection
PHP reached the point of trying to talk to MySQL and failed — because the credentials are wrong, the hostname is wrong, or the database server refused the connection.
Post the exact error and your account name on the community forum — staff and other users answer there, and the thread helps the next person who hits this.